If you run a UK agency that uses contractors, HMRC's IR35 rules are probably the single biggest compliance risk on your books. Not corporation tax. Not VAT. Not payroll errors. IR35.
HMRC has been actively targeting the agency sector for years now. They know agencies are heavy users of limited company contractors. They know the rules changed in 2021 to put the responsibility on you, not the contractor. And they know many agency founders still haven't done a proper audit of their contractor engagements for IR35 compliance.
This article walks you through exactly how to run that audit. Before HMRC decides to run one for you.
Why Your Agency Needs to Audit Contractor Engagements for IR35 Compliance
The off-payroll working rules (commonly called IR35) shifted liability from the contractor to the client and fee-paying agency in April 2021 for medium and large organisations. Your agency counts if it meets two of these three criteria: annual turnover over £15 million, balance sheet over £7.5 million, or more than 50 employees (for financial years beginning on or after 6 April 2025; previously £10.2 million and £5.1 million). Because size is tested over two consecutive financial years using filed accounts, the higher thresholds first affect off-payroll status determinations in the 2027/28 tax year at the earliest.
Most agencies with 10+ people and £1m+ revenue will be medium or large. Many smaller agencies are too but don't realise it. If you're caught, you are responsible for determining the contractor's employment status and issuing a Status Determination Statement (SDS) before the engagement starts. You are also liable for any unpaid tax and National Insurance if HMRC later decides the determination was wrong.
The liability can be enormous. HMRC can go back six years. The tax bill includes unpaid income tax, employee NI, employer NI, and interest. Plus penalties of up to 30% of the tax due, or more if they decide it was deliberate.
A proper audit now is cheap insurance against that outcome.
Step 1: List Every Contractor Engagement You Currently Have
Start with the basics. You cannot audit what you have not listed.
Pull every contractor your agency has engaged in the last six years. Include:
- Limited company contractors (PSCs)
- Umbrella company contractors
- Freelancers working through their own limited company
- Contractors who started before April 2021 and are still working with you
For each engagement, record the contractor's name, their limited company name, the start date, the end date (if applicable), the role they filled, and the rate they were paid. If you use a system like Xero or FreeAgent for your contractor payments, you can export this data directly. If you are still using spreadsheets, now is the time to get organised.
Most agencies I work with find contractors they had forgotten about. A web designer who did a three-month project in 2019. A copywriter who worked through an umbrella company for six months in 2020. A developer who started as a full-time contractor in 2018 and is still on your books today.
All of them need to be reviewed.
Step 2: Review the Status Determination Statements (SDS)
For every contractor engagement starting after April 2021, you should have issued a Status Determination Statement before the work began. The SDS must state whether the engagement is inside or outside IR35 and give the reasons for that decision.
If you cannot find an SDS for a contractor who started after April 2021, that is a red flag. HMRC will treat that as a failure to comply, regardless of whether the determination itself was correct.
For contractors who started before April 2021 and are still working with you, you should have reassessed their status when the rules changed. If you did not, you need to do it now.
What a proper SDS looks like:
- Names of the client, agency, and contractor
- The start date of the engagement
- A clear statement: inside IR35 or outside IR35
- The reasons for the decision, referencing the specific employment status tests
- Evidence considered (contract terms, working practices, responses to CEST questions)
- Date issued
If your SDSs are generic one-liners, they will not hold up under scrutiny. HMRC wants to see that you actually considered the facts, not that you copied a template from the internet.
Step 3: Assess Each Engagement Against the Employment Status Tests
This is where most agencies fall down. They rely on the contract terms alone. HMRC looks at the actual working practices, not just what is written in the contract.
The key tests are:
- Substitution: Can the contractor send someone else to do the work? If the contract says yes but in practice you would never allow it, HMRC will look at the practice, not the contract.
- Control: Who decides what work is done, when it is done, and how it is done? If your project manager tells the contractor exactly what to do and how to do it, that points to employment.
- Mutuality of obligation: Is the agency obliged to offer work, and is the contractor obliged to accept it? Regular, ongoing work with no right to refuse points to employment.
- Financial risk: Does the contractor bear any financial risk? Do they have to rectify mistakes at their own cost? Do they provide their own equipment?
- Part and parcel of the organisation: Is the contractor treated like an employee? Do they attend team meetings, use a company email address, have a line manager, work set hours?
For each contractor, score them against these tests based on what actually happens day to day, not what the contract says. If the reality points to employment, the engagement is inside IR35, regardless of what your contract says.
Step 4: Use the CEST Tool but Understand Its Limits
HMRC's Check Employment Status for Tax (CEST) tool is free and gives you a determination that HMRC will stand by if you answer the questions accurately. That is the official line.
The reality is more nuanced. CEST works well for straightforward cases. A contractor who works full-time, uses your equipment, takes direction from your project manager, and has been with you for two years will get an inside IR35 result. That is correct.
But CEST struggles with complex arrangements. If your contractor works through a separate limited company, provides their own laptop, works from home three days a week, and has multiple clients, CEST can produce inconsistent results depending on how you answer the questions.