Right to Work Audit: How to Prepare for a Home Office Inspection
A Home Office visit doesn't announce itself months in advance. Officers can arrive to inspect your right to work records, and what they find — or don't find — decides whether you walk away clean or with a civil penalty of up to £45,000 per worker. The employers who come through an inspection well are the ones who audited themselves first. This guide shows you how to run that self-audit before someone else does it for you.
This guide is for informational purposes only and does not constitute legal advice. For advice on your specific situation, consult a qualified immigration solicitor.
Why audit your own records
The civil penalty regime is built around a simple question: did you take the prescribed steps to check each worker's right to work, and can you prove it? A right to work audit answers that question for yourself, on your own timetable, while you still have time to fix gaps.
The alternative is finding out during an inspection — when a missing record or an expired statutory excuse can't be undone. A self-audit costs an afternoon. A missed check can cost £45,000.
What the Home Office checks
In an inspection, officers are looking for evidence that you established and maintained a statutory excuse for every worker. In practice they want to see:
- A compliant right to work check was carried out before each person started work
- The check used an approved method — online share code, manual document check, identity document validation technology (IDVT) via a certified provider, or the Employer Checking Service
- For time-limited permission, a follow-up check was done before the statutory excuse expired
- Records are held in an unalterable format and retained for the right period
A genuine right to work that you failed to check properly is still a breach. The penalty turns on your process, not the worker's ultimate status.
The records you must hold
For every worker, you should be able to produce:
- A copy of the document or online check response. For manual checks, a clear copy of the documents you saw. For online and Employer Checking Service checks, the verification response. Copies must be in a format that can't be altered — a PDF or JPEG, not an editable file.
- The date you carried out the check. This proves the check happened before employment started.
- For time-limited permission: the expiry date of the statutory excuse and the date of any follow-up check.
- For Employer Checking Service cases: the Positive Verification Notice and its date.
Keep these securely for the duration of employment plus 2 years, then destroy them securely. Holding them longer than necessary is a data protection issue; holding them for less is a compliance gap. Our right to work checklist template sets out the full record-keeping checklist.
How to run a self-audit
Work through your whole workforce, one person at a time:
- List every current worker. Include anyone you'd struggle to categorise — agency staff, recent starters, long-tenured employees whose checks predate your current system.
- Find the check record for each one. No record is a red flag — it means no provable statutory excuse.
- Confirm the check was done before they started. A check done after the start date doesn't give a statutory excuse for the gap.
- Identify everyone on time-limited permission. For each, note the statutory excuse expiry date — the visa expiry, or 6 months from a Positive Verification Notice.
- Check each follow-up is current or scheduled. Anyone whose statutory excuse has lapsed without a follow-up is your highest-priority gap.
- Verify retention. Are records unalterable and kept for the right period?
The step that catches most micro-employers isn't the initial check — it's step 5, the follow-up check. One check at hire feels like the job is done, and the renewal slips.
The gaps that trigger penalties
The most common findings in an inspection are:
- No check on file for a worker who turns out not to have the right to work
- A check done after the start date, leaving an uncovered gap
- A lapsed follow-up — the initial check was fine, but the statutory excuse expired and was never renewed
- Selective checking — only checking workers who "look foreign," which is unlawful discrimination under the Equality Act 2010 and not a defence
- Editable copies that don't meet the unalterable-format requirement
You can estimate your exposure with our penalty risk calculator, and see exactly how a civil penalty is calculated — including the reductions available if you've cooperated and kept good records.
Make it a recurring review, not a one-off
A self-audit is most useful as a regular habit, not a panic response to news of enforcement activity. A monthly or quarterly review — checking which statutory excuses are approaching expiry and which follow-ups are due — keeps you continuously inspection-ready instead of scrambling. Our ongoing compliance guide sets out a simple review cadence, and the follow-up timeline calculator flags the dates that need action.
The bottom line
A right to work audit is you doing the Home Office's job before they do. List every worker, confirm a compliant check exists for each, fix lapsed follow-ups first, and keep records unalterable for employment plus 2 years. The afternoon you spend auditing is cheap insurance against a penalty that starts at £45,000 per worker.