IR35 Compliance in Recruitment: Are You at Risk of Costly Non-Compliance?
Post updated April 2026
Since April 2021, medium and large businesses have carried the responsibility for deciding whether each contractor they engage is inside or outside IR35. Most know that. Fewer know whether the engagements they have running today would survive a look from HMRC. This post is about that second question: the signs you're at risk, what it costs, and what a good process looks like. It's general commentary, not tax or legal advice, and the notes at the end say where to get the real thing.
What is IR35, in one paragraph
IR35, or the off-payroll working rules, is tax legislation aimed at "disguised employment": people working through their own limited company whose day-to-day arrangement looks like a job. If an engagement is inside IR35, the fee payer deducts tax and National Insurance as if the contractor were an employee. The full background, including the public sector rules that arrived in 2017, is in how IR35 changes the way you hire contractors.
Who is responsible for IR35 compliance?
If you're a medium or large business, you are. You decide the status of each engagement, put the decision and the reasons in writing, and pass it down the chain. If you're small, the contractor's company decides, as it did before 2021.
Check which you are, because the line moved this year (2026). From 6 April 2026 the off-payroll rules use the updated Companies Act test: a business is small if it meets two of three conditions: turnover of no more than £15 million, a balance sheet total of no more than £7.5 million, and no more than 50 employees. The previous figures, £10.2 million and £5.1 million, no longer apply. Some businesses that were medium last year are small this year, and if you're near the line, ask your accountant, because the qualifying rules look at more than one year. If you're near the line, ask your accountant, because the qualifying rules look at more than one year, and the small-company test is explained in more detail here.
Signs a contractor engagement may be inside IR35
HMRC and the tribunals weigh three things first, then look at the overall picture. If several of these apply to a contractor you're treating as outside IR35, the determination needs another look.
You control the work. You decide how, when and where it's done, move the contractor between tasks, and expect them to follow internal policies like a member of staff. Genuine contractors are engaged for a defined piece of work and decide how to deliver it.
They couldn't send someone else. A right of substitution that exists in the contract but would never be accepted in practice is worth little. If the engagement depends on that specific person turning up, it looks like personal service.
Work keeps flowing and they keep taking it. Mutuality of obligation: you're expected to keep offering work and they're expected to accept it, with no defined end point. Twelve months of rolling extensions on an hourly rate with no deliverable is a classic pattern.
They carry no financial risk. Paid regardless of outcome, never putting right defective work at their own cost, no investment in their own business. Contractors run businesses; employees don't.
They're part and parcel of the organisation. Company laptop and email, a line manager, appraisals, an entry in the org chart, staff benefits, an invitation to the Christmas party. The laptop alone matters less than people think, especially where security policy requires it; the laptop plus everything else matters a great deal.
None of these decides it alone. It's the whole picture, and what actually happens day to day counts for more than what the contract says.
What does IR35 non-compliance cost?
If HMRC decides an engagement you treated as outside was inside, you owe the tax and National Insurance that should have been deducted, plus interest, normally going back four years, six where it judges you careless and up to twenty where it judges the failure deliberate. Penalties on top run up to 30% of the lost tax for carelessness, 70% for deliberate failure and 100% where it was deliberate and concealed. Then there's the part that doesn't appear on the assessment: the audit that follows, the contractors who leave, and the story that gets told about you. The NRW settlement is what that looks like at scale.
How do you make sure you're IR35 compliant?
Review every engagement on its own facts. Job titles and contract templates don't decide status; the working relationship does. A blanket "everyone is inside" decision fails the reasonable-care test just as surely as no decision at all.
Use HMRC's CEST tool as a structured starting point, answer it against the real arrangements rather than the ideal ones, and keep a record of the inputs. Get a specialist view on anything borderline, high value or long running.
Keep the evidence. Contracts, the determination and its reasons, the correspondence, any challenge and your response. If HMRC asks, the question is not only what you decided but whether you can show how.
Revisit determinations when the facts change. A contractor engaged for a three-month project who is still there two years later, now line-managing people, is not the engagement you assessed. The same applies when the business itself changes hands: what a merger or acquisition does to contractor IR35 status.
One way to make determinations consistent is a managed programme; here's how to tell whether you need a recruitment MSP. And if you are growing, bear in mind that IR35 is one of five bottlenecks that surface when regulated firms scale hiring.
What does a good IR35 process look like?
Good IR35 management isn't only about avoiding penalties. It gives contractors certainty, keeps projects moving and stops the last-minute scramble when an extension lands. A working process has six parts.
Status is considered at the point of hire, before the contractor starts, not when the first invoice arrives.
Each engagement gets its own determination, with reasons, and the contractor and the agency both receive it in writing.
There's a written disagreement process, and challenges are answered within the 45-day limit.
Inside-IR35 roles have a plan: a compliant engagement route, a rate conversation and a contractor who understands what it means for them. Note that from April 2026 agencies and, where there's no agency, end clients carry joint liability for PAYE that an umbrella company fails to pay, so the route matters as much as the decision.
Determinations are reviewed at renewal and whenever the working arrangements change.
Everything above is recorded somewhere you could hand to HMRC tomorrow.
How Vermelo helps
Two ways. An IR35 audit reviews your current contractor engagements against the working reality rather than the contract wording, gives you a documented determination and reasons for each one, and flags the roles that need a different engagement route. Our managed service provider (MSP) solution then runs contractor hiring end to end: sourcing, pre-employment checks, the paperwork behind each status determination, compliant engagement and payroll routes for inside-IR35 roles, and the reporting that shows you where every contractor stands. We don't replace your tax adviser; we make sure the process exists, the evidence is there and nothing slips through at renewal.
If you're not confident your current engagements would pass, get in touch and we'll walk through them with you.
01892 553360 | info@vermelorpo.com
This article is general commentary on the off-payroll working rules as we understand them at the time of writing. It isn't tax or legal advice. IR35 status depends on the facts of each engagement, so take specialist advice before relying on anything here.
Sources: Forvis Mazars: new IR35 off-payroll thresholds from 6 April 2026, Kingsbridge: IR35 small company threshold changes 2026, HMRC: Check employment status for tax (CEST)
IR35 risk, answered
The written decision a medium or large client must give for each off-payroll engagement, saying whether the role is inside or outside IR35 and why. It goes to the contractor and to the agency or other party you contract with, and it has to be produced with reasonable care: a blanket "everyone is inside" decision, or one copied from a job title, does not count. Until a valid SDS has been passed down the chain, the liability for tax and National Insurance stays with you.
Yes. The rules require the client to run a disagreement process: the contractor (or the agency) can put their objections in writing, and you have 45 days to consider them and either confirm the original decision with reasons or issue a new SDS. Ignore the challenge, or miss the 45 days, and the liability sits with you. A written process, applied consistently, is one of the cheapest pieces of IR35 protection there is.
Up to a point. HMRC says it will stand by a CEST result provided the information entered is accurate and the tool is used in line with its guidance, so a determination based on the real working arrangements, with the inputs recorded, carries weight. It gives no answer at all in a proportion of cases, and it is only as good as what you type in. Treat it as a structured starting point, keep the evidence behind each answer, and get a specialist view on anything borderline or high value.