Are you really IR35 compliant? Why you need an IR35 audit
IR35 used to be seen as a contractor problem. Not any more.
Since the off-payroll reforms, responsibility for status decisions, and in most cases the liability, sits with medium and large end-clients and fee-payers. If HMRC later decides your determinations were wrong, you could face backdated Income Tax and National Insurance, interest on the late payment, penalties that scale with how careless or deliberate HMRC judges the behaviour to have been, and an enquiry that reaches back several years. Since April 2024 a set-off rule lets HMRC credit tax the contractor has already paid against what the deemed employer owes, which reduces the bill but does not remove it, and does nothing for the interest, penalties or disruption; the detail is in our note on the off-payroll set-off.
Beyond the money, getting IR35 wrong damages your standing with contractors, clients and HMRC, and ties up leadership and legal time while you deal with it. An IR35 audit is how you get ahead of those risks.
What is an IR35 audit?
An IR35 audit is a structured review of how your organisation engages and manages contractors, with one aim: to test whether your IR35 decisions and processes would stand up to scrutiny. A thorough audit looks at your current contractor population and the routes they come through; contracts and working practices against the IR35 tests; how Status Determination Statements are created, documented and communicated; how you evidence reasonable care; and how responsibility is split between HR, procurement, legal, finance and hiring managers. The outcome is a clear picture of where you're compliant, where you're exposed and what to fix.
The real risks of getting IR35 wrong
IR35 isn't just another policy. If HMRC finds you've treated inside-IR35 engagements as outside, or can't show reasonable care, you can be liable for the employment taxes that should have been paid, interest from the date they were due, and penalties on top. Public-sector settlements have already run to tens of millions of pounds, which is a clear warning of what's at stake. The non-financial costs are real too: reputational damage in the contractor community, closer HMRC attention elsewhere in the business, and months of management distraction.
What a good IR35 audit should cover
Map your contractor landscape. Who is engaged, through what route (personal service company, umbrella, agency), in which teams and on what terms. This baseline is what lets you spot patterns and risk hotspots.
Review contracts and working practices. HMRC looks at how people actually work, not just what the contract says. A good audit compares substitution, control and mutuality of obligation in practice; on-site and remote expectations; and hours, supervision and how integrated the contractor is with permanent staff. The warning signs are set out in the signs a contractor engagement may be inside IR35.
Assess your SDS process and reasonable care. You need to show that determinations are systematic, consistent and documented, not guesswork: who completes them and how they're trained, what tools and guidance they use, and how decisions and their rationale are recorded and revisited.
Turn findings into priorities. Immediate fixes, medium-term improvements and any structural changes needed to stay compliant, written as a plan the business can act on.
How Vermelo's IR35 audit works
Our audit is built to clarify your risk, by reviewing where you may be exposed to backdated tax, NI, interest and penalties; to test your processes, including SDS workflows, documentation, governance and reasonable care; and to support practical change, translating findings into concrete steps for HR, procurement, finance and hiring managers. The audit is an operational review, not legal advice: it gives your advisers something solid to work from.
If your contractor population has outgrown a spreadsheet, the audit is also the natural first step towards bringing it under one managed process.
When should you prioritise an IR35 audit?
Move IR35 up the agenda if your contractor population has grown since the reforms; different teams handle contractors in different ways; you're not confident in how SDSs are created or stored; you've inherited legacy contractor arrangements from before April 2021; you're acquiring a business with contractors in it (see what changes for IR35 on completion); or leadership is asking "are we definitely safe on IR35?" If even one of those rings true, an audit gives you visibility, and a plan, before HMRC comes asking.
Download the IR35 non-compliance risks factsheet
Our "Why you need an IR35 audit" factsheet gives stakeholders a concise, shareable overview of the financial and reputational risks of non-compliance, how backdated tax, NI, interest and penalties escalate, why reasonable care and a strong SDS process matter, and how an audit finds the gaps. There's also a short video: Are you really IR35 compliant?.