Examples

Examples of labour supply chain risks and applying assurance practices, including details of real HMRC investigations.

Assurance practice examples

Examples of due diligence checks and assurance practices that some larger businesses have told us about include:

  • where appropriate, verifying membership of gangmasters and Labour Abuse Authority for labour agency subcontractor which gives an independent commitment to minimum living wage and adherence to the modern slavery legislation
  • if the work comes within the scope of the Construction Industry Scheme, advising subcontractors of the VAT and end user status and if the VAT reverse charge will be applied to any payments made to them
  • checking that the subcontracted business has appropriate insurance cover for the work that they will be undertaking — this might include employer’s liability, public and product liability, contractors’ risk and professional indemnity
  • checking the number of employees to see if the size of the workforce is appropriate to the size of the business
  • sampling payslips from a section of the workforce directly — in organised labour fraud models, fraudulent documents are often used by non-compliant businesses to hide issues from legitimate businesses
  • producing educational training material with HR to upskill employees

Cross-risk example: waste disposal

This is an example of where robust assurance practices can assure multiple risks.

Criminals aim to profit from applying the wrong landfill tax rate but also from theft of VAT, Income Tax and Fuel Duty through waste disposal supply chains. Waste producers, brokers, hauliers and waste processors may all be targeted.  On larger contracts, where a temporary workforce may be required by the supplier, risks relating to the supply of labour may also be present.

Undertaking due diligence to get information about the supply chain and workforce enables the business to know who is dealing with the waste disposal and transporting it. This information helps with their risk assessment and they can check the correct rate of landfill tax is being applied.

This can help to reduce the likelihood of the business being deemed joint and severally liable for the illegal dumping or misdescription of waste.

A person is liable to pay landfill tax if they dispose of waste on an unauthorised waste site (UWS). Any persons who knowingly causes or allows the disposal of waste at an UWS may also be liable to pay this.

The following persons will be joint and severally liable:

  • the persons making the disposal
  • any person who knowingly causes or facilitates the disposal to be made

When determining if a person knowingly caused or facilitated the disposal, the following may be joint and severally liable:

  • the waste broker or dealer involved in the disposal
  • the waste haulier involved in the transport of the waste to the UWS
  • the landowner
  • the waste producer
  • any company officers

Sector-based risk example: security workforces

HMRC has seen a number of risks associated with non-compliant pay and employment arrangements for these workforces.

Non-compliance identified within some supply chain arrangements includes:

  • employment status non-compliance — involving self-employment, gross payments and cash in hand arrangements
  • organised labour payroll fraud
  • complex tax avoidance schemes
  • wages being routed through offshore jurisdictions
  • umbrella arrangements making disguised payments to workers

Supply chain assurance ideas include:

  • incorporate the Security Industry Authority (SIA) accreditation as a minimum requirement at procurement stage
  • stipulate onward sub-contractors should also have Approved Contractor Scheme (ACS) accreditation
  • regular audits to verify compliance with contractual requirements

Specific due diligence checks to consider are:

The SIA and ACS accreditation

This means:

  • the SIA considers the arrangements of the supplier’s relationship with its security workers, including due diligence, as part of accreditation requirements
  • a business must give consent for HMRC to disclose information about its tax compliance to the SIA to become accredited

Case example: construction sector fraud risk case

This is an example of a HMRC supply chain investigation which has been simplified for demonstration purposes.

In this case there was a contractor sitting at tier 2 in the supply chain, which supplied multiple larger businesses above it. For the purpose of this example, we have focussed on one business.

In this case there were 7 tiers of businesses in the chain before any workers became evident.

There was evidence of illegal workers in this chain and several of the businesses were defaulters for VAT. The amount of VAT that had been fraudulently diverted from HMRC was £3.5m. Where businesses had gone missing following HMRC contact, they were quickly replaced with other businesses that continued to commit VAT fraud.

HMRC issued tax loss letters to all businesses above the defaulters, including the end-users. The Kittel principle was applied to multiple companies across the chain. This resulted in them being denied their VAT Input Tax on the associated transactions and they also received penalties.

Compulsory VAT deregistration and Construction Industry Scheme gross payment status removal was also undertaken further down the supply chain.

The larger business also received a tax loss letter, naming the tier 2 contractor. Although not necessarily involved in the fraud, this identified the supply chain that the larger business could then focus on, having several large LSCs.

The business was concerned that their operations could be disrupted with some companies lower in the contractual chain going missing. This could have a knock-on effect on their ability to fulfil their contract with the end-user, which could incur financial penalties. They did not have information about who was in their chain below their direct supplier.

They talked to their immediate supplier, at tier 2, and reinforced some of the contractual conditions they had relating to their onward sub-contracting.

The tier 2 supplier subsequently engaged with a different business at tier 3, who employed the workers directly on their payroll.

The larger business reviewed their own assurance practices and made some changes to give them better information about their chain. They introduced a supplier requirement to report information on sub-contractors below if this changed. They linked their finance systems to HMRC’s VAT checker tool, helping them automate frequent VAT status checks on all their direct suppliers. They also introduced stronger enforcement procedures for suppliers, including terminating contracts and removal from preferred supplier frameworks.

Result

The action taken at different points in the chain resulted in a shrinkage of the chain and no further concerns were noted during this contract. The larger business felt that the changes gave them more confidence in their practices and their ability to protect themselves from future issues. Whilst the changes they made did improve their ability to check compliance aspects of their direct suppliers more frequently and record the details of the onward sub-contracted businesses, HMRC advised that this would not necessarily alert them to issues further below in the chain.

HMRC recommended the following practices for the business to consider:

  • review their other chains for similar risk and act to address any concerns
  • audit the workforce periodically during the contract — do checks on payslips and the arrangements of employment-on a sample basis if this was unfeasible in total
  • do independent checks on the businesses below the direct supplier, to verify information and inform risk assessment
  • adding contractual requirements for information to be provided about businesses that their suppliers engaged
  • extending their use of the VAT checker tool to include the businesses provided by their suppliers
  • whilst input tax was not denied on this case, the business was advised that this would be considered should further tax losses be identified

Case example: assessing and managing a risk

This scenario has been created based on aspects of real HMRC investigations.

Customer A has recently been awarded a high-value contract that will involve a large number of temporary workers to fulfil it. 

They have run a tendering process and have selected an agency supplier customer B following an extensive due diligence process. The supplier does not have many employees but has assured the customer they will be able to deliver the scale of supply needed. Customer A knows they will be sub-contracting onwards.

Customer B uses a tendering process to select their direct supplier (supplier C), who will source and funnel workers through to customer B. Supplier C is an umbrella company with only a few employees.

Customer B receives Key information Documents (KIDs) and invoices for workers engaged through supplier C. They record the details of the business employing each worker and retain the KIDs. They pay the timesheet-related invoices for the workers and recharge this plus their fee to customer A.

Nine months into the contract, customer A asks customer B to report on the latest position regarding compliance of the chain. Due to the number of chains, they manage at any one time, they have a contractual agreement in place that requires customer B to assure them of the compliance and integrity of the chain below, including tax compliance, worker safeguarding and due diligence.

Customer B does do sample payslip sample checks and updates the database of any changes to the KIDs and employer details.

Customer A is initially satisfied with the report which states ‘no change to risk-no risks identified’ but wants to verify some of the information as part of their assurance practices. They initially assessed the chain as low risk and want to check this is still the case. Customer A’s risk consideration included the size of workforce engaged and potential serious disruption with financial contractual penalties and reputational damage if they fail to deliver on time, to cost. They have stipulated in contract that all workers must be engaged through payroll.

Customer A selects some of the employing businesses details, provided by customer B and uses Companies House and the VAT checker to verify the information.

The information they gather causes them some concern and they refer to HMRC guidance.

Information gathered included:

  • directorship details
  • VAT registration status
  • the number of businesses engaging the workers
  • tiers in the chain

What it tells them are:

  • several directorships have changed to foreign national directors
  • some employing businesses have very limited trading history
  • there are umbrella companies in the chain with no workforce
  • most businesses are VAT registered
  • there are a lot of businesses at the bottom of the chain employing workers

The guidance indicates that there could be a potential risk of organised labour fraud. Customer A discusses their concerns with customer B and asks them to provide more information about what they have done assurance wise.

Customer B reviews their risk assessment, drawing on more information from the KIDs and worker payslips.

They identify that there could be mini umbrella companies at the bottom of the chain. This is indicated by changes to directorship, the number of umbrella companies in the chain and the fact that the workforce is spread amongst many smaller businesses without a clear commercial reason.

The businesses do appear to be VAT registered and payslips show deductions for Income Tax and National Insurance that appear correct.

Customer B is concerned about potential reputational damage as they are considered to be a preferred supplier by many larger businesses that offer high value contracts. They know that they could also be associated with tax non-compliance and are keen to avoid or limit any financial consequences.

Overview

Both customers understand what risks could be present and have used due diligence procedures to gather information to assess the risk more fully, confirming a likely risk based on risk indicators.

Next actions are:

  1. Customer B should now decide what action to take, and this should include notifying HMRC of their concerns promptly. They had information available to identify the risk indicators but have failed to do so. 
  2. Customer A should also consider what they might need to do as they could also be associated with tax non-compliance and should also report their concerns to satisfy their own procedures. They might consider whether customer B offers them the level of integrity and reliability they are looking for on this contract. 
  3. Identifying the risk quickly means they can take action to limit its potential impact. They would both be keen to avoid operational disruption and might consider how they can move the workforce closer to them and out of a mini umbrella company model. This might involve customer B using a different supplier (multiple) instead of supplier C to employ the workers directly. This moves the workers closer and makes it easier to assure the chain. 
  4. They might enforce any contractual terms and conditions with supplier C relating to supply chain assurance. 
  5. Customer A and B should review their practices following action and make any changes necessary that would reduce the risk of repeated concerns.

HMRC considerations

Customer A

Strengths in current practices included:

  • the contract includes specific supplier requirements relating to onward assurance of the chain
  • the contract includes stipulations about worker engagement for example payroll requirement
  • there are systems and processes in place to review the chain during the contract
  • efforts are made to verify the information that has been provided to them
  • they have an understanding of potential risk indicators and use HMRC guidance to inform their risk assessment

Recommendations for the business to consider include more frequent reviews — the customer may choose to do, or commission, periodic audits of the chain alongside the usual reviews with the supplier.

Add contractual requirement for suppliers to:

  • notify of any changes to businesses they have engaged below them
  • limit how many businesses are sub-contracted between them and the workers

Supplier B

Strengths in current practices include:

  • there are systems and processes in place to record the details of all businesses employing the workers and keep this updated
  • sample checks are undertaken on payslips

Recommendations for the business to consider:

  • build in specific checks to mitigate the identified risk in future and inform ongoing risk assessment
  • use Companies House to provide reports on changes to directorship of the employing businesses
  • check the employers name on the payslip matches the name provided on the Key Information Documents and how they are engaged

Review, and where required, add contractual requirements that:

  • restrict or limit onward sub-contracting to bring the workforce closer
  • give them practical enforcement options for non-compliance with any requirements