ISO & Compliance Blog

Right to Work Checks: A Step-by-Step Compliance Guide

Few compliance obligations carry as much direct financial risk for small employers as right to work checks — and yet they’re often treated as a quick box-ticking exercise during onboarding, rather than the rigorous, evidence-based process the law actually requires. Getting it wrong isn’t a minor administrative slip. An employer may face a civil penalty of up to £60,000 for each illegal worker where the prescribed checks were not completed correctly.

The good news is that carrying out a compliant check properly gives you strong legal protection — and it’s a process you can build into your hiring routine with confidence, once you understand exactly what’s required. This guide walks through the correct process step by step, including important changes taking effect later in 2026.

In this article:
– Why right to work checks matter so much
– The three types of check, explained
– Step-by-step: how to carry out a compliant check
– What’s changing from October 2026
– Common mistakes employers make
– Building a reliable ongoing process

Why Right to Work Checks Matter So Much

The legal framework behind these checks sits within immigration law, not just employment law. The Immigration, Asylum and Nationality Act 2006 sets out the framework for preventing illegal working and gives the Home Office power to impose civil penalties and prosecute employers who employ workers without permission.

The financial exposure is severe and has recently increased. Employers can be issued with a civil penalty of up to £45,000 per illegal worker for a first breach and up to £60,000 per illegal worker for repeat breaches. Crucially, penalties are applied on a strict basis — there’s no partial credit for good intentions or incomplete paperwork. Civil penalties are issued on a strict basis: either you completed a prescribed check and kept the evidence, or you did not.

The upside is that doing the check correctly gives you a legal shield. A correct online check can establish a statutory excuse against a civil penalty, provided the employer confirms the person’s identity, checks any work restrictions and keeps evidence.

The Three Types of Check, Explained

Depending on the individual’s nationality and documents, there are broadly three routes:

1. Manual document checks — physically examining original documents (such as a passport) in the presence of the holder, checking they appear genuine and belong to the person presenting them.

2. Home Office online checks via share code — used for individuals with digital immigration status (such as those with visas or settled status). The employer needs the nine-character code and the person’s date of birth to run the check through the official government service.

3. Identity Document Validation Technology (IDVT) checks — a digital alternative available for British and Irish citizens holding a valid passport. A right to work check using Identity Document Validation Technology (IDVT) via the services of a digital provider (British and Irish citizens with a valid passport or Irish passport card only) is carried out through a certified Digital Verification Service (DVS) provider rather than by physically examining the document yourself.

For non-UK citizens, the position is more straightforward in one respect: this always involves a Home Office online check, rather than a manual or IDVT alternative.

Step-by-Step: How to Carry Out a Compliant Check

1. Establish which check type applies. Ask the candidate about their nationality and status early in the recruitment process so you know which route to follow.

2. For share-code checks: obtain the nine-character share code and date of birth, then verify these directly through the official Home Office online checking service — never accept a screenshot or printout as a substitute.

3. For manual checks: examine the original document in the physical presence of the holder (or via a live video link where permitted), checking photographs, dates, and security features carefully.

4. For IDVT checks: use a certified Digital Verification Service provider. The individual will need to generate a different type of share code in order that you are provided with the correct information for identity checking purposes.

5. Retain evidence properly. You must retain a clear copy of the output delivered by the digital verification service (DVS) used, for the duration of the candidate’s employment, plus two years after their employment has come to an end.

6. Diarise follow-up checks where needed. If the individual’s right to work is time-limited, the employer must carry out another check before that protection expires — missing this renewal removes your statutory excuse.

What’s Changing From October 2026

This is an area of active regulatory change, and employers should be tracking it now rather than waiting. A draft revised code of practice was published on 30 June 2026 and is due to take effect from 1 October 2026, extending the reach of the civil penalty scheme.

The scope of who needs checking is also widening. There has been a significant update in relation to right to work checks for all businesses, which will come into force from 1 October 2026, substantially changing the processes and policies employers and sponsors need to implement to maintain compliance.

Given the scale of the penalties involved, businesses should treat the run-up to October 2026 as a priority compliance review window, not an afterthought.

Common Mistakes Employers Make

– Accepting a screenshot or printed share code result instead of running the live online check yourself.
– Failing to repeat checks for time-limited status before the expiry date, losing the statutory excuse.
– Not retaining evidence for the required retention period — a gap often discovered only when an audit or penalty notice arrives.
– Treating verbal assurances as sufficient. As established, good intentions, verbal assurances and partial paperwork do not count.
– Inconsistent processes across hiring managers, particularly in businesses without a single, written right-to-work procedure that everyone follows.

Building a Reliable Ongoing Process

Right to work compliance works best as a standardised, written procedure rather than something left to individual judgement:

– Create a simple written procedure covering all three check types, so hiring managers follow the same process every time
– Build a tracking system for time-limited status, with reminders well ahead of expiry
– Store evidence securely and consistently, meeting the required retention periods
– Review your process against the revised code of practice ahead of the October 2026 changes
– Consider a certified Digital Verification Service provider if your business hires at volume, to reduce manual error

Getting the Basics Right, Every Time

Right to work checks are one of the clearest examples of a compliance area where doing things properly costs very little time, but getting it wrong can be genuinely business-threatening. A consistent, well-documented process — reviewed ahead of the October 2026 changes — is the best protection your business can have.

If you’d like support reviewing your right to work processes, HR compliance, or wider business foundations, CAW Consultancy works with UK business owners to build practical, audit-ready compliance across every area of the business.

Get in touch with CAW Consultancy today for a free, no-obligation consultation — visit https://www.cawconsultancy.co.uk to find out how we can help you build a compliant, confident business.