Right to work checks, and why security contractors get asked twice

Right to work checking is a duty on every UK employer, not a security-specific one. What is specific to this sector is how often you are asked to demonstrate it — by clients during contract mobilisation, during assessments, and whenever a contract changes hands.

Where the evidence goes missing

The check itself is usually done. The evidence is what disappears, and it tends to disappear for structural reasons rather than careless ones.

• –The check happens at onboarding, in a different system from the operational record
• –A follow-up check is due for time-limited permission, and nothing prompts it
• –An officer transfers in from a subcontractor, and the check is assumed rather than repeated
• –Documents are held as email attachments rather than against the person

Time-limited permissions

Where someone's permission to work is time-limited, a follow-up check is required before it expires. This is the same shape of problem as licence expiry — a date, sitting in a file, with nothing attached to it that raises its hand. The fix is the same: put the date somewhere that will prompt you.

Government guidance on acceptable documents and the checking process is updated regularly, including the rules on digital and online checks, so confirm the current Home Office guidance rather than relying on the process you set up two years ago.

Where the gap opens on a security contract

Two situations account for most failures. The first is time-limited permission: the initial check is done correctly, filed, and the expiry date is not watched by anything. The second is short-notice cover — a post needs filling tonight, an officer is pulled from another contract or an agency, and they work a shift before anything is evidenced.

The second is the more dangerous because it feels proportionate in the moment. One shift, an officer who is almost certainly fine, and a client who needs the post covered. It recurs precisely because each individual instance seems reasonable.

Subcontracted and agency officers

Where officers come through another supplier, the practical question is what you actually hold rather than what you have been assured. A contractual statement that a supplier screens their people is not the same as evidence for a named individual working on your client's site — and it is the second that will be asked for.

Common mistakes

• –Treating the check as a one-off with no expiry tracking
• –Allowing cover to start before evidence exists
• –Assuming a supplier has checked without holding anything for the individual
• –No record of when a check was done and by whom
• –Documents held by a branch rather than centrally
• –No escalation route when a post must be covered and evidence is missing

What separates a process that does not slip

Two features, consistently. The first is that no officer can be rostered without their evidence being present — the check happens at the point of scheduling rather than as a parallel administrative task. The second is that follow-up dates are held by the system rather than by a person, with notification early enough to act on.

Both remove the moment of discretion. The failures in this area almost never come from someone deciding to skip a check; they come from a process that permits a shift to be filled before anybody has looked.

One practical test: look at last month's short-notice cover

Find every officer who worked a shift last month at less than twenty-four hours' notice, and check what right-to-work evidence you held before they started.

The initial check is rarely the problem. The gaps appear in short-notice cover, where a post needs filling tonight and evidence follows afterwards — and in time-limited permission, where the expiry date sits in a record nothing watches.

• –Block rostering where evidence is not already held
• –Track follow-up dates for time-limited permission
• –Hold evidence for the individual, not an assurance from a supplier
• –Record when a check was done and by whom
• –Give supervisors a route to escalate rather than proceed

Worth adding: the follow-up needs its own owner

A follow-up on time-limited permission is created at one moment and acted on much later, usually by a different person. Unless the date sits somewhere that actively surfaces it to somebody named, the only thing between the contract and a missed follow-up is whether anybody happens to remember.

Worth recording what the follow-up will actually require, so whoever picks it up is not reconstructing the context from the original file.