Your Right to Work Process Has a Gap. Here Is Where It Is.
Most HR Directors and compliance managers reading this will believe their right to work process is in reasonable shape. Not perfect perhaps, but functional. Ticked off the list. Handled.
That confidence is usually misplaced. Not because the intention is wrong, but because the gap rarely sits where people think it does. It is not the obvious failure of doing no check at all. It is something quieter, more specific, and considerably more expensive when it surfaces.
The Home Office confirmed in January 2026 that enforcement raids have reached their highest level in UK history. Over 17,400 raids. More than 12,300 arrests. A 77% increase since July 2024. The enforcement machine is running at full speed and it is not slowing down. If your process has a gap, the environment for that gap to be discovered has never been more pressurised.
So here is where the gap usually is.
The Statutory Excuse Is Everything, and Most Employers Do Not Fully Understand It
Right to work compliance is not primarily about whether you checked. It is about whether you checked in the specific way the Home Office prescribes, using the correct method for that individual, at the right time, and retained the right evidence. Every one of those conditions matters. Miss any one of them and the statutory excuse that protects your organisation from a civil penalty does not exist.
The statutory excuse is the legal shield between your organisation and a fine of up to £45,000 per worker for a first breach, rising to £60,000 for a repeat breach within three years. It is not a given. It is earned by following a specific prescribed process and it is lost the moment that process deviates from what the Home Office requires.
In 2026 there are three recognised checking methods. Manual document checks, examining original documents from List A or List B. Online checks via the Home Office right to work checking service, which is now mandatory for anyone holding digital immigration status. And Identity Document Validation Technology checks, available for British and Irish citizens through Home Office certified IDVT providers. A fourth route, the Employer Checking Service, applies where an individual's immigration status is pending.
The method is not interchangeable. Using the wrong one for a particular individual, even where their documents appear entirely genuine and their status is in fact legitimate, does not establish a statutory excuse. You followed a process. You just did not follow the prescribed one. The protection is gone.
The "They Said They Were British" Gap
This is where most organisations have their most significant exposure, and where the most common misunderstanding lives.
A candidate presents themselves as a British citizen. They were born here, they say. They have lived here their whole life. They speak the language. They produce a driving licence and a bank statement. Someone in HR notes down that the candidate is British and moves on to the offer paperwork.
None of that constitutes a right to work check.
A verbal claim of British nationality has no legal standing in this context. A driving licence is not a specified document under the Home Office checking framework. A National Insurance number, produced on its own or alongside a payslip, does not establish a right to work. These are pieces of information. They are not a compliant check.
For a person claiming British citizenship, a compliant check requires you to examine a valid original British passport, a certificate of registration or naturalisation as a British citizen, or a UK birth or adoption certificate alongside a document that confirms their National Insurance number. You then retain a clear legible copy, note the date the check was carried out, and keep that record for the duration of employment and for two years after it ends.
If the documents cannot be produced, the check cannot be completed. That does not automatically mean the person cannot work. But it does mean they cannot start until the check is done correctly and the statutory excuse is in place. There is no shortcut, no workaround, and no amount of good faith that substitutes for the prescribed process.
The BRP Gap That Is Catching Organisations Right Now
From January 2026, physical Biometric Residence Permits can no longer be used by non-British and non-Irish workers as evidence of their right to work. This is not a future change. It has already happened.
Any non-British or Irish worker who previously held a physical BRP now holds an eVisa. To prove their right to work, they must generate a share code through the Home Office online service. The employer must then verify that share code online via the right to work checking service before employment begins.
If your onboarding team is still accepting a physical BRP card presented at reception, the check is not compliant and no statutory excuse exists for that hire. The card may look entirely valid. The individual may have every right to work in the UK. None of that changes the fact that accepting the card as evidence in 2026 does not follow the prescribed method.
This is one of the more urgent gaps in the current landscape and one that many organisations have not yet closed. Our post on what every employer must do now that BRPs are legacy documents covers the detail of what the transition means in practice.
The Repeat Check Gap
Initial checks are where most organisations focus their attention. Repeat checks are where the gaps quietly accumulate.
Where an employee has time-limited permission to work, which applies to anyone on a visa, graduate route or other temporary leave, the employer is required to carry out a repeat check before that permission expires. Not if it is convenient. Not when HR notices. Before the permission runs out.
In practice what happens is this. The initial check is completed on day one. The expiry date is noted somewhere. A follow-up check is intended. And then the operational pressures of running a busy team take over, the date passes, and six months later a routine audit reveals a worker whose permission expired without a repeat check ever being done.
For organisations managing large numbers of temporary, fixed-term or seasonal workers, this is the gap most likely to result in enforcement action. It is not about bad intent. It is about the absence of a system that reliably fires before the expiry date, not after.
A compliance calendar, a flagged record in your HR system, a process that alerts the right person at least 12 weeks before expiry: whichever mechanism you use, it needs to operate consistently and leave an auditable trail. Our post on what a compliant right to work check process looks like in 2026 sets out the structure clearly.
The Consistency Gap
This is the gap that organisations with multiple sites, departments or a devolved HR structure tend to carry without realising it.
The Home Office, when conducting a compliance visit, does not simply ask whether a right to work check was done. It assesses whether the organisation has a coherent, auditable, consistent process capable of preventing breaches. An informal or inconsistent checking approach is treated as a systemic failing, not an isolated oversight.
What this means in practice is that a well-documented central HR policy that is applied correctly by head office but handled differently by line managers in regional offices, or interpreted loosely by hiring managers who were never properly trained, does not protect the organisation as a whole. The compliance officer looks at the full picture. If the picture is inconsistent, the exposure is organisational.
Everyone involved in the onboarding process, not just HR, needs to understand what they are doing and why. They need to know the difference between a List A document that grants an indefinite right to work and a List B document that requires a follow-up. They need to know that the online check for a digital status holder is not optional. They need to know that good intentions are not evidence.
This is closely connected to a broader question about who carries accountability when things go wrong. Our post on outsourcing screening and employer accountability is worth reading alongside this one, particularly for organisations that rely on recruitment agencies or third-party providers for any part of their onboarding process.
The Expanding Obligation Gap
One more gap worth naming, because it is building right now in organisations that are focused only on direct employees.
The Border Security, Asylum and Immigration Act 2025, which received Royal Assent in December 2025, extends right to work check obligations to workers engaged under workers' contracts, individual sub-contractors and individuals sourced through online matching platforms. The expanded regime is expected to come into force during 2026.
Organisations that routinely use contractors, gig workers or platform-sourced labour without running right to work checks are accumulating a compliance exposure that the law is about to make explicit. Waiting until the commencement regulations land before beginning to act is not a position any compliance professional should be comfortable with. The process takes time to build and embed. Starting now, before the obligation is live, is the right decision.
What a Compliant Process Actually Requires
Across all of the gaps above, the common thread is the same. A compliant right to work process is not a form. It is a system that operates consistently, produces auditable evidence, uses the correct method for each individual, fires repeat check reminders before expiry dates, and is understood and applied reliably by everyone involved in hiring.
The question to sit with is straightforward. If an Immigration Enforcement officer walked in today and asked to see right to work records for every person in your organisation, what would they find? Would the records exist, would they be complete, and would every check have been carried out using the correct prescribed method?
If you cannot answer that with certainty, the gap is real. And in the current enforcement environment, real gaps have real consequences.
Working With Vetting Hub
At Vetting Hub, we work with organisations across every regulated sector to build employment screening processes that hold up under scrutiny. The knowledge, tools and direct expert access we provide give HR Directors, Compliance Managers and business owners the practical foundation to handle right to work compliance with complete confidence, not just at the point of hire, but throughout the employment relationship and into every audit.
Whether you are building a process from scratch, reviewing what you have before an inspection, or working through the implications of the expanded obligations coming through the 2025 Act, The Hub brings together CPD certified practical training, compliance templates and frameworks, and direct access to Graham and Vivianne Johnson, who spent two decades doing this work operationally before founding Vetting Hub.
Find out more at www.vettinghub.co.uk
