Sponsor Licence Compliance Audit: How to Prepare

Sponsor Licence Compliance Audit: At a Glance

A sponsor licence compliance audit tests whether an organisation’s sponsorship systems, records and working practices operate effectively in practice. It can expose gaps between the Sponsor Management System (SMS), Certificate of Sponsorship (CoS) records, HR data, payroll and the worker’s actual employment arrangements.

For employers, the value of an audit lies in identifying compliance weaknesses before they become embedded or are exposed through Home Office compliance activity. Findings may concern individual worker files, reporting, right to work, key personnel, sponsored roles, salary or wider weaknesses in the organisation’s compliance controls.

A strong audit should also establish whether problems are isolated or systemic and whether remedial action has corrected both the individual issue and the process that caused it.

This guide explains how to conduct a sponsor licence compliance audit, what employers should test, how to assess findings and how to build remediation and ongoing assurance into the organisation’s sponsorship framework.

 

Section A: Sponsor Licence Compliance Audit: Key Points

 

A sponsor licence compliance audit is a structured review of an organisation’s compliance with its duties as a licensed sponsor. The review should test the evidence held by the organisation, how sponsorship processes operate and whether the recorded position corresponds with day-to-day working practices.

For a sponsored worker, this means reconciling information across the SMS, CoS, employment contract, current duties, salary, payroll, working hours and work location. Differences should be investigated to establish whether they reflect an administrative discrepancy, a sponsor compliance issue or a wider control weakness requiring corrective action.

A sponsor licence compliance audit can help an employer to:

 

• identify breaches of sponsor duties;
• detect weaknesses in HR systems and compliance controls;
• check sponsored worker records for accuracy and completeness;
• verify that relevant changes have been reported to the Home Office where required;
• test right to work processes and records;
• identify discrepancies between the SMS, HR records and operational reality;
• assess whether key personnel understand and perform their sponsor responsibilities;
• establish whether identified problems are isolated or systemic;
• implement and document remedial action; and
• improve preparedness for possible Home Office scrutiny.

 

An internal sponsor compliance audit is an assurance exercise undertaken by, or on behalf of, the sponsor. A Home Office compliance visit is regulatory activity undertaken by UK Visas and Immigration (UKVI) to assess whether the organisation is meeting its sponsorship obligations.

Sponsor compliance should be reviewed on an ongoing basis because weaknesses can develop as sponsored workers, key personnel, business operations and internal processes change. A useful assurance cycle is:

Test → Identify → Remediate → Verify → Monitor → Re-test

The aim is to establish whether the organisation can demonstrate effective sponsor compliance through its records, systems and day-to-day operations.

 

Audit question	What the sponsor should establish
Are the sponsor licence details correct?	The information held by the Home Office accurately reflects the organisation and its current circumstances.
Are key personnel arrangements effective?	Appropriate individuals remain appointed, have suitable access and understand their responsibilities.
Are sponsored worker records complete?	Required records are retained, current and readily retrievable.
Is the SMS accurate?	SMS information corresponds with HR records and actual circumstances.
Are reportable changes being identified?	Relevant worker and organisational changes are recognised and escalated.
Are reporting deadlines being met?	Required reports are made within the applicable Home Office timescales.
Are sponsored roles compliant?	Actual duties, salary, hours and work arrangements remain consistent with the basis of sponsorship.
Are right to work controls effective?	Checks are carried out correctly using the applicable prescribed method and evidence is retained as required.
Can the organisation evidence compliance?	Relevant documents and audit trails can be produced if requested by the Home Office.
Are weaknesses being corrected?	Findings result in documented, proportionate and verified remedial action.

 

A strong audit should test two positions against each other:

What do the sponsor’s records and procedures say should be happening?

What is actually happening in practice?

Any material gap between them should be investigated to determine the compliance exposure and the control that needs to change.

 

 

Back to top

 

Section B: What Is a Sponsor Licence Compliance Audit?

 

A sponsor licence compliance audit is a systematic examination of an organisation’s sponsorship arrangements to determine whether it is meeting its duties as a licensed sponsor.

The audit should assess both the organisation’s documentary compliance and the effectiveness of the systems used to manage sponsored workers. It should therefore consider not only whether required records exist, but whether those records are accurate, current and consistent with the reality of the worker’s employment.

Depending on the organisation and the purpose of the exercise, the review may be described as a:

 

• sponsor licence compliance audit;
• sponsor compliance audit;
• sponsor licence audit;
• internal sponsor audit;
• mock sponsor audit;
• mock compliance audit; or
• sponsor compliance review.

 

The terminology is less important than the scope and quality of the review.

A meaningful audit should test the relationship between the sponsor’s Home Office records, internal employment records and actual working arrangements.

For an individual sponsored worker, this can involve examining the following audit chain:

CoS → Immigration Status → Contract → Actual Duties → Salary → Payroll → Hours → Work Location → Attendance → SMS

Each element should be capable of being reconciled with the others. For example, the salary stated on the Certificate of Sponsorship should be considered against the contractual salary, current working hours and actual payroll records. Similarly, the role described for sponsorship purposes should be compared with the duties the worker is actually performing.

 

1. What Does a Sponsor Compliance Audit Examine?

 

The scope of an audit will depend on the organisation, the sponsored workforce and the risks being tested. A comprehensive review can include:

 

• sponsor licence details;
• the organisation’s current structure and trading position;
• Authorising Officer and other key personnel arrangements;
• Level 1 User access and remaining Level 2 User arrangements during the applicable 2026–27 transition;
• SMS security, individual user access and multi-factor authentication arrangements;
• Certificates of Sponsorship;
• sponsored worker files;
• Appendix D record keeping;
• worker contact details and required contact-detail histories;
• right to work checks;
• immigration permission and expiry monitoring;
• date-of-entry evidence where required;
• attendance and absence records;
• reporting of changes affecting sponsored workers;
• reporting of relevant organisational changes;
• job roles and actual duties;
• occupation classifications where relevant;
• salary and payroll;
• working hours;
• work locations and working arrangements;
• recruitment evidence and explanations of how sponsored workers were recruited;
• HR processes;
• communication between HR, payroll, managers and the sponsorship team;
• staff understanding of sponsor responsibilities;
• previous compliance findings; and
• evidence that previous remediation has been implemented and verified.

 

The purpose is not simply to determine whether each individual requirement has been considered. The audit should also test how the different parts of the sponsorship system interact.

A sponsor may, for example, have an effective HR process for recording salary changes but no reliable process for determining whether those changes have sponsorship implications. Similarly, managers may know that a sponsored worker has changed duties or work location without understanding that the change needs to be escalated to the person responsible for sponsorship compliance.

 

2. Internal Sponsor Audit vs Home Office Compliance Visit

 

An internal sponsor licence compliance audit should be distinguished from a Home Office compliance visit.

An internal audit is an assurance exercise undertaken by the sponsor itself or by an adviser acting for the organisation. Its purpose is to identify and address weaknesses in the sponsor’s compliance arrangements.

A Home Office compliance visit is undertaken by the Home Office as part of its regulatory oversight of the sponsorship system. It may involve examination of records, systems, personnel and sponsored workers to assess whether the organisation is meeting the requirements associated with holding a sponsor licence.

The distinction can be summarised as follows:

Internal compliance audit: the sponsor tests itself.

Home Office compliance visit: the Home Office tests the sponsor.

An internal audit can therefore form an important part of maintaining readiness for Home Office scrutiny, but it should not be treated solely as preparation for a compliance visit.

The objective should be to maintain compliant systems throughout the life of the sponsor licence.

 

3. An Audit Should Test Records, Reality and Controls

 

A sponsor compliance audit should operate at three levels.

 

a. Records

 

The audit should establish what the organisation’s documentation and systems record.

This can include the SMS, CoS information, contracts, personnel files, payroll, right to work evidence, attendance records and internal HR systems.

 

b. Reality

 

The audit should establish what is actually happening.

This may require discussions with HR, payroll, managers, key personnel and sponsored workers, together with examination of operational evidence.

 

c. Controls

 

The audit should establish how the organisation ensures that relevant events are identified and dealt with correctly.

For example, if a manager changes a sponsored worker’s duties, the audit should establish whether there is a reliable process for:

Change identified → Change escalated → Sponsorship implications assessed → Required action taken → Evidence retained

This is important because a sponsor may have compliant records at the point of audit while still operating weak processes that create a significant risk of future non-compliance.

 

4. An Audit Should Examine Compliance Over Time

 

Sponsor compliance should not be assessed only as a snapshot of the organisation on the day the audit takes place.

The audit should consider relevant events during the period under review.

For a sponsored worker, this may include:

 

• the original sponsorship decision;
• recruitment and appointment;
• right to work checking;
• commencement of employment;
• date of entry to the UK where relevant;
• changes in role or duties;
• salary changes;
• changes to working hours;
• changes in work location;
• periods of absence;
• changes to immigration status;
• extensions or further sponsorship;
• SMS reporting; and
• termination of sponsorship or employment.

 

This allows the auditor to build a compliance timeline and determine whether the organisation remained compliant throughout the relevant period rather than merely whether the worker’s current records appear correct.

 

5. The Audit Should Identify Both Individual and Systemic Problems

 

Where a problem is identified, the audit should determine whether it affects only one case or indicates a wider weakness.

For example, a missing document on one worker file may be an isolated administrative error. The same missing document across multiple worker files may indicate that the organisation’s onboarding process is defective.

Similarly, one missed report may result from an individual oversight, while repeated failures to report worker changes may indicate that managers do not understand what information needs to be escalated to the sponsorship team.

A useful principle is:

One error is a finding. Repeated errors form a pattern. A pattern may indicate a control failure.

Where the initial audit sample identifies a potential systemic issue, the scope of the review should be expanded sufficiently to establish the extent of the problem.

 

6. Sponsor Compliance Audit Methodology

 

For each issue identified during the review, the audit should move through a consistent assessment framework:

Requirement → Evidence → Finding → Exposure → Remediation → Verification

Requirement: What sponsor requirement or internal control applies?

Evidence: What do the SMS, worker records, payroll, HR systems and operational evidence show?

Finding: Is the organisation compliant, or is there a discrepancy, weakness or potential breach?

Exposure: How significant is the issue, how many workers are affected and is it continuing?

Remediation: What action should be taken to address the individual issue and any underlying control weakness?

Verification: How will the organisation establish that the corrective action has actually resolved the problem?

This approach turns the audit from a document-checking exercise into a practical compliance assurance process.

 

7. Sponsor Compliance Is a Cross-Functional Responsibility

 

Although the sponsor licence has designated key personnel, compliance frequently depends on information held elsewhere in the organisation.

Relevant functions can include:

 

• HR;
• recruitment;
• payroll;
• finance;
• line management;
• operations;
• legal or compliance teams;
• senior management; and
• the personnel responsible for operating the SMS.

 

An effective audit should therefore test how information moves between these functions.

A salary reduction recorded correctly by payroll may still create a sponsorship problem if the sponsorship team is not informed. A work-location change known to a line manager may not be assessed for reporting purposes if there is no escalation mechanism. A corporate restructuring known to senior management may have sponsor licence consequences that are overlooked if immigration compliance is not incorporated into the transaction process.

The audit should establish not only who is nominally responsible for sponsor compliance, but whether the organisation has functioning systems that allow relevant information to reach that person at the right time.

 

8. The Central Question for a Sponsor Licence Audit

 

Ultimately, a sponsor licence compliance audit should determine whether the organisation can demonstrate that its sponsorship arrangements operate correctly in practice.

The central question is therefore:

Can the sponsor evidence that its records, people, systems and actual employment arrangements consistently reflect the requirements of the sponsorship regime?

If the answer is uncertain, the audit should identify why, determine the resulting exposure and establish what needs to change.

 

 

Back to top

 

Section C: Why Conduct a Sponsor Licence Compliance Audit?

 

A sponsor licence places ongoing compliance responsibilities on the organisation holding the licence. These responsibilities continue throughout the life of the licence and cannot be managed effectively through the initial sponsor licence application or individual sponsorship decisions alone.

As an organisation changes, its sponsor compliance position can also change. New sponsored workers may join, existing workers may change roles, salaries or working arrangements, key personnel may leave, HR systems may be replaced and the business itself may restructure.

A sponsor licence compliance audit provides a structured way to identify whether these developments have created gaps between the organisation’s sponsor obligations and its actual practices.

The objective should be preventative as well as corrective. Rather than waiting for a compliance failure to become apparent through Home Office scrutiny, the sponsor can identify weaknesses itself, understand their cause and implement appropriate remediation.

 

1. Identify Compliance Failures Before Home Office Scrutiny

 

One of the principal reasons for conducting an internal sponsor compliance audit is to identify potential problems before they are identified by the Home Office.

Home Office compliance activity can examine whether the sponsor is meeting its duties and whether the information provided through the sponsorship system corresponds with the organisation’s actual circumstances.

Depending on the circumstances and seriousness of non-compliance, Home Office action can include measures affecting the sponsor’s ability to assign Certificates of Sponsorship, downgrading of the licence, suspension or revocation.

An internal audit cannot guarantee that Home Office action will be avoided. It can, however, give the organisation an opportunity to understand its compliance position, investigate discrepancies and take appropriate corrective action.

This is particularly important where a problem has existed for some time without being recognised.

For example, an employer may discover that:

 

• a sponsored worker’s duties have changed significantly;
• a salary reduction was not escalated for sponsorship assessment;
• a worker has moved to a different normal work location;
• required records cannot readily be produced;
• a reportable event was not identified at the relevant time;
• the SMS does not reflect current organisational information;
• worker contact-detail histories are incomplete;
• right to work evidence is missing or defective;
• key personnel arrangements are no longer appropriate; or
• an internal process is not operating in the way management believed.

 

Finding the issue internally allows the organisation to establish the facts before deciding what action is required.

 

2. Identify Compliance Drift

 

Sponsor compliance problems do not always result from a deliberate failure to follow the rules. They can develop gradually through what may be described as compliance drift.

An organisation may have had effective systems when the sponsor licence was granted, but those systems can become less effective as the business changes.

Common causes can include:

 

• growth in the sponsored workforce;
• staff turnover within HR or compliance teams;
• changes to the Authorising Officer or SMS users;
• changes to internal responsibilities;
• new offices or operating locations;
• remote or hybrid working arrangements;
• changes to payroll systems;
• changes to HR software;
• business acquisitions or restructuring;
• increased use of different sponsored work routes;
• changes to Home Office guidance; and
• informal working practices developing outside documented procedures.

 

An audit allows the sponsor to determine whether the compliance framework that exists on paper continues to operate effectively in practice.

 

3. Test Whether Different Compliance Systems Work Together

 

Sponsor compliance rarely sits within a single system.

Information relevant to sponsorship may be distributed across:

 

• the Sponsor Management System;
• HR software;
• personnel files;
• payroll;
• recruitment systems;
• absence management systems;
• right to work records;
• manager records;
• finance systems; and
• operational business records.

 

Each system may appear accurate when reviewed independently while inconsistencies exist between them.

For example, HR may correctly record a promotion, payroll may correctly implement the associated salary change and the line manager may correctly update the employee’s duties. The sponsor compliance failure can arise if nobody considers whether the change has sponsorship implications.

A compliance audit should therefore test the complete information chain rather than examining systems in isolation.

For a sponsored worker, a useful audit sequence is:

CoS → Immigration Status → Contract → Actual Duties → Salary → Payroll → Hours → Work Location → Attendance → SMS

Compliance is strongest where every source tells the same story.

 

4. Check Records Against Operational Reality

 

Documentary compliance is important, but documents alone may not establish that the organisation is operating compliantly.

A worker’s personnel file may contain a job description that has not been updated for several years. The worker may now be performing materially different duties.

A contract may state one work location while the employee has permanently moved elsewhere.

The SMS may contain a salary figure that no longer corresponds with payroll.

A policy may require managers to notify HR about sponsored worker changes, while managers may not know that the policy exists.

The audit should therefore compare:

What the records say → What staff understand → What actually happens

Material differences should be investigated rather than assumed to be administrative anomalies.

 

5. Establish Whether Problems Are Isolated or Systemic

 

Identifying an error is only the first stage of an effective compliance audit.

The organisation should determine whether the problem is confined to one case or indicates a broader control weakness.

For example:

 

• one missing document may be an isolated filing error;
• the same missing document across multiple worker files may indicate a defective onboarding process;
• one late escalation may result from individual oversight;
• repeated late escalations may indicate that managers have not been trained properly;
• one payroll discrepancy may be an administrative mistake; and
• multiple discrepancies may indicate that payroll changes are not being reviewed for sponsorship implications.

 

Where a potential pattern is identified, the audit should expand sufficiently to establish the affected population and underlying cause.

The principle is:

One error is a finding. Repeated errors form a pattern. A pattern may indicate a control failure.

 

6. Protect Against Failures in Sponsor Reporting

 

Licensed sponsors are required to report specified changes affecting sponsored workers and the sponsoring organisation within the applicable Home Office timescales.

As a general framework, many reportable changes relating to sponsored workers must be reported within 10 working days, while specified changes relating to the sponsoring organisation are generally reportable within 20 working days. The applicable requirement should always be checked for the particular event because different provisions can apply.

An audit should therefore test whether the organisation has a reliable process for:

Event → Identification → Escalation → Assessment → Reporting or Other Required Action → Evidence

This is important because the person who first becomes aware of a change may not be an SMS user.

A line manager may know that a worker’s duties have changed. Payroll may know that salary has been reduced. HR may know that the employee has moved location. Senior management may know that the business is being restructured.

Unless these events reach the person capable of assessing their sponsorship implications, the organisation can fail to take required action even though the relevant information exists somewhere within the business.

 

7. Test Absence Monitoring and Escalation

 

Attendance and absence controls form an important part of sponsor compliance.

The audit should establish whether the organisation records sponsored worker absences and whether potentially relevant absence events are escalated for sponsorship assessment.

This includes testing whether the organisation can identify circumstances that may engage specific sponsor reporting requirements, including unauthorised absence for more than the applicable period and extended periods of unpaid or reduced-pay absence.

Current sponsor guidance contains specific requirements concerning, among other matters, unauthorised absence of more than 10 consecutive working days and absence without pay or on reduced pay for more than four weeks in total in a calendar year, subject to the applicable rules, permitted exceptions and route-specific provisions.

The audit should not merely ask whether the organisation has an absence policy. It should test whether:

 

• absence is recorded;
• managers understand escalation requirements;
• HR can identify relevant absence patterns;
• salary consequences are communicated to payroll and the sponsorship function;
• potential reporting requirements are assessed; and
• required evidence is retained.

 

8. Maintain Institutional Knowledge

 

Sponsor compliance can become vulnerable where too much knowledge sits with one individual.

This can happen where one Level 1 User understands the SMS, one HR employee manages sponsored workers or the Authorising Officer relies heavily on another member of staff without maintaining sufficient oversight.

If that person leaves, is absent or changes role, the organisation may lose important knowledge about:

 

• reporting procedures;
• worker records;
• SMS administration;
• immigration expiry monitoring;
• previous compliance issues;
• Home Office correspondence; and
• outstanding remediation.

 

An audit should therefore test business continuity as well as individual knowledge.

The organisation should be capable of operating its sponsor compliance framework even where a key member of staff becomes unavailable.

 

9. Respond to Organisational Change

 

Corporate and organisational changes can have significant sponsor licence consequences.

Examples include:

 

• mergers;
• acquisitions;
• takeovers;
• demergers;
• TUPE transfers;
• changes in direct ownership;
• restructuring;
• changes to branches;
• changes to trading arrangements; and
• insolvency events.

 

These events should not be treated simply as routine administrative changes to the SMS.

Depending on the transaction, sponsor action can include time-critical reporting, changes affecting sponsored workers and, in some circumstances, the need for a new sponsor licence application. Sponsor licences are not transferable between organisations.

Relevant organisational changes can be subject to a 20-working-day timeframe for required sponsor action.

An audit following significant corporate change should therefore establish what happened, when it happened, which employing entities and sponsored workers were affected and whether the correct sponsorship action was taken within the applicable timeframe.

 

10. Respond to Changes in Sponsor Requirements

 

Sponsor compliance requirements and Home Office systems change over time.

An organisation that relies on procedures created several years earlier may therefore be operating processes that no longer reflect current requirements.

For example, the sponsor regime in 2026 has included changes affecting areas such as SMS access, multi-factor authentication, Level 2 Users, right to work processes and the framework used to assess whether sponsored roles are eligible.

A compliance audit should therefore consider not only whether the organisation follows its existing procedures, but whether those procedures remain legally and operationally current.

A useful change-control process is:

What changed? → Does it affect us? → Which workers or processes are affected? → What needs to change? → Who owns the change? → Has implementation been verified?

 

11. Improve Home Office Compliance Visit Readiness

 

A well-conducted internal audit can improve the organisation’s readiness for possible Home Office scrutiny.

This does not mean creating documents shortly before a visit or coaching staff to provide rehearsed answers.

It means ensuring that the organisation can demonstrate its normal compliance arrangements through reliable records, knowledgeable personnel and functioning systems.

The sponsor should be capable of showing:

 

• who is responsible for sponsorship;
• how sponsored workers are monitored;
• how changes are identified;
• how reporting decisions are made;
• how records are retained;
• how right to work is managed;
• how payroll and sponsored salary information are reconciled;
• how actual roles and duties are monitored;
• how compliance problems are escalated; and
• how identified weaknesses are remediated.

 

An organisation that maintains these controls continuously should be better positioned to respond to Home Office enquiries than one attempting to reconstruct its compliance position after scrutiny has begun.

 

12. Create an Evidence Trail of Compliance Assurance

 

A sponsor compliance audit also creates evidence that the organisation actively manages its sponsorship responsibilities.

The audit record can show:

 

• what was tested;
• when it was tested;
• what evidence was examined;
• what findings were identified;
• how findings were risk-assessed;
• what remediation was required;
• who was responsible;
• when corrective action was completed; and
• whether remediation was subsequently verified.

 

The existence of an audit does not itself establish compliance. A superficial audit that identifies problems but leaves them unresolved provides limited assurance.

The value lies in demonstrating a functioning compliance process:

Test → Find → Remediate → Verify → Monitor → Re-test

 

13. Support Better Operational Governance

 

Sponsor compliance auditing can also improve wider organisational governance.

Many of the controls required for effective sponsorship overlap with good HR and workforce management, including:

 

• accurate personnel records;
• clear reporting lines;
• reliable payroll information;
• effective absence management;
• controlled system access;
• documented responsibilities;
• management escalation;
• change control; and
• evidence-based decision-making.

 

A well-designed sponsor compliance framework should therefore integrate with normal business processes rather than operate as a separate immigration administration exercise.

The aim is to create an organisation in which relevant workforce events are identified naturally as part of ordinary operations and assessed for sponsorship implications where necessary.

 

14. The Purpose of the Audit

 

The ultimate purpose of a sponsor licence compliance audit is not to produce a perfect set of files on the day of the review.

It is to determine whether the organisation has reliable systems capable of maintaining compliance as circumstances change.

The audit should therefore answer:

Are we compliant now?

Can we demonstrate that compliance?

Would our systems identify a relevant change tomorrow?

Would the right person know about it?

Would the required action be taken within the applicable timeframe?

Could we evidence that action afterwards?

Where the answer to any of these questions is uncertain, the audit has identified an area requiring further investigation or improvement.

 

 

Back to top

 

Section D: When Should You Audit Sponsor Licence Compliance?

 

There is no single internal audit timetable that will be appropriate for every sponsor. The frequency and scope of sponsor licence compliance audits should reflect the organisation’s size, structure, sponsored workforce, previous compliance history and level of sponsorship activity.

A sponsor with a small and stable sponsored population may require a different assurance programme from an organisation that regularly assigns Certificates of Sponsorship across multiple sites, departments or group companies.

The appropriate approach is therefore risk-based.

Audits can be conducted periodically as part of routine governance, but they should also be triggered by events that materially change the organisation, its sponsored workforce or its compliance risk.

 

1. Routine Sponsor Compliance Audits

 

Periodic audits can help employers identify compliance drift before it develops into a more significant problem.

The appropriate frequency should take account of factors such as:

 

• the number of sponsored workers;
• the number of Certificates of Sponsorship being assigned;
• the number of sponsor licence routes being used;
• the complexity of the organisation;
• the number of work locations;
• the frequency of changes affecting sponsored workers;
• staff turnover within HR or compliance functions;
• previous audit findings;
• previous Home Office compliance activity;
• the effectiveness of existing controls;
• changes to Home Office rules or sponsor guidance; and
• the organisation’s reliance on sponsored workers.

 

A routine audit should not become a mechanical exercise conducted simply because a calendar date has been reached.

Its scope should reflect the organisation’s current risk profile and what has changed since the previous review.

 

2. After Significant Growth in the Sponsored Workforce

 

Rapid growth in sponsorship activity can place additional pressure on compliance systems.

Processes that worked effectively when an organisation sponsored five workers may not remain effective when it sponsors 50 or 500.

Growth can increase the volume of:

 

• Certificates of Sponsorship;
• right to work checks;
• worker files;
• immigration expiry dates;
• salary changes;
• promotions;
• work-location changes;
• absence events;
• reporting decisions; and
• SMS administration.

 

An audit following significant growth can determine whether compliance resources, responsibilities and systems have developed at the same pace as the sponsored workforce.

 

3. When the Authorising Officer or Key Personnel Change

 

A change in the Authorising Officer, Key Contact or SMS users should prompt consideration of whether the organisation’s sponsor governance remains effective.

The audit should establish:

 

• whether required changes have been made or reported;
• whether appropriate individuals hold the relevant roles;
• whether SMS access remains appropriate;
• whether former users have been removed where necessary;
• whether current users understand their responsibilities;
• whether SMS access is held through individual accounts;
• whether current user contact information is accurate;
• whether multi-factor authentication arrangements are functioning correctly;
• whether any remaining Level 2 User accounts are being managed in accordance with the current transitional arrangements; and
• whether there is sufficient cover if a key member of staff becomes unavailable.

 

This is particularly relevant following the 2026 changes to SMS user arrangements. Sponsors have been unable to appoint new Level 2 Users since 9 September 2026, while existing Level 2 Users are subject to transitional arrangements requiring eligible users to be upgraded to Level 1 or otherwise deactivated by 8 March 2027.

An audit conducted during this transition should therefore specifically examine remaining Level 2 User accounts and the organisation’s plan for managing them.

 

4. Following Changes to HR, Payroll or Other Systems

 

A change to HR software, payroll systems or workforce-management processes can create compliance risk even where the underlying sponsor responsibilities have not changed.

Data may fail to migrate correctly. Automated alerts may stop working. Responsibilities may move between teams. Historical records may become difficult to retrieve.

Following a significant system change, the sponsor should consider testing whether:

 

• sponsored workers have migrated correctly;
• immigration expiry dates remain accurate;
• right to work evidence remains accessible;
• worker contact-detail histories have been preserved;
• salary and hours information remains accurate;
• absence records remain available;
• reporting triggers continue to operate;
• historical records can be retrieved; and
• responsibilities remain clearly allocated.

 

The audit should test actual migrated records rather than relying solely on confirmation that the technical migration completed successfully.

 

5. Following a Merger, Acquisition, TUPE Transfer or Restructuring

 

Corporate transactions and organisational changes can have significant sponsor licence implications.

An audit should be considered following events such as:

 

• a merger;
• an acquisition;
• a takeover;
• a demerger;
• a TUPE transfer;
• a change in direct ownership;
• a significant restructuring;
• the creation or closure of branches;
• changes to employing entities; or
• relevant insolvency events.

 

The review should establish what changed, when the change took effect, which sponsored workers were affected and what sponsor action was required.

This is important because a sponsor licence cannot simply be transferred from one organisation to another. Depending on the transaction, the applicable requirements can involve reporting, action relating to sponsored workers and potentially a new sponsor licence application.

Relevant organisational changes can be subject to a 20-working-day timeframe for required sponsor action.

Corporate transactions should therefore be treated as potential sponsorship events at an early stage rather than considered only after the transaction has completed.

 

6. Following Significant Changes to Sponsored Workers

 

A targeted audit may be appropriate where the organisation has experienced a high volume of changes affecting sponsored workers.

Examples can include:

 

• promotions;
• changes in duties;
• changes in job title;
• salary reductions;
• changes in working hours;
• changes in normal work location;
• extended absence;
• changes to working arrangements;
• transfers between departments;
• changes of employing entity; and
• large numbers of sponsored workers leaving the organisation.

 

The purpose is to determine whether the organisation correctly identified the sponsorship implications of these events and took the required action.

Not every employment change is reportable in the same way. For example, an ordinary salary increase will not generally require an SMS report simply because salary has increased, although associated changes to role, duties, hours or other circumstances may still require assessment.

Similarly, some changes to a sponsored worker’s role can be dealt with through sponsor reporting where the relevant conditions are met, while other changes may be sufficiently significant to engage the change of employment requirements.

The audit should therefore test the quality of the organisation’s assessment rather than assuming that every employment change requires the same response.

 

7. Following Changes to Remote or Hybrid Working Arrangements

 

Changes in working location should be considered carefully because the reporting position depends on the nature of the change.

A move to a different normal work location can have sponsorship implications. This can include, for example, a worker moving to a new branch or client site not previously recorded as the normal work location, or moving permanently to full-time remote working with little or no attendance at a workplace.

By contrast, moving to a hybrid working pattern does not of itself necessarily require an SMS report. Sponsors should nevertheless maintain appropriate records of working arrangements and assess changes to the worker’s normal work location where relevant.

An audit should therefore establish:

 

• where the sponsored worker actually works;
• what location information was originally recorded;
• whether the normal work location has changed;
• whether any new branch or client location is involved;
• whether the worker is permanently remote or hybrid;
• whether the applicable reporting requirement was considered; and
• whether the organisation retains sufficient evidence of current working arrangements.

 

Day-to-day variations in working location should not automatically be treated as reportable changes. The audit should determine the substantive working arrangement.

 

8. After a Suspected Compliance Failure

 

A sponsor should not necessarily wait for its next scheduled audit where a potential compliance failure has been identified.

A targeted review may be appropriate following discovery of:

 

• a missed or potentially late SMS report;
• incorrect information on a Certificate of Sponsorship;
• a salary discrepancy;
• missing right to work evidence;
• incomplete Appendix D records;
• a role that appears materially different from the sponsored role;
• an unreported work-location change;
• problems with absence monitoring;
• an expired immigration permission alert;
• inappropriate SMS access;
• a failure to maintain worker contact information; or
• another potential breach of sponsor duties.

 

The review should initially establish the facts and then determine whether the problem is isolated or potentially affects a wider population.

If the same control has been used across multiple sponsored workers, the audit may need to expand beyond the original case.

 

9. After a Missed or Late SMS Report

 

Discovery of a potentially missed or late report should trigger investigation rather than an automatic assumption that the same remedial action is appropriate in every case.

The sponsor should establish:

 

• what event occurred;
• when it occurred;
• when the organisation became aware of it;
• which reporting requirement applied;
• what reporting deadline applied;
• whether any report or other action was taken;
• whether the issue is continuing;
• why the event was not dealt with correctly; and
• whether similar events may also have been missed.

 

As a general framework, many changes affecting sponsored workers must be reported within 10 working days, while specified organisational changes are generally subject to a 20-working-day reporting period. The specific requirement should always be checked against the event concerned.

The audit should also examine the underlying process failure.

If a manager knew about the event but HR did not, the problem may be escalation. If HR knew but the sponsorship team did not, the problem may be internal communication. If the sponsorship team knew but failed to act, the issue may concern responsibility, knowledge, workload or governance.

 

10. Following Changes to Sponsor Guidance or Immigration Requirements

 

Changes to the Immigration Rules, sponsor guidance, right to work guidance or Home Office systems can affect existing processes.

A sponsor should therefore consider targeted assurance when a material change affects its workforce or compliance procedures.

The review should ask:

What changed? → Does the change affect us? → Which workers or processes are affected? → What action is required? → Who owns implementation? → Has the change been verified?

This approach is preferable to assuming that existing policies remain correct simply because they were compliant when originally drafted.

 

11. Before a Known Home Office Compliance Visit

 

Where the organisation has been notified of forthcoming Home Office compliance activity, an immediate review of its compliance position may be appropriate.

The purpose should be to establish the genuine position and identify outstanding issues, not to manufacture a temporary appearance of compliance.

The review can examine:

 

• licence information;
• key personnel;
• SMS records;
• sponsored worker files;
• Appendix D documentation;
• right to work evidence;
• reporting history;
• salary and payroll;
• actual roles and duties;
• work locations;
• attendance and absence;
• HR processes;
• staff understanding;
• outstanding remediation; and
• the organisation’s ability to retrieve evidence promptly.

 

Any problems identified should be assessed carefully to determine the appropriate response.

Historical records should not be rewritten or altered to create the impression that an action occurred when it did not.

 

12. Following Home Office Correspondence or Compliance Activity

 

Home Office correspondence can also provide a reason to conduct a targeted or wider compliance review.

This may be appropriate where correspondence raises questions about:

 

• a sponsored worker;
• a Certificate of Sponsorship;
• the organisation’s sponsor licence;
• SMS information;
• right to work;
• a corporate change;
• the genuineness or eligibility of a sponsored role;
• salary or employment arrangements; or
• another aspect of sponsor compliance.

 

The organisation should assess the immediate issue while also considering whether it indicates a wider compliance weakness.

 

13. Before Sponsoring Significantly More Workers

 

An organisation planning substantial expansion of its sponsored workforce may benefit from auditing its existing arrangements before increasing sponsorship activity.

The review can establish whether current systems are capable of handling increased volumes of:

 

• CoS assignments;
• worker files;
• right to work checks;
• immigration expiry dates;
• employment changes;
• SMS reports;
• payroll reconciliations;
• absence monitoring; and
• compliance enquiries.

 

Identifying capacity problems before expansion can be considerably easier than correcting widespread compliance failures after the sponsored population has increased.

 

14. Use Event-Driven Auditing Alongside Periodic Audits

 

A mature sponsor compliance programme should not rely solely on a fixed annual or six-monthly audit date.

Periodic reviews can be useful, but material events should also trigger targeted assurance where appropriate.

Examples of useful audit triggers include:

 

Trigger	Potential audit focus
Rapid sponsored workforce growth	Capacity, worker files, reporting and governance
New Authorising Officer	Governance, knowledge and oversight
SMS user changes	Access, MFA, Level 1/Level 2 arrangements and security
HR or payroll system migration	Data integrity, historical records and compliance alerts
Merger or acquisition	Licence implications, sponsored workers and reporting
Large number of promotions	Roles, duties, occupation classification and reporting
Salary changes	Pay, hours, payroll and sponsorship implications
New remote-working model	Normal work locations and reporting assessment
Potential missed report	Facts, affected population and escalation controls
Material guidance change	Policies, procedures, training and implementation
Home Office visit notification	Overall audit readiness and outstanding findings

 

The objective is to align audit activity with actual compliance risk.

 

15. Document Why the Audit Was Conducted

 

Each audit should have a clearly documented purpose and scope.

The audit record should explain:

 

• why the audit was initiated;
• what period was reviewed;
• which workers or records were included;
• which compliance areas were tested;
• how any sample was selected;
• what evidence was reviewed;
• what findings were identified;
• what remediation was required; and
• how remediation will be verified.

 

This helps the organisation demonstrate that audit activity forms part of a deliberate compliance assurance programme rather than an isolated administrative exercise.

 

16. A Risk-Based Audit Programme

 

The appropriate audit programme should ultimately reflect the organisation’s actual sponsorship exposure.

Rather than asking only:

“When was our last sponsor audit?”

the organisation should also ask:

“What has changed since our last sponsor audit?”

“Where are our highest current compliance risks?”

“Have previous findings been fully remediated and verified?”

“Do our current controls still work?”

This allows the sponsor to combine periodic assurance with targeted reviews triggered by material events.

The result should be an audit programme that responds to the organisation’s actual compliance position rather than an arbitrary timetable.

 

 

Back to top

 

Section E: How to Prepare for a Sponsor Licence Compliance Audit

 

Preparation for a sponsor licence compliance audit should begin by defining what the audit is intended to test and assembling the evidence needed to establish the organisation’s actual compliance position.

The exercise should not begin with an assumption that the organisation is compliant or non-compliant. The purpose is to test the evidence objectively, identify inconsistencies and determine whether the sponsor’s systems are capable of maintaining compliance as circumstances change.

A structured preparation process can be divided into ten stages:

 

1. Define the audit scope.
2. Identify the applicable sponsor requirements.
3. Assemble the relevant evidence.
4. Map compliance responsibilities.
5. Identify the sponsored worker population and sampling approach.
6. Reconcile records across different systems.
7. Test relevant employment and organisational events.
8. Speak to the people operating the processes.
9. Record and risk-assess findings.
10. Expand the audit where evidence indicates a wider problem.

 

1. Define the Scope of the Audit

 

The first stage is to determine what the audit will cover.

A full sponsor licence compliance audit may examine the organisation’s entire sponsorship framework. A targeted audit may instead focus on a particular issue, department, worker population or compliance risk.

Potential audit areas include:

 

• sponsor licence details;
• key personnel;
• SMS access and administration;
• Certificates of Sponsorship;
• sponsored worker files;
• Appendix D records;
• right to work;
• immigration expiry monitoring;
• date-of-entry evidence where required;
• worker contact-detail histories;
• attendance and absence;
• sponsor reporting;
• roles and duties;
• occupation classifications where relevant;
• salary and payroll;
• working hours;
• work locations;
• recruitment evidence;
• HR processes;
• corporate changes;
• staff knowledge; and
• previous audit remediation.

 

The audit scope should also identify the period under review. A current snapshot may not reveal historical failures, so it may be necessary to examine relevant events over a longer period.

 

2. Identify the Applicable Sponsor Requirements

 

The audit should be conducted against the requirements that actually apply to the organisation and its sponsored workers.

Relevant sources can include:

 

• the Immigration Rules;
• Workers and Temporary Workers: Guidance for Sponsors;
• Part 1 of the sponsor guidance;
• Part 2: Sponsor a Worker;
• Part 3: Sponsor Duties and Compliance;
• Appendix D record-keeping requirements;
• route-specific sponsor guidance;
• current SMS guidance;
• current right to work guidance; and
• relevant Home Office compliance guidance.

 

The auditor should use current requirements rather than relying solely on historic internal policies, previous training materials or assumptions about how sponsorship operates.

This is particularly important where Home Office requirements or systems have changed since the organisation’s procedures were drafted.

 

3. Assemble the Audit Evidence

 

The organisation should identify the evidence needed before substantive testing begins.

This can include:

 

• sponsor licence information;
• SMS records and reporting history;
• Certificates of Sponsorship;
• employment contracts;
• job descriptions;
• right to work evidence;
• immigration status evidence;
• date-of-entry evidence where applicable;
• worker address, email and telephone histories;
• payroll reports;
• payslips;
• salary-change records;
• working-hours records;
• attendance records;
• absence records;
• work-location information;
• recruitment records;
• organisation charts;
• HR policies;
• sponsor compliance procedures;
• training records;
• corporate records; and
• evidence relating to previous audit findings.

 

The audit should not be restricted to documents stored in the sponsored worker’s personnel file if relevant evidence is held elsewhere.

Payroll, managers, finance, recruitment and operational systems may all contain information needed to establish the true position.

 

4. Check Appendix D Record Retention

 

Preparation should include testing whether sponsor records have been retained for the required period and remain readily retrievable.

Unless a specific provision requires otherwise, Appendix D generally requires documents relating to sponsored workers to be retained throughout the period of sponsorship until the earlier of:

 

• one year after the sponsorship ends; or
• the date on which a Home Office compliance officer has examined and approved the documents, where that examination takes place after sponsorship has ended.

 

Documents submitted in support of the sponsor licence application are generally required to be retained for as long as the organisation holds the sponsor licence.

Other legal, regulatory, tax, employment or data-retention requirements may require particular records to be retained for longer.

The audit should therefore test both:

Do we have the required evidence?

and

Can we retrieve it when required?

A document that theoretically exists but cannot be located may create significant practical difficulty during Home Office scrutiny.

 

5. Map Sponsor Compliance Responsibilities

 

The organisation should identify who is responsible for each stage of the sponsorship process.

This should extend beyond the individuals formally named as key personnel.

Relevant responsibilities may sit with:

 

• the Authorising Officer;
• the Key Contact;
• Level 1 Users;
• remaining Level 2 Users during the applicable transitional period;
• HR;
• recruitment;
• payroll;
• finance;
• line managers;
• operations;
• legal or compliance personnel; and
• senior management.

 

For each relevant event, the audit should identify:

Who identifies it? → Who escalates it? → Who assesses it? → Who takes action? → Who verifies completion?

This exercise can expose gaps where everyone assumes another person or department is responsible.

 

6. Identify the Sponsored Worker Population

 

The sponsor should establish an accurate population of sponsored workers before selecting files for review.

The population should be reconciled against relevant sources rather than relying automatically on a single HR report.

This can involve comparing:

 

• SMS records;
• current CoS information;
• HR records;
• payroll;
• immigration records; and
• leaver information.

 

Unexpected differences should be investigated.

For example, a worker appearing on one system but not another may indicate a timing difference, an administrative issue or a potentially more significant compliance problem.

 

7. Decide Whether to Audit Every Worker or Use Sampling

 

It may be practical for an organisation with a small sponsored workforce to audit every sponsored worker.

For larger populations, sampling may be appropriate.

Sampling should be designed to test meaningful compliance risks rather than simply selecting files at random.

The sample can include workers who:

 

• were recently sponsored;
• have been sponsored for a longer period;
• work at different locations;
• work in different departments;
• have different managers;
• have changed salary;
• have changed hours;
• have been promoted;
• have changed duties;
• have changed work location;
• work remotely or on a hybrid basis;
• have experienced significant absence;
• have had immigration permission extended;
• have transferred internally; or
• have been the subject of an SMS report.

 

Higher-risk cases can provide more useful information about whether the organisation’s controls are operating effectively.

If the sample identifies a recurring problem, the audit should expand to establish how many workers may be affected.

 

8. Reconcile the Sponsored Worker Audit Chain

 

For each worker reviewed, the audit should reconcile the principal sources of sponsorship and employment information.

A useful sequence is:

CoS → Immigration Status → Contract → Actual Duties → Salary → Payroll → Hours → Work Location → Attendance → SMS

The purpose is to determine whether each source supports the same underlying employment arrangement.

For example:

 

• Does the worker hold the expected immigration permission?
• Does the contract correspond with the sponsored role?
• Are the actual duties consistent with the role being sponsored?
• Does the salary correspond with payroll?
• Do the stated hours correspond with actual arrangements?
• Is the worker operating from the expected location?
• Do attendance and absence records support the organisation’s account?
• Were relevant changes assessed for reporting purposes?
• Does the SMS reflect the current position where required?

 

Differences do not automatically establish non-compliance, but they should be explained and assessed.

 

9. Check Date-of-Entry Evidence Where Required

 

Appendix D requires sponsors to retain relevant date-of-entry evidence in circumstances where the worker’s current immigration permission resulted from entry clearance sponsored by the organisation.

The purpose is to establish that the worker entered the UK during the validity period of the relevant permission.

The evidence required can depend on how the worker’s immigration status and entry are evidenced, including the use of eVisas and other appropriate travel evidence.

This area became particularly important following the 2026 move away from physical entry-clearance vignettes in relevant cases.

The audit should therefore establish:

 

• whether a date-of-entry check was required;
• whether it was completed;
• what evidence was relied upon;
• whether that evidence has been retained; and
• whether the worker commenced employment consistently with the applicable immigration arrangements.

 

10. Test Worker Contact-Detail Histories

 

Appendix D requires sponsors to maintain relevant contact information for sponsored workers, including a history of their UK residential address, personal email address and telephone number.

The audit should therefore do more than check whether the organisation holds the worker’s current address.

It should establish whether:

 

• current contact details are accurate;
• previous relevant contact details have been retained;
• workers understand how to notify the organisation of changes;
• changes are recorded promptly; and
• the organisation can produce the required contact-detail history.

 

If the organisation’s HR system overwrites old information when a worker updates their details, the sponsor should consider whether the required history is being retained elsewhere.

 

11. Review Recruitment Evidence

 

The audit should examine how sponsored workers were recruited and whether the organisation can explain and, where appropriate, evidence the recruitment process.

The absence of a general resident labour market test does not mean that recruitment evidence is irrelevant to sponsor compliance.

Depending on the circumstances, relevant evidence can help demonstrate:

 

• how the vacancy arose;
• how the worker was identified;
• how recruitment was conducted;
• why the individual was selected;
• that the role genuinely exists;
• that the role meets the applicable sponsorship requirements; and
• that the sponsored position is an eligible role.

 

Where historic or route-specific recruitment requirements applied, the audit should separately test whether the required evidence was retained.

The auditor should therefore distinguish between formal historic recruitment requirements and the continuing need to be able to explain the circumstances in which a sponsored worker was recruited.

 

12. Test the Role Against the Current Eligible Role Framework

 

The audit should not assume that a role remains compliant simply because a Certificate of Sponsorship was originally assigned.

The organisation should establish whether the role being performed remains consistent with the applicable sponsorship requirements and whether the factual circumstances support the sponsored position.

This can include examining:

 

• whether the role actually exists;
• the worker’s substantive duties;
• the level and nature of responsibility;
• the relevant occupation classification;
• salary and hours;
• the business need for the role;
• the worker’s reporting line;
• where the work is performed; and
• whether the role remains an eligible role for sponsorship.

 

The audit should also identify circumstances that could raise questions about whether a role is genuine, including where the apparent role does not exist in practice, is a sham or appears to have been created principally to facilitate immigration permission.

These questions should be answered through evidence rather than assumptions based on the job title.

 

13. Test Employment and Organisational Events

 

A strong audit should test events, not only static records.

The organisation should identify significant changes during the review period and trace how each was handled.

Potential events include:

 

• salary reductions;
• promotions;
• changes in duties;
• changes in job title;
• changes in working hours;
• changes in normal work location;
• extended absence;
• periods of unpaid or reduced-pay absence;
• changes in immigration status;
• employment termination;
• changes to key personnel;
• changes to organisational details;
• mergers and acquisitions;
• TUPE transfers;
• changes in direct ownership; and
• restructuring.

 

For each event, the audit should trace:

Event → Identification → Escalation → Assessment → Action → Evidence

This provides a practical test of whether the organisation’s compliance system works when something changes.

 

14. Check Reporting Timescales

 

Where an event was reportable, the audit should determine whether the required action was taken within the applicable timeframe.

As a general framework, many changes affecting sponsored workers are reportable within 10 working days, while specified changes relating to the sponsoring organisation are generally reportable within 20 working days.

The specific sponsor requirement should always be checked because different provisions can apply depending on the event.

The audit should record:

 

• the date the event occurred;
• the date the organisation became aware of it;
• the applicable requirement;
• the applicable deadline;
• the date action was taken;
• the evidence of that action; and
• any explanation for delay or non-reporting.

 

Where no report was made, the audit should establish whether this was because the event was correctly assessed as non-reportable or because the organisation failed to identify or act on the requirement.

 

15. Speak to the People Operating the Processes

 

Policies and process maps should be tested against the understanding of the people expected to use them.

Depending on the audit scope, this may involve discussions with:

 

• the Authorising Officer;
• Level 1 Users;
• HR personnel;
• recruitment staff;
• payroll personnel;
• line managers;
• senior management; and
• sponsored workers.

 

Questions should focus on actual processes and factual scenarios.

For example:

 

• What happens if a sponsored worker is promoted?
• Who is told if salary is reduced?
• What happens when a worker changes location?
• How are prolonged absences escalated?
• Who monitors immigration expiry dates?
• Who decides whether an SMS report is required?
• What happens if the Level 1 User is absent?
• How are corporate changes escalated for immigration assessment?

 

The objective is to establish whether the organisation’s stated procedures operate in practice.

 

16. Test SMS Access and Security

 

The audit should include current SMS access arrangements.

This has become particularly important following the 2026 changes to SMS user administration and the phased introduction of mandatory multi-factor authentication.

The review should establish:

 

• who currently has SMS access;
• whether each user has an individual account;
• whether access remains necessary and appropriate;
• whether former users have been removed;
• whether user contact information is current;
• whether multi-factor authentication is operating where applicable;
• whether users understand how one-time passcodes are handled;
• whether passwords, user IDs or one-time passcodes are being shared;
• whether any Level 2 Users remain active; and
• whether the organisation has addressed the applicable Level 2 User transition requirements.

 

A useful SMS security chain is:

Named User → Individual Account → Current Contact Details → MFA → Appropriate Permissions → Secure Use

Shared credentials or informal access arrangements should be treated as a compliance concern.

 

17. Record Findings Consistently

 

Audit findings should be documented in a consistent format.

A useful framework is:

Requirement → Evidence → Finding → Exposure → Remediation → Verification

For each finding, the audit record should identify:

 

• the relevant requirement;
• the evidence reviewed;
• the factual finding;
• the workers or processes affected;
• whether the issue is historical or continuing;
• the potential compliance exposure;
• the likely root cause;
• the required corrective action;
• the person responsible;
• the target completion date; and
• how completion will be verified.

 

This helps prevent audit reports from becoming lists of observations without clear actions.

 

18. Allow the Audit Scope to Expand

 

The original audit scope should not prevent further investigation where evidence indicates a wider problem.

For example, if three files in a sample show the same missing record, the auditor should consider whether the issue affects the entire sponsored population.

If one salary discrepancy reveals that payroll changes are never escalated to the sponsorship team, the audit should test other workers who have experienced salary changes.

If one manager does not understand sponsor reporting triggers, the organisation may need to test knowledge across other departments.

The audit should therefore be responsive to the evidence.

A useful approach is:

Finding → Determine Cause → Identify Potential Population → Expand Testing → Establish Full Exposure

 

19. Prepare for Evidence, Not Appearances

 

Audit preparation should not focus on making files appear complete shortly before they are reviewed.

Where historical records are missing, inaccurate or incomplete, the organisation should establish the genuine position and determine what remediation is appropriate.

Records should not be backdated, rewritten or altered to suggest that an action occurred when it did not.

Where information is reconstructed legitimately from other evidence, the audit trail should make clear what has been reconstructed, the evidence relied upon and when the reconstruction took place.

The purpose of the audit is to establish the truth of the organisation’s compliance position.

 

20. The Sponsor Audit Preparation Test

 

Before substantive testing begins, the organisation should be able to answer:

What are we testing?

Which requirements apply?

Which workers and business areas are in scope?

Where is the evidence?

Who owns each compliance process?

How will we test records against operational reality?

How will findings be recorded and risk-assessed?

What happens if the initial testing reveals a wider problem?

Once these questions can be answered, the organisation has the basis for a structured sponsor licence compliance audit rather than a simple file-checking exercise.

 

 

Back to top

 

Section F: Sponsor Licence Audit Checklist

 

A sponsor licence audit checklist provides a structured framework for reviewing the principal areas of sponsor compliance. It should not, however, be treated as a simple tick-box exercise.

The purpose of the checklist is to establish whether the sponsor can demonstrate compliance through its records, systems and actual working practices.

For each audit area, the organisation should consider four questions:

Requirement → Record → Reality → Control

Requirement: What does the sponsorship regime require?

Record: What evidence does the organisation hold?

Reality: What is actually happening in practice?

Control: What system ensures the organisation remains compliant when circumstances change?

The following checklist provides a comprehensive starting point for an internal sponsor licence compliance audit.

 

1. Sponsor Licence & Organisation Information

 

Check whether the information associated with the sponsor licence remains accurate and reflects the organisation’s current circumstances.

 

• Is the organisation’s legal name correct?
• Are relevant trading names current?
• Is the registered address correct?
• Are relevant operating addresses and branches correctly reflected?
• Are organisation contact details current?
• Is the organisation still operating in the manner represented to the Home Office?
• Have material changes to the organisation been identified?
• Have relevant organisational changes been reported within the applicable timeframe?
• Have mergers, acquisitions, takeovers, demergers, TUPE transfers, ownership changes or restructures been assessed for sponsor licence implications?
• Where a corporate change required more than an SMS report, was the necessary sponsor action taken?

 

Specified changes affecting the sponsoring organisation are generally subject to a 20-working-day reporting or action framework, although the precise requirement depends on the event concerned.

Corporate transactions should be reviewed particularly carefully because a sponsor licence cannot simply be transferred between organisations and some changes can require a new sponsor licence application.

 

2. Key Personnel & Sponsor Governance

 

Review whether the organisation’s key personnel arrangements remain appropriate and effective.

 

• Is the Authorising Officer still the appropriate person?
• Does the Authorising Officer understand their overall responsibility for the sponsor licence and the actions of SMS users?
• Is the Key Contact information current?
• Are Level 1 Users still appropriate?
• Do users continue to meet applicable eligibility requirements?
• Have individuals who no longer require access been removed?
• Are responsibilities clearly allocated?
• Is there adequate cover during absence or staff turnover?
• Does senior management receive appropriate information about sponsor compliance?
• Are previous compliance findings escalated where necessary?

 

The audit should establish whether governance works in practice rather than simply confirming that individuals have been named in the relevant roles.

 

3. SMS Access, Level 2 Users & Multi-Factor Authentication

 

SMS access should be audited as a distinct compliance and security area.

The review should establish:

 

• who currently has SMS access;
• whether each user operates through their own account;
• whether SMS user contact information is current;
• whether access remains necessary for each user;
• whether former employees or inappropriate users retain access;
• whether multi-factor authentication is operating where applicable;
• whether one-time passcodes are handled securely;
• whether passwords, user IDs or authentication codes are being shared;
• whether there are any remaining Level 2 Users; and
• whether the organisation has a plan for complying with the current Level 2 User transitional arrangements.

 

Sponsors have been unable to appoint new Level 2 Users since 9 September 2026. Existing Level 2 Users are subject to transitional arrangements under which eligible users need to be upgraded to Level 1 or otherwise deactivated by 8 March 2027.

The phased introduction of mandatory SMS multi-factor authentication during 2026 also makes the accuracy of individual SMS user contact information particularly important. Rollout began on 3 September 2026, is expected to cover all sponsors by November 2026, and applies immediately to organisations granted a sponsor licence on or after 9 September 2026.

Sponsors should also audit inactive SMS User accounts. Current Home Office guidance treats an SMS User account as inactive where it has not been accessed for 12 months. Where the Home Office identifies inactive accounts, affected users can be required to log in and check or update their details within the applicable review period. Accounts may be deactivated where the required action is not taken. If this leaves the sponsor with no active Level 1 User, the Home Office can suspend the licence and allow 28 days for an eligible Level 1 User to be nominated, with revocation normally following if the position is not corrected. The Home Office recommends that a Level 1 User accesses the SMS at least once a month.

A useful security test is:

Named User → Individual Account → Current Contact Details → MFA → Appropriate Permissions → Secure Use

 

4. Certificates of Sponsorship

 

Review a suitable sample of Certificates of Sponsorship and compare the information against the worker’s actual circumstances.

Check:

 

• worker identity;
• sponsored route;
• job title;
• occupation classification where relevant;
• job description;
• salary;
• working hours;
• work location;
• employment dates;
• other relevant information declared on the CoS; and
• whether subsequent changes were assessed appropriately.

 

The fact that a CoS was accurate when assigned does not establish that the sponsored employment has remained unchanged.

The audit should therefore compare the original sponsorship position with subsequent employment history.

 

5. Sponsored Worker Files

 

Each worker file selected for audit should be reviewed against the applicable sponsor record-keeping requirements and the worker’s actual employment circumstances.

The review can include:

 

• identity information;
• immigration status evidence;
• right to work evidence;
• date-of-entry evidence where required;
• Certificate of Sponsorship information;
• employment contract;
• job description;
• salary records;
• payroll evidence;
• working-hours information;
• work-location information;
• attendance and absence records;
• recruitment evidence;
• contact-detail history;
• evidence of relevant SMS reports; and
• records of material employment changes.

 

The central worker-file test is:

Does this file provide an accurate and evidenced history of the worker’s sponsored employment?

 

6. Appendix D Record Keeping

 

Audit the organisation’s records against the current Appendix D requirements.

The review should determine:

 

• whether required documents have been retained;
• whether records are complete;
• whether records are current where required;
• whether historical records required by Appendix D have been preserved;
• whether records can be retrieved promptly;
• whether date-of-entry evidence has been retained where applicable;
• whether absence records are retained;
• whether worker contact-detail histories are retained; and
• whether applicable retention periods are being observed.

 

Unless otherwise specified, Appendix D generally requires sponsored-worker records to be retained throughout sponsorship until the earlier of one year after sponsorship ends or the date on which a Home Office compliance officer has examined and approved the documents after sponsorship has ended.

Documents submitted in support of the sponsor licence application are generally required to be retained for as long as the organisation holds the licence.

Other legal requirements may require records to be retained for longer.

 

7. Worker Contact Details

 

Do not limit the audit to checking the worker’s current address.

Appendix D requires sponsors to retain relevant contact information, including a history of the sponsored worker’s:

 

• UK residential address;
• personal email address; and
• telephone number.

 

The audit should establish whether:

 

• current details are accurate;
• previous details have been preserved;
• workers know how to report changes;
• changes are updated appropriately; and
• the organisation’s HR system preserves the required history rather than simply overwriting previous information.

 

8. Date-of-Entry Evidence

 

Where the worker’s current immigration permission resulted from entry clearance sponsored by the organisation, the audit should determine whether the required date-of-entry check was completed and evidenced.

Check:

 

• whether a date-of-entry check was required;
• the relevant visa or eVisa validity period;
• when the worker entered the UK;
• what evidence was used to establish entry;
• whether that evidence has been retained; and
• whether employment commenced consistently with the applicable immigration arrangements.

 

The move towards eVisas and the 2026 changes affecting physical entry-clearance documentation mean that historic processes based solely on checking a vignette should not automatically be assumed to remain appropriate.

 

9. Right to Work Compliance

 

Review whether the organisation has conducted the appropriate right to work check and retained the required evidence.

The current right to work framework should be applied, including the employer guidance in force from 1 October 2026.

Depending on the worker and circumstances, the applicable method can involve:

 

• a Home Office online right to work check;
• an applicable Right to Work Digital Verification Service Provider process; or
• a manual document-based check where permitted.

 

For sponsored workers, the audit should ensure that the correct Home Office service has been used where an online check is required and that the evidence retained meets the sponsor’s Appendix D obligations.

Check:

 

• the method used;
• the date of the check;
• the identity of the individual checked;
• the immigration permission shown;
• any restrictions on employment;
• whether follow-up checks were required;
• whether follow-up checks were completed;
• whether evidence has been retained correctly; and
• whether the check corresponds with the sponsored employment.

 

Where the audit identifies wider right to work weaknesses affecting non-sponsored workers, the organisation should consider a separate workforce-wide right to work review.

 

10. Attendance & Absence Monitoring

 

Audit whether sponsored worker attendance and absence are monitored and recorded effectively.

Check:

 

• how attendance is monitored;
• how absence is recorded;
• whether Appendix D absence records are retained;
• who reviews extended absence;
• how unauthorised absence is escalated;
• how unpaid or reduced-pay absence is identified;
• whether payroll consequences are considered;
• whether sponsorship implications are assessed; and
• whether required reports are made within the applicable timeframe.

 

The audit should specifically test the organisation’s ability to identify absence patterns that can engage sponsor reporting requirements, including unauthorised absence of more than 10 consecutive working days and absence without pay or on reduced pay for more than four weeks in total in a calendar year, subject to the applicable exceptions and route-specific provisions.

 

11. Sponsored Worker Reporting

 

Review relevant employment events and determine whether reportable changes were identified and handled correctly.

Potential events include:

 

• employment not commencing as expected;
• employment ending;
• relevant absence;
• salary reduction;
• changes in job role or duties;
• changes in job title;
• changes in working hours;
• changes in normal work location;
• other relevant changes in employment circumstances; and
• changes affecting the basis on which the worker is sponsored.

 

Many reportable changes relating to sponsored workers are generally subject to a 10-working-day reporting period, although the precise requirement should be checked for the event concerned.

The audit should test:

Event → Identification → Escalation → Assessment → Reporting or Other Action → Evidence

 

12. Salary Changes

 

Salary should be tested carefully because different changes can have different sponsorship consequences.

The audit should identify:

 

• the salary stated on the CoS;
• contractual salary;
• current salary;
• actual payroll payments;
• working hours;
• salary reductions;
• periods of unpaid or reduced pay;
• allowances or other relevant remuneration;
• changes associated with promotion or role changes; and
• whether applicable sponsorship requirements continue to be met.

 

A reduction from the salary stated on the CoS can engage sponsor reporting and other sponsorship requirements and should be assessed carefully.

By contrast, an ordinary salary increase does not generally require an SMS report simply because pay has increased, subject to specific exceptions in the sponsor guidance. However, the circumstances surrounding an increase may still need assessment where it accompanies a promotion, change in duties, change in hours or another relevant employment event.

 

13. Roles, Duties & Change of Employment

 

The audit should compare the sponsored role with the work actually being performed.

Check:

 

• job title;
• substantive duties;
• level of responsibility;
• reporting line;
• occupation classification where relevant;
• salary;
• hours;
• work location;
• promotion history; and
• internal transfers.

 

Where the worker’s role has changed, the audit should establish whether the change could be dealt with through sponsor reporting under the applicable rules or whether it was sufficiently significant to engage the change of employment requirements.

A material role change should not automatically be treated as something that can be corrected simply through a retrospective SMS report.

 

14. Eligible Role & Genuine Role Testing

 

The audit should test whether the sponsored position continues to meet the applicable requirements for an eligible role.

The review should consider:

 

• whether the role actually exists;
• whether the duties are being performed;
• whether the role corresponds with the relevant occupation classification;
• whether salary and hours remain compliant;
• whether the business can explain the need for the role;
• whether the worker is performing the role for which they were sponsored; and
• whether the evidence supports the organisation’s account of the position.

 

The audit should investigate circumstances that could raise concerns that a role does not exist, is a sham or has been created principally to facilitate immigration permission.

The analysis should be evidence-led rather than based solely on job titles or historic documentation.

 

15. Recruitment Records

 

Review how sponsored workers were recruited and whether the organisation can explain and, where appropriate, evidence the recruitment process.

Depending on the circumstances, relevant evidence may include:

 

• vacancy information;
• advertisements;
• applications;
• shortlisting information;
• interview records;
• recruitment agency information;
• selection records;
• offer documentation;
• evidence explaining how the worker was identified; and
• records supporting the business need for the role.

 

The absence of a general resident labour market test does not make recruitment evidence irrelevant. Sponsors should still be capable of explaining how a sponsored worker was recruited and, where appropriate, evidencing the recruitment process.

Where historic or route-specific formal recruitment requirements applied, those requirements should be audited separately.

 

16. Salary, Hours & Payroll Reconciliation

 

Payroll provides important evidence of the worker’s actual employment arrangements.

For each worker reviewed, compare:

CoS → Contract → Salary → Hours → Payroll

Investigate discrepancies involving:

 

• basic salary;
• working hours;
• unpaid leave;
• reduced pay;
• deductions;
• allowances;
• overtime where relevant;
• salary sacrifice arrangements where relevant;
• promotion-related changes; and
• unexpected payroll fluctuations.

 

The audit should determine whether any discrepancy affects the applicable sponsorship requirements rather than assuming that a payroll difference is merely an accounting issue.

 

17. Work Locations & Working Arrangements

 

Review where sponsored workers actually perform their work and compare this with the information held for sponsorship purposes.

Check:

 

• the original work location;
• current normal work location;
• branch locations;
• client sites where relevant;
• remote-working arrangements;
• hybrid-working arrangements;
• changes in normal work location; and
• whether applicable reporting requirements were assessed.

 

A change in normal work location can require sponsor action. This can include a move to a new branch or client site not previously recorded or a move to permanent full-time remote working with little or no workplace attendance.

Moving to a hybrid working pattern does not, by itself, necessarily require an SMS report. Sponsors should nevertheless retain appropriate records of working arrangements and assess relevant changes to the worker’s normal work location.

Day-to-day variations should not automatically be treated as reportable changes. The audit should establish the substantive working arrangement.

 

18. HR-to-SMS Escalation

 

Test whether information held within HR and elsewhere in the organisation reaches the people responsible for sponsorship assessment.

Select actual employment events and trace what happened.

For example:

Manager changes duties → HR informed → Sponsorship team informed → Immigration assessment → Required action → Evidence

Potential escalation events include:

 

• promotion;
• salary reduction;
• change in hours;
• change in duties;
• change in work location;
• extended absence;
• unpaid leave;
• termination;
• change in immigration status; and
• corporate change.

 

The audit should identify where information can become trapped within one department.

 

19. Staff Knowledge, Training & Governance

 

Review whether the people whose roles affect sponsor compliance understand what is expected of them.

This can include:

 

• the Authorising Officer;
• SMS users;
• HR personnel;
• recruitment teams;
• payroll personnel;
• line managers;
• operations personnel; and
• senior management.

 

Training records can provide evidence that information has been communicated, but training attendance alone does not establish that staff understand or apply the requirements.

The audit should test practical knowledge through realistic scenarios.

For example:

 

• What happens if a sponsored worker is promoted?
• Who is informed if salary is reduced?
• What happens if a worker permanently changes location?
• Who monitors extended absence?
• Who assesses whether an SMS report is required?
• What happens if the normal Level 1 User is unavailable?

 

20. Previous Audit Findings & Remediation

 

Previous compliance findings should be included within the audit scope.

For each previous finding, establish:

 

• what was identified;
• what remediation was agreed;
• who was responsible;
• whether the action was completed;
• what evidence demonstrates completion;
• whether the control was subsequently tested; and
• whether the problem has recurred.

 

Closing an action because a policy has been rewritten or a training session has taken place is not necessarily sufficient.

The organisation should verify whether the revised control works in practice.

The appropriate sequence is:

Finding → Remediation → Implementation → Verification → Closure

 

21. Sponsor Licence Audit Checklist Summary

 

Audit area	Core question
Licence information	Does the Home Office record reflect the organisation today?
Key personnel	Are appropriate people responsible and do they understand their roles?
SMS access	Are individual access, MFA and user permissions secure and current?
CoS records	Does sponsorship information correspond with actual employment?
Worker files	Can the sponsor evidence the worker’s sponsored employment history?
Appendix D	Are required records complete, retained and retrievable?
Contact details	Is the required history of worker contact information retained?
Date of entry	Was the required entry check completed and evidenced?
Right to work	Was the correct check completed and evidence retained?
Attendance and absence	Can relevant absence events be identified and escalated?
Reporting	Are reportable events identified and actioned within applicable deadlines?
Roles and duties	Is the worker actually performing the sponsored role?
Eligible role	Does the position continue to meet applicable sponsorship requirements?
Recruitment	Can the organisation explain and evidence how the worker was recruited?
Salary and payroll	Do sponsorship, contractual and payroll records reconcile?
Hours	Do actual working arrangements correspond with sponsorship records?
Work location	Is the worker operating from the expected normal location?
HR escalation	Do relevant business events reach the sponsorship function?
Staff knowledge	Do relevant personnel know what they need to identify and escalate?
Remediation	Have previous findings actually been corrected and verified?

 

The checklist should ultimately allow the sponsor to answer four questions for every major area of compliance:

What is required?

What evidence do we have?

What is actually happening?

What control keeps us compliant when something changes?

Where the organisation cannot answer all four questions confidently, the issue should be investigated further as part of the audit.

 

 

Back to top

 

Section G: Auditing Sponsored Worker Files

 

Sponsored worker files are a central part of a sponsor licence compliance audit because they provide the documentary evidence connecting the individual worker to the organisation’s sponsorship records and actual employment arrangements.

The purpose of the worker-file audit is not simply to establish whether a file contains a prescribed set of documents. It should determine whether the complete record provides an accurate, consistent and evidenced history of the worker’s sponsored employment.

For each worker selected for review, the audit should reconcile:

CoS → Immigration Status → Contract → Actual Duties → Salary → Payroll → Hours → Work Location → Attendance → SMS

Compliance is strongest where every source tells the same story.

 

1. Start with the Certificate of Sponsorship

 

The Certificate of Sponsorship provides an important reference point for the audit because it records the basis on which the worker was originally sponsored.

The audit should review relevant CoS information, including:

 

• worker identity;
• sponsored immigration route;
• job title;
• occupation classification where relevant;
• job description;
• salary;
• working hours;
• work location;
• employment dates; and
• other material information provided when sponsorship was assigned.

 

The auditor should then compare this information with the worker’s subsequent employment history.

The fact that the CoS was accurate when assigned does not establish that the worker’s circumstances have remained unchanged.

 

2. Check Immigration Status

 

The worker file should contain appropriate evidence of the individual’s immigration status and the organisation’s right to work checking process.

The audit should establish:

 

• the immigration permission held by the worker;
• the period for which permission was granted;
• any relevant conditions or restrictions;
• whether the immigration permission corresponds with the sponsored employment;
• whether the required right to work check was completed;
• whether appropriate evidence of the check was retained;
• whether any follow-up check was required; and
• whether immigration expiry dates are monitored effectively.

 

The audit should use the current right to work framework rather than relying on historic checking practices that may no longer reflect current Home Office guidance.

 

3. Check Date-of-Entry Evidence Where Required

 

Where the worker’s current immigration permission resulted from entry clearance sponsored by the organisation, Appendix D can require the sponsor to retain evidence establishing the worker’s date of entry to the UK.

The audit should determine:

 

• whether a date-of-entry check was required;
• the validity period of the relevant immigration permission;
• when the worker entered the UK;
• what evidence was used to establish the date of entry;
• whether the evidence has been retained; and
• whether the worker entered during the relevant validity period.

 

The evidence available may differ depending on the worker’s immigration documentation and travel history, including where immigration status is evidenced digitally through an eVisa.

The 2026 transition away from physical entry-clearance vignettes in relevant cases means sponsors should ensure that their processes reflect the current Appendix D requirements rather than relying solely on historic vignette-checking procedures.

 

4. Review the Employment Contract

 

The worker’s employment contract should be compared with the sponsorship information and current employment arrangements.

Relevant terms can include:

 

• job title;
• duties;
• salary;
• working hours;
• work location;
• employment start date;
• employment end date where applicable;
• contractual benefits where relevant; and
• other terms that may affect the sponsored role.

 

The auditor should not assume that the contract necessarily reflects the worker’s current circumstances.

Where employment arrangements have changed since the contract was issued, the audit should identify what changed, when it changed and whether the change was documented and assessed for sponsorship purposes.

 

5. Compare the Job Description with Actual Duties

 

The worker’s job description should be compared with the duties the individual actually performs.

This is important because sponsor compliance is concerned with the substantive role rather than the job title alone.

The audit should consider:

 

• the original job description;
• current duties;
• level of responsibility;
• reporting line;
• department;
• management responsibilities;
• professional or technical responsibilities;
• occupation classification where relevant; and
• changes since sponsorship began.

 

Evidence can be obtained from the worker’s file, organisational charts, managers, internal records and, where appropriate, the sponsored worker.

Where duties have changed, the sponsor should determine whether the change was reportable under the applicable sponsor rules or whether the change was sufficiently significant to engage the change of employment requirements.

A material role change should not automatically be treated as something that can be resolved simply by making a retrospective SMS report.

 

6. Test Whether the Role Remains an Eligible Role

 

The worker-file audit should also test whether the actual position continues to meet the applicable sponsorship requirements for an eligible role.

The review can consider:

 

• whether the role actually exists within the organisation;
• whether the worker performs the stated duties;
• whether the level of the role is consistent with the sponsorship basis;
• whether the occupation classification remains appropriate;
• whether salary and hours remain compliant;
• whether the organisation can explain the business need for the position;
• whether the worker’s place within the organisational structure supports the role; and
• whether the overall evidence supports the organisation’s account of the employment.

 

The audit should investigate evidence suggesting that the apparent role does not exist in practice, is a sham or may have been created principally to facilitate immigration permission.

The assessment should be evidence-led and based on the substantive position rather than the label given to the job.

 

7. Reconcile Salary with Payroll

 

The salary stated for sponsorship purposes should be reconciled against the worker’s actual pay.

The audit should compare:

CoS → Contract → Salary Changes → Working Hours → Payroll

Relevant evidence can include:

 

• the salary stated on the CoS;
• contractual salary;
• current salary;
• payslips;
• payroll reports;
• working hours;
• salary-change documentation;
• periods of unpaid leave;
• periods of reduced pay;
• deductions;
• allowances where relevant; and
• other remuneration information relevant to the sponsorship assessment.

 

Unexpected differences should be investigated.

A salary discrepancy may result from a payroll error, change in working hours, absence, salary sacrifice, promotion, deduction or another employment event. The audit should establish the underlying facts before determining the sponsorship implications.

 

8. Distinguish Salary Increases from Salary Reductions

 

The audit should avoid treating all salary changes as having the same reporting consequences.

A reduction from the salary stated on the CoS can engage sponsor reporting requirements and may require wider assessment of whether the worker continues to meet the applicable sponsorship conditions.

An ordinary salary increase does not generally require an SMS report merely because the worker’s pay has increased, subject to specific exceptions in the sponsor guidance.

However, a salary increase should still be examined where it forms part of another employment change.

For example, an increase may accompany:

 

• a promotion;
• a new job title;
• materially different duties;
• a change in working hours;
• a departmental transfer; or
• another change requiring sponsorship assessment.

 

The audit should therefore consider the employment event as a whole rather than looking at the salary figure in isolation.

 

9. Check Working Hours

 

The worker’s actual working hours should be compared with the information used for sponsorship and with payroll.

The audit should investigate:

 

• contracted hours;
• actual normal hours;
• changes in working hours;
• part-time arrangements;
• temporary reductions in hours;
• changes associated with absence;
• pay changes resulting from altered hours; and
• whether changes affect the applicable sponsorship requirements.

 

Salary should not be considered independently from working hours where the applicable immigration requirements depend on the relationship between the two.

 

10. Check the Worker’s Normal Work Location

 

The audit should establish where the worker actually performs their role and compare this with the location information held for sponsorship purposes.

Check:

 

• the original work location;
• the current normal work location;
• branch locations;
• client sites where relevant;
• remote-working arrangements;
• hybrid-working arrangements;
• historic changes in normal work location; and
• whether any applicable reporting requirement was considered.

 

A change to the worker’s normal work location can require sponsor action. This can include a move to a new branch or client site not previously recorded or a move to permanent full-time remote working with little or no workplace attendance.

Moving to hybrid working does not, by itself, necessarily require an SMS report. Sponsors should nevertheless maintain appropriate records of working arrangements and continue to assess changes to the worker’s normal work location.

The audit should focus on the substantive working arrangement rather than treating occasional or day-to-day location variations as automatic reporting events.

 

11. Audit Attendance & Absence Records

 

Sponsored worker files should be reviewed alongside attendance and absence records.

Appendix D requires sponsors to retain relevant records of sponsored worker absences, while sponsor duties can also require action where particular absence circumstances arise.

The audit should establish:

 

• how absence is recorded;
• whether records are complete;
• whether managers escalate relevant absence;
• whether unauthorised absence is identified;
• whether periods of unpaid or reduced-pay absence are identified;
• whether payroll consequences are assessed;
• whether sponsorship implications are considered; and
• whether any required reports were made.

 

Current sponsor guidance includes specific provisions relating to unauthorised absence of more than 10 consecutive working days and absence without pay or on reduced pay for more than four weeks in total in a calendar year, subject to the applicable exceptions and route-specific provisions.

The audit should therefore test whether the organisation’s absence systems are capable of identifying these situations rather than relying on individual managers to recognise immigration consequences themselves.

 

12. Review Right to Work Evidence

 

The sponsored worker file should contain appropriate evidence that the relevant right to work process was completed.

Under the right to work framework in force from 1 October 2026, the applicable checking method can depend on the worker and their evidence of status.

The permitted framework includes, where applicable:

 

• a Home Office online right to work check;
• an applicable Right to Work Digital Verification Service Provider process; or
• a manual document-based check where permitted.

 

For sponsored workers, the audit should ensure that the correct Home Office service was used where an online check was required and that evidence has been retained in accordance with the sponsor’s record-keeping obligations.

The review should also establish whether:

 

• the check was conducted before employment commenced where required;
• the worker’s identity corresponds with the person checked;
• the permission allowed the work in question;
• any relevant employment restrictions were considered;
• a follow-up check was required;
• follow-up checks were completed where applicable; and
• the evidence remains retrievable.

 

13. Audit Worker Contact-Detail Histories

 

The worker file should contain or provide access to the required history of the worker’s contact information.

This includes relevant history of the worker’s:

 

• UK residential address;
• personal email address; and
• telephone number.

 

The audit should not simply confirm that the latest details are present.

It should establish whether:

 

• current details are accurate;
• previous details have been preserved;
• workers know how to notify the organisation of changes;
• changes are recorded promptly; and
• the required history can be produced.

 

This is particularly important where HR systems automatically overwrite previous contact information when a worker updates their details.

 

14. Review Recruitment Evidence

 

The worker file should be reviewed for evidence explaining how the individual came to be recruited into the sponsored role.

The absence of a general resident labour market test does not mean that recruitment history is irrelevant.

Depending on the circumstances, relevant evidence can include:

 

• vacancy information;
• advertising;
• applications;
• shortlisting records;
• interview records;
• recruitment agency correspondence;
• selection records;
• offer documentation;
• records explaining how the worker was identified; and
• evidence supporting the need for the role.

 

The organisation should be capable of explaining how the worker was recruited and, where appropriate, evidencing that process.

Where historic or route-specific formal recruitment requirements applied, the audit should separately establish whether the required records were retained.

 

15. Build a Compliance Timeline for Each Worker

 

A worker-file audit is more effective where relevant events are arranged chronologically.

A compliance timeline can include:

 

• CoS assignment;
• visa or immigration permission grant;
• entry to the UK where relevant;
• right to work check;
• employment commencement;
• salary changes;
• changes in hours;
• promotions;
• changes in duties;
• changes in work location;
• significant absence;
• immigration extensions;
• SMS reports;
• changes in employment arrangements; and
• termination of employment or sponsorship where applicable.

 

This allows the auditor to identify gaps between the event occurring and the organisation taking any required sponsorship action.

A timeline can also reveal patterns that are difficult to identify when documents are reviewed separately.

 

16. Reconcile the Worker File with the SMS

 

The worker file should not be audited independently from the Sponsor Management System.

Relevant SMS information should be compared with:

 

• HR records;
• employment documentation;
• payroll;
• attendance records;
• work-location information;
• manager information; and
• the worker’s actual circumstances.

 

Where a relevant employment event occurred, the audit should establish whether:

Event occurred → Event identified → Event assessed → Required action taken → SMS evidence retained

Where no SMS report was made, the audit should determine whether this was because the event was correctly assessed as non-reportable or because the organisation failed to identify or action the requirement.

 

17. Test Reporting Deadlines

 

Where the worker file identifies a reportable event, the audit should test whether the report was made within the applicable timeframe.

Many reportable worker changes are generally subject to a 10-working-day reporting period, although the precise rule should be checked for the particular event.

The audit record should identify:

 

• the event;
• the date it occurred;
• the date the organisation became aware of it;
• the applicable sponsor requirement;
• the reporting deadline;
• the date of the SMS report;
• evidence of the report; and
• any discrepancy requiring investigation.

 

This allows the auditor to distinguish between accurate reporting, late reporting and events that were never assessed.

 

18. Test Appendix D Retention

 

The worker-file audit should also establish whether records have been retained for the required period.

Unless otherwise specified, Appendix D generally requires sponsored-worker documents to be retained throughout sponsorship until the earlier of:

 

• one year after the sponsorship ends; or
• the date on which a Home Office compliance officer has examined and approved the documents after sponsorship has ended.

 

Other legal or regulatory requirements may require particular documents to be retained for longer.

The audit should therefore examine both current sponsored worker files and, where relevant, records relating to former sponsored workers.

 

19. Check Whether Records Can Be Retrieved

 

Record keeping is not effective if relevant evidence exists somewhere within the organisation but cannot be located when required.

The audit should test actual retrieval.

For a sample worker, the organisation should be able to locate relevant evidence without relying entirely on the knowledge of one individual.

This is particularly important where records are spread across:

 

• HR systems;
• shared drives;
• email accounts;
• payroll platforms;
• recruitment systems;
• manager records;
• archived files; and
• third-party systems.

 

Where evidence cannot be retrieved promptly, the organisation should investigate whether the issue is isolated or indicates a wider record-management weakness.

 

20. Expand the Sample Where Problems Are Found

 

If the worker-file review identifies a recurring issue, the audit should expand sufficiently to determine whether the problem is systemic.

For example:

 

• missing date-of-entry evidence may justify checking other workers who entered under similar circumstances;
• incomplete contact histories may indicate an HR-system design problem;
• salary discrepancies may justify testing other workers affected by the same payroll process;
• missing absence records may indicate a wider record-keeping weakness;
• incorrect work locations may indicate that managers do not escalate location changes; and
• repeated role discrepancies may indicate weak controls over promotions or internal transfers.

 

The appropriate approach is:

Finding → Root Cause → Potential Population → Expanded Testing → Full Exposure

 

21. Record Worker-File Findings

 

Each material worker-file finding should be documented clearly.

A useful structure is:

Requirement → Evidence → Finding → Exposure → Remediation → Verification

For example:

 

Audit element	Example
Requirement	Relevant sponsored worker contact history must be retained.
Evidence	HR system contains only the worker’s current residential address.
Finding	Previous address history cannot currently be produced.
Exposure	Potential Appendix D record-keeping weakness; wider worker population may be affected.
Remediation	Establish whether historic information can legitimately be recovered and modify the process to preserve future changes.
Verification	Re-test a sample after implementation to confirm address histories are being retained.

 

This approach ensures that the audit identifies both the immediate problem and the action needed to prevent recurrence.

 

22. The Sponsored Worker File Audit Test

 

At the end of each worker-file review, the auditor should be able to answer:

Who is this worker and what immigration permission do they hold?

What role were they sponsored to perform?

What role are they actually performing?

What should they be paid and what have they actually been paid?

What hours do they work?

Where do they normally work?

Can required attendance, absence and contact records be produced?

Were relevant employment changes identified and assessed?

Were required reports made within the applicable timeframe?

Can the organisation evidence the worker’s sponsored employment throughout the period under review?

If these questions cannot be answered from consistent and reliable evidence, the file should be investigated further.

 

 

Back to top

 

Section H: Auditing the Sponsor Management System

 

The Sponsor Management System (SMS) is central to the administration of a sponsor licence. A sponsor licence compliance audit should therefore test both the accuracy of the information recorded on the SMS and the controls governing how the system is accessed and used.

The audit should not be limited to checking whether the organisation can log into the SMS.

It should establish whether:

 

• appropriate people have access;
• access is secure;
• sponsor licence information is accurate;
• Certificates of Sponsorship have been administered correctly;
• relevant worker changes have been assessed and reported where required;
• relevant organisational changes have been assessed and reported where required;
• the SMS corresponds with HR, payroll and operational records; and
• the organisation maintains an effective audit trail of sponsorship activity.

 

A useful SMS audit should test three areas:

Accuracy → Completeness → Control

 

1. Audit SMS User Access

 

The audit should begin by establishing exactly who has access to the SMS.

For each user, determine:

 

• the individual’s identity;
• their SMS user level;
• their current role within the organisation;
• whether they still require access;
• whether their contact information is current;
• whether their permissions remain appropriate;
• whether their account is being used only by that individual;
• when the user last accessed the SMS;
• whether the account is at risk of being treated as inactive;
• whether any Home Office inactive-user notification requires action; and
• whether access should be changed or removed.

 

Former employees and individuals who no longer need SMS access should not simply remain on the system because their accounts have been overlooked.

The audit should also determine whether the organisation relies excessively on one SMS user. If only one person understands how the system operates, absence or departure can create a significant operational compliance risk.

 

2. Review Level 1 User Arrangements

 

Level 1 Users perform important sponsor administration functions through the SMS.

The audit should establish whether:

 

• current Level 1 Users remain appropriate;
• they meet applicable requirements;
• they understand their responsibilities;
• they have sufficient knowledge to perform their functions;
• their SMS contact information is accurate;
• at least one eligible Level 1 User remains active;
• Level 1 access is being maintained regularly, including in line with the Home Office recommendation to access the SMS at least once a month;
• there is sufficient cover during absence;
• responsibilities between multiple users are clear; and
• the Authorising Officer maintains appropriate oversight.

 

The organisation should avoid a situation where the formal Authorising Officer has little practical understanding of sponsorship because all responsibility has effectively been delegated to an SMS user.

The Authorising Officer retains overall responsibility for the sponsor licence and for the actions of the organisation’s SMS users.

 

3. Audit Remaining Level 2 Users

 

The 2026 changes to SMS user administration should form part of the current audit.

Sponsors have been unable to appoint new Level 2 Users since 9 September 2026. Existing Level 2 Users are subject to transitional arrangements under which eligible users need to be upgraded to Level 1 or otherwise deactivated by 8 March 2027.

The audit should therefore identify:

 

• whether any Level 2 Users remain active;
• whether those individuals still require SMS access;
• whether they are eligible to become Level 1 Users;
• whether an upgrade is required;
• whether any account should instead be deactivated; and
• who is responsible for completing the transition.

 

This should be treated as an active compliance action rather than left until the transitional deadline approaches.

 

4. Audit Multi-Factor Authentication

 

The phased introduction of mandatory multi-factor authentication for the SMS during 2026 has made individual account security and accurate user contact information increasingly important. Mandatory MFA rollout began on 3 September 2026 and is being introduced to existing sponsors on a phased basis, with completion expected by November 2026. It applies immediately to organisations granted a sponsor licence on or after 9 September 2026.

The audit should establish whether multi-factor authentication is operating correctly where applicable. Level 1 Users should have accurate date of birth, mobile number and email details recorded for authentication purposes, while any remaining Level 2 Users should have an accurate email address.

For each relevant user, check:

 

• whether the account is linked to the correct individual;
• whether the registered email address is current;
• whether the registered telephone details are current where relevant;
• whether the user can receive the required authentication code;
• whether one-time passcodes are kept secure;
• whether credentials are shared with colleagues; and
• whether there are contingency arrangements where an authorised user is unavailable.

 

SMS credentials, passwords and one-time passcodes should not be shared between users.

A useful security chain is:

Named User → Individual Account → Current Contact Details → MFA → Appropriate Permissions → Secure Use

 

5. Check Sponsor Licence Information on the SMS

 

The audit should compare the organisation’s current circumstances with the information held for the sponsor licence.

Relevant information can include:

 

• organisation name;
• trading names;
• registered address;
• operating addresses;
• branches;
• contact information;
• key personnel;
• organisation structure where relevant;
• ownership information where relevant; and
• other licence details capable of being affected by organisational change.

 

Differences should be investigated to determine whether they are administrative discrepancies or indicate that a reportable organisational event was not dealt with correctly.

 

6. Audit Organisational Change Reporting

 

The SMS audit should examine significant organisational events during the period under review.

Potential events include:

 

• changes to organisation details;
• changes of address;
• changes to branches;
• changes in key personnel;
• mergers;
• acquisitions;
• takeovers;
• demergers;
• TUPE transfers;
• changes in direct ownership;
• restructuring; and
• relevant insolvency events.

 

Specified organisational changes are generally subject to a 20-working-day reporting or action framework, although the precise requirement depends on the event.

The audit should not assume that every corporate change can be resolved simply by updating the SMS.

Depending on the circumstances, corporate changes can have wider consequences for the sponsor licence and sponsored workers and can potentially require a new sponsor licence application.

The audit should therefore establish:

Corporate Event → Sponsor Impact Assessment → Required Action → Deadline → Completion → Evidence

 

7. Audit Certificates of Sponsorship on the SMS

 

The audit should review a suitable sample of Certificates of Sponsorship and compare the information recorded on the SMS with the worker’s actual employment.

Check relevant information including:

 

• worker identity;
• immigration route;
• job title;
• occupation classification where relevant;
• job description;
• salary;
• working hours;
• work location;
• employment dates; and
• other material sponsorship information.

 

The objective is not simply to establish that the CoS was completed correctly when assigned.

The audit should determine whether subsequent events altered the worker’s circumstances and whether those events were assessed appropriately.

 

8. Reconcile the SMS with HR Records

 

SMS information should be compared with the organisation’s HR records.

For sampled workers, compare:

 

• job title;
• department;
• duties;
• salary;
• working hours;
• work location;
• employment status;
• employment start date;
• employment end date where applicable; and
• significant employment changes.

 

Differences should be investigated.

The audit should determine whether the SMS is inaccurate, the HR system is inaccurate or a relevant change occurred without appropriate sponsorship assessment.

 

9. Reconcile the SMS with Payroll

 

Payroll is an important independent source of evidence because it records what the worker has actually been paid.

For sampled workers, compare:

CoS → SMS → Contract → Working Hours → Payroll

Investigate:

 

• salary reductions;
• unexpected pay variations;
• changes in hours;
• unpaid leave;
• reduced pay;
• deductions;
• allowances where relevant;
• promotion-related changes; and
• other discrepancies affecting sponsored remuneration.

 

A salary reduction from the level stated on the CoS can engage sponsor reporting and other sponsorship requirements and should be assessed carefully.

An ordinary salary increase does not generally require an SMS report merely because pay has increased, subject to specific exceptions in the sponsor guidance. However, the audit should consider whether the increase accompanied another relevant change, such as a promotion, different duties or altered working hours.

 

10. Audit Worker Change Reporting

 

The audit should identify significant employment events and determine whether they were correctly assessed for sponsor reporting purposes.

Potential events include:

 

• employment not commencing as expected;
• employment ending;
• relevant absence;
• salary reduction;
• changes in job role;
• changes in duties;
• changes in job title;
• changes in working hours;
• changes in normal work location; and
• other relevant changes affecting the sponsored employment.

 

Many reportable worker changes are generally subject to a 10-working-day reporting period, although the applicable requirement should be checked for the specific event.

For each event, trace:

Event → Identification → Escalation → Assessment → SMS Action or Other Required Action → Evidence

 

11. Distinguish Reporting from Change of Employment Requirements

 

The audit should not assume that every change to a sponsored worker’s role can be dealt with through an SMS report.

Where a worker has changed job title, duties or responsibilities, the organisation should establish whether:

 

• the worker remains in the same relevant occupation classification;
• the substantive sponsored role remains appropriate;
• the change can be dealt with through sponsor reporting under the applicable rules; or
• the change is sufficiently significant to engage the change of employment requirements.

 

This distinction is important because making an SMS report does not itself resolve a situation where the applicable immigration requirements require a different process.

The audit should therefore review the original event and the legal assessment made at the time.

 

12. Audit Work-Location Reporting

 

The SMS audit should compare recorded work-location information with the worker’s actual normal working arrangements.

The review should consider:

 

• the original sponsored work location;
• the current normal work location;
• new branches;
• client sites where relevant;
• permanent remote working;
• hybrid working;
• historic location changes; and
• the reporting assessment made for relevant changes.

 

A change to the worker’s normal work location can require sponsor reporting, including circumstances involving a new branch or client site not previously recorded or a move to permanent full-time remote working with little or no workplace attendance.

Moving to a hybrid working pattern does not, by itself, necessarily require an SMS report. Sponsors should nevertheless maintain appropriate records and assess relevant changes to the worker’s normal work location.

Day-to-day variations in location should not automatically be treated as reportable changes.

 

13. Audit Absence Reporting

 

The SMS audit should be reconciled with attendance and absence information held elsewhere in the organisation.

Relevant records can include:

 

• HR absence records;
• manager records;
• timesheets;
• payroll;
• leave records;
• sickness records; and
• records of unpaid or reduced-pay absence.

 

The audit should establish whether circumstances potentially engaging sponsor reporting requirements were identified and assessed.

Current sponsor guidance includes specific provisions concerning unauthorised absence of more than 10 consecutive working days and absence without pay or on reduced pay for more than four weeks in total in a calendar year, subject to the applicable exceptions and route-specific requirements.

The key control question is whether the sponsorship team receives relevant absence information in time to assess and take any required action.

 

14. Audit the SMS Reporting History

 

Where possible, the organisation should review its reporting history rather than examining only the current SMS position.

The audit should identify:

 

• what reports were made;
• which worker or organisational event triggered the report;
• when the event occurred;
• when the organisation became aware of it;
• when the report was submitted;
• whether the report accurately described the event; and
• whether supporting evidence exists.

 

This allows the sponsor to test both the quality and timeliness of its reporting.

It can also identify repeated patterns, such as reports consistently being made late because information reaches the Level 1 User too slowly.

 

15. Test Events That Did Not Result in an SMS Report

 

An SMS audit should not examine only events that were reported.

The organisation should select employment and business changes from HR, payroll and corporate records and trace whether they were considered for sponsorship purposes.

This is important because the absence of an SMS report may mean either:

 

• the event was correctly assessed as non-reportable; or
• the event was never identified or assessed.

 

These are very different compliance outcomes.

A useful test is:

Business Event → Was Sponsorship Considered? → What Requirement Applied? → What Decision Was Made? → Is the Decision Evidenced?

 

16. Check the Quality of SMS Reporting Decisions

 

The audit should test whether reporting decisions are based on the correct sponsor requirement rather than habit or assumption.

For example:

 

• not every salary increase is reportable;
• a salary reduction may require reporting and wider assessment;
• not every role change can be dealt with through reporting;
• hybrid working does not automatically require reporting;
• a substantive change in normal work location may require reporting; and
• some corporate changes can require action beyond an SMS update.

 

The quality of the decision-making process is therefore as important as the number of reports made.

Over-reporting every minor event is not a substitute for understanding the sponsor requirements.

 

17. Check for Unresolved SMS Actions

 

The audit should identify any sponsorship actions that were started but not completed.

This can include:

 

• draft reports;
• internal requests awaiting information;
• changes identified by HR but not assessed;
• outstanding key personnel changes;
• incomplete user-access changes;
• unresolved CoS issues;
• corporate changes awaiting sponsorship assessment; and
• previous audit findings requiring SMS action.

 

Outstanding actions should have a named owner and clear deadline.

The organisation should not rely on informal email chains or individual memory to manage significant sponsor actions.

 

18. Test SMS Business Continuity

 

The sponsor should be able to operate the SMS appropriately when a regular user is absent or leaves the organisation.

The audit should therefore establish:

 

• whether there is adequate authorised user cover;
• whether responsibilities are documented;
• whether relevant records can be accessed by authorised personnel;
• whether MFA arrangements create any single-person dependency;
• whether outstanding actions are centrally recorded; and
• whether the organisation can continue meeting reporting deadlines during absence.

 

Business continuity should not depend on sharing another user’s SMS credentials.

Each authorised user should operate through their own account and applicable authentication arrangements.

 

19. Check the HR-to-SMS Escalation Process

 

Many SMS failures originate outside the SMS itself.

The system cannot be updated correctly if relevant information never reaches the person responsible for sponsorship.

The audit should therefore test how information flows from:

 

• line managers;
• HR;
• recruitment;
• payroll;
• finance;
• operations;
• legal or compliance teams; and
• senior management.

 

For significant employment events, test:

Business Event → Internal Notification → Sponsorship Escalation → Assessment → SMS Action → Evidence

The auditor should identify points where relevant information can become delayed or lost.

 

20. Record the Reason for Reporting Decisions

 

Where a potentially significant event is assessed as not requiring an SMS report, it can be useful for the organisation to retain an appropriate record of the decision and reasoning.

This is particularly useful where the circumstances could later raise questions, such as:

 

• changes in duties;
• salary changes;
• work-location changes;
• hybrid-working arrangements;
• absence;
• internal transfers; and
• corporate changes.

 

The record does not need to turn every routine HR event into a formal legal memorandum.

The objective is to demonstrate that material sponsorship implications were considered rather than overlooked.

 

21. Investigate Missing or Late SMS Reports Carefully

 

Where the audit identifies a potentially missed or late report, the organisation should establish the facts before deciding what remedial action is appropriate.

The review should determine:

 

• what happened;
• when it happened;
• when the organisation became aware of it;
• what sponsor requirement applied;
• whether the event was reportable;
• what deadline applied;
• whether any action was taken;
• whether the issue is continuing;
• whether other workers may be affected; and
• why the normal control failed.

 

The sponsor should not automatically assume that every historical discrepancy should be dealt with through the same retrospective action.

The correct response depends on the applicable requirement and the factual circumstances.

 

22. Maintain an SMS Audit Trail

 

The organisation should be able to evidence significant sponsorship activity and decisions.

A useful audit trail can include:

 

• the event giving rise to consideration;
• the evidence reviewed;
• the applicable sponsor requirement;
• the decision made;
• the person responsible;
• the date of action;
• confirmation or evidence of an SMS report where applicable; and
• any subsequent verification.

 

This is particularly important where different departments contribute to the process.

The audit trail should allow another appropriately authorised person to understand what happened without relying solely on the recollection of the original decision-maker.

 

23. The SMS Audit Test

 

At the end of the SMS review, the organisation should be able to answer:

Who has access to our SMS and why?

Are individual accounts and authentication arrangements secure?

Are our Level 1 and remaining Level 2 User arrangements current?

Does our sponsor licence information reflect the organisation today?

Do our CoS and SMS records correspond with actual sponsored employment?

Can we identify changes affecting sponsored workers?

Can we identify changes affecting the organisation?

Do relevant events reach the sponsorship function quickly enough?

Are reporting decisions based on the correct sponsor requirements?

Are required reports made within the applicable deadlines?

Can we evidence what was reported, when and why?

The final assessment should therefore test:

Accuracy → Completeness → Control

The SMS should not operate as an isolated Home Office administration tool. It should form part of an integrated compliance process connecting sponsorship records with HR, payroll, management and the reality of the sponsored workforce.

 

 

Back to top

 

Section I: Auditing Right to Work Compliance

 

Right to work compliance and sponsor licence compliance are closely connected, but they are not the same legal regime. A sponsor licence audit should test whether appropriate right to work checks have been completed for sponsored workers while recognising the separate requirements governing the statutory excuse against liability for illegal working. A sponsor must ensure that an appropriate right to work check is carried out for any worker it sponsors, including where the sponsor is not the worker’s direct employer.

Separately, from 1 October 2026, the statutory right to work regime extends beyond conventional contracts of employment to specified additional working arrangements, including certain individuals engaged under a worker’s contract, individual subcontractors and certain arrangements involving online matching services.

The audit should establish not only whether a right to work check appears on the worker’s file, but whether the correct checking method was used, the check was completed at the appropriate time, the evidence was retained and any restrictions or follow-up requirements were acted upon.

A useful audit sequence is:

Identity → Immigration Status → Correct Check → Permission to Work → Restrictions → Evidence → Follow-Up → Monitoring

 

1. Identify Which Right to Work Check Was Required

 

The first step is to establish which right to work checking method applied to the individual at the relevant time.

Under the employer right to work framework in force from 1 October 2026, the applicable method can include:

 

• a Home Office online right to work check;
• a check using an applicable Right to Work Digital Verification Service Provider (RtW DVSP); or
• a manual document-based right to work check where permitted.

 

The correct method depends on the worker’s circumstances and the evidence through which their right to work can be established.

The audit should therefore avoid applying one checking method retrospectively to every worker without considering what process was applicable when the check was conducted.

 

2. Audit Home Office Online Right to Work Checks

 

Many sponsored workers will evidence their right to work digitally.

Where a Home Office online right to work check was required, the audit should establish whether the employer used the appropriate GOV.UK right to work checking service.

For each sampled check, review:

 

• the identity of the worker;
• the date the check was conducted;
• the photograph displayed by the service;
• the immigration status shown;
• the expiry date where permission is time-limited;
• the type of work permitted;
• any conditions or restrictions;
• whether the check related to the individual presenting for work;
• whether appropriate evidence of the online check was retained; and
• whether a follow-up check was identified where required.

 

For sponsored workers, the audit should ensure that the correct Home Office right to work service was used rather than relying on another Home Office immigration-status service that does not itself constitute the prescribed employer right to work checking process.

 

3. Audit Share Code Checks

 

Where the worker used the Home Office online service, the employer should have completed the employer-side check using the worker’s share code and date of birth.

The audit should establish whether:

 

• the appropriate share code was obtained;
• the employer completed the check through the correct service;
• the employer viewed the individual’s right to work information;
• the photograph was checked against the individual;
• employment restrictions were considered;
• the result was retained in an appropriate format; and
• the date of the check can be evidenced.

 

The existence of a share code alone is not evidence that the employer completed the required online right to work check.

 

4. Audit Digital Verification Service Provider Checks

 

Where an applicable Right to Work Digital Verification Service Provider process has been used, the audit should establish whether the worker and documentation fell within the scope of the relevant digital verification process.

The audit should examine:

 

• which provider was used;
• the identity document relied upon;
• the result supplied by the provider;
• the date of the check;
• the employer’s own identity verification responsibilities;
• the evidence retained; and
• whether the process was appropriate for the worker concerned.

 

Using a third-party identity service does not remove the employer’s responsibility to ensure that the prescribed right to work process has been completed correctly.

 

5. Audit Manual Right to Work Checks

 

Where a manual document-based check was permitted, the audit should test whether the prescribed process was followed.

This should include establishing whether:

 

• acceptable original documentation was obtained where required;
• the documents related to the individual presenting for work;
• photographs and dates of birth were consistent with the individual;
• expiry dates and immigration restrictions were considered;
• the documents appeared reasonably genuine and unaltered;
• any differences in names were appropriately explained;
• copies were taken in the required manner;
• the date of the check was recorded; and
• the evidence remains retrievable.

 

The audit should apply the document requirements that were legally relevant to the check concerned rather than assuming that historic physical documents remain acceptable for new checks.

 

6. Check That the Right to Work Check Was Completed at the Correct Time

 

The timing of the right to work check should be tested.

For an initial statutory right to work check, the employer should establish the individual’s right to work before employment begins.

The audit should compare:

 

• the right to work check date;
• the contractual start date;
• the payroll commencement date;
• the actual first day of employment; and
• any relevant immigration permission dates.

 

A check completed after employment has already commenced should be investigated carefully rather than treated as equivalent to a correctly timed initial check.

 

7. Check That the Worker Is the Person Whose Status Was Checked

 

A right to work check is not simply a database or document exercise.

The employer should establish that the person presenting for employment is the individual whose right to work has been checked.

The audit should therefore test whether the organisation’s process requires the person conducting the check to compare the worker with the photograph or identity information produced through the applicable checking method.

This control should operate consistently regardless of whether the recruitment process takes place in person or remotely.

 

8. Check Whether the Permission Allows the Work in Question

 

The existence of immigration permission does not automatically establish that the individual can undertake any form of employment.

The audit should consider whether the right to work result permits the work being undertaken and whether any relevant restrictions have been observed.

For sponsored workers, this should be reconciled with:

 

• the sponsored route;
• the Certificate of Sponsorship;
• the job being performed;
• working hours;
• any relevant conditions; and
• the worker’s actual employment arrangements.

 

Where the right to work evidence appears inconsistent with the sponsored employment, the discrepancy should be investigated.

 

9. Audit Time-Limited Right to Work

 

Where the worker has time-limited permission, the organisation should have a reliable system for identifying when further right to work action is required.

The audit should test:

 

• the immigration permission expiry date;
• the date recorded within HR systems;
• the timing of reminder alerts;
• who receives those alerts;
• who is responsible for the follow-up check;
• what happens if evidence of extended permission is not immediately available;
• whether the check is completed within the required timeframe; and
• whether evidence of the new check is retained.

 

The process should not depend solely on the sponsored worker remembering to notify HR that their immigration permission is approaching expiry.

 

10. Test Immigration Expiry Monitoring

 

The audit should compare immigration expiry dates across relevant systems.

Potential sources include:

 

• right to work records;
• HR systems;
• immigration case records;
• the worker file;
• calendar alerts; and
• other compliance tracking systems.

 

Differences should be investigated.

An organisation should be particularly cautious where an expiry date has been manually entered into one system and then relied upon for future alerts without independent verification.

The audit should test whether alerts actually generate and whether somebody acts on them.

 

11. Audit Employer Checking Service Cases

 

There may be circumstances in which an employer needs to use the Home Office Employer Checking Service (ECS), including relevant cases where an individual has an outstanding immigration application, administrative review or appeal and their right to work cannot be established through the normal online service.

Where the ECS has been used, the audit should establish:

 

• why the ECS check was required;
• when the request was submitted;
• what information was provided;
• whether a Positive Verification Notice (PVN) was received;
• the date of the PVN;
• how long the statutory excuse provided by the PVN applied;
• whether a further check was diarised where required; and
• whether the relevant evidence has been retained.

 

The audit should identify any cases where employment continued while the organisation lacked appropriate evidence of the worker’s continuing right to work.

 

12. Reconcile Right to Work with Sponsorship Records

 

Right to work evidence should be compared with the organisation’s sponsorship records.

For each sampled sponsored worker, reconcile:

Right to Work → Immigration Status → CoS → Contract → Actual Role → Employment Dates

The audit should investigate differences involving:

 

• worker identity;
• immigration route;
• permission dates;
• employment commencement;
• job restrictions;
• actual role; and
• employment termination.

 

This reconciliation can identify circumstances where each individual record appears plausible but the combined evidence is inconsistent.

 

13. Check Appendix D Right to Work Evidence

 

Sponsor record-keeping requirements should be considered alongside the wider right to work regime.

The audit should establish whether the sponsor retains the evidence required by Appendix D in relation to the sponsored worker’s right to work.

This is important because the statutory right to work regime and sponsor record-keeping obligations serve related but distinct purposes.

An employer should therefore avoid assuming that because it has established a statutory excuse against an illegal working civil penalty, every sponsor record-keeping requirement has necessarily also been satisfied.

The audit should test both requirements where applicable.

 

14. Check Right to Work Evidence Retention

 

The organisation should be able to retrieve evidence showing how and when the relevant right to work check was completed.

Depending on the method used, evidence may include:

 

• the output from the Home Office online checking service;
• records produced through an applicable digital verification process;
• copies of acceptable documents from a permitted manual check;
• Employer Checking Service correspondence;
• Positive Verification Notices; and
• records showing subsequent follow-up checks.

 

The audit should test whether records remain legible, accessible and linked to the correct worker.

Applicable right to work and sponsor record-retention requirements should both be considered when determining how long evidence is retained.

 

15. Check the Relationship Between Date of Entry and Right to Work

 

A right to work check and a sponsor’s date-of-entry evidence are related but should not automatically be treated as the same requirement.

Where Appendix D requires the sponsor to establish that a worker entered the UK during the relevant entry-clearance validity period, the worker file should contain appropriate evidence of that entry.

The audit should therefore separately ask:

Did we establish the worker’s right to work?

and

Where required, did we establish and retain evidence of when the worker entered the UK?

This distinction is increasingly important where immigration status is evidenced digitally through an eVisa rather than a physical vignette or immigration document.

 

16. Test Information Flow Between Immigration, Recruitment & HR

 

A technically correct right to work procedure can still fail if information does not move between the relevant teams.

The audit should establish who is responsible for:

 

• requesting the initial check;
• conducting the check;
• reviewing restrictions;
• retaining evidence;
• recording immigration expiry dates;
• setting follow-up reminders;
• conducting follow-up checks;
• using the ECS where required;
• escalating adverse or unclear results; and
• informing the sponsorship team of relevant immigration changes.

 

A useful process test is:

Recruitment → Right to Work Check → HR Record → Expiry Monitoring → Follow-Up → Sponsorship Assessment

 

17. Test the Escalation Process for Failed or Unclear Checks

 

The audit should establish what happens when the organisation cannot immediately establish a person’s right to work.

Relevant scenarios can include:

 

• the online service does not show the expected status;
• the worker cannot provide the expected evidence;
• the information produced is inconsistent;
• immigration permission appears to have expired;
• the worker says an extension application is outstanding;
• employment restrictions appear inconsistent with the proposed role;
• identity information does not match; or
• the organisation is uncertain which checking method applies.

 

Staff should know when to stop the normal onboarding or follow-up process and escalate the case for specialist assessment.

Uncertainty should not be resolved by simply placing whatever evidence is available on the personnel file.

 

18. Investigate Missing or Defective Right to Work Evidence

 

Where the audit identifies a missing or defective check, the organisation should establish the facts before determining the appropriate response.

The review should identify:

 

• whether a check was actually completed;
• when it was completed;
• which method was used;
• whether evidence has simply been misplaced;
• whether the prescribed process was followed;
• whether the worker had permission to perform the work;
• whether the issue affects the statutory excuse;
• whether sponsor record-keeping requirements were met;
• whether the problem is continuing; and
• whether other workers may be affected by the same control weakness.

 

The organisation should not recreate or backdate a historical check to suggest that it was conducted correctly at the time.

Any legitimate subsequent or remedial action should be recorded accurately as having taken place when it actually occurred.

 

19. Expand Testing Where a Systemic Problem Is Identified

 

A defective right to work check may indicate a problem extending beyond the sponsored worker population.

For example, the audit may identify that:

 

• HR has been using the wrong online service;
• checks are routinely completed after employment begins;
• follow-up dates are not monitored;
• evidence is not retained correctly;
• staff do not understand when the ECS should be used;
• manual checks are being used where another process is required; or
• the organisation cannot demonstrate who completed its checks.

 

Where the problem results from a workforce-wide process, the sponsor licence audit should flag the need for broader right to work testing rather than restricting remediation to the sponsored workers initially sampled.

 

20. Test Right to Work Controls, Not Just Files

 

The final right to work assessment should examine the system responsible for producing compliant checks.

The auditor should ask:

Who identifies which checking method applies?

Who completes the check?

How is identity verified?

Who checks employment restrictions?

Where is the evidence retained?

How are time-limited permissions monitored?

Who conducts follow-up checks?

What happens when status cannot immediately be verified?

How are immigration changes communicated to the sponsorship team?

Who verifies that the process continues to work?

The objective is to move beyond:

“Is there a right to work document in the file?”

and instead establish:

“Can the organisation demonstrate a reliable process for establishing, evidencing and monitoring the right to work of its workforce?”

 

 

Back to top

 

Section J: Auditing Sponsor Reporting

 

Reporting is one of the most important areas of sponsor licence compliance because relevant information often originates elsewhere in the organisation before it reaches the people responsible for sponsorship.

A sponsor reporting audit should therefore test more than whether reports appear on the Sponsor Management System. It should determine whether the organisation has a reliable process for identifying potentially reportable events, escalating them for assessment, applying the correct sponsor requirement and taking any required action within the applicable timeframe.

The core reporting chain is:

Event → Identification → Escalation → Assessment → Action → Evidence

A weakness at any stage can result in a reporting failure.

 

1. Identify Events Before Auditing Reports

 

A reporting audit should begin with events that occurred within the business rather than with the reports already recorded on the SMS.

This is important because reviewing only completed SMS reports cannot identify events that were never recognised as potentially reportable.

The auditor should therefore examine relevant sources such as:

 

• HR records;
• payroll;
• personnel files;
• absence records;
• manager records;
• organisation charts;
• corporate records;
• work-location records;
• leaver records;
• recruitment records; and
• internal correspondence where relevant.

 

Material events identified from these sources can then be traced through the organisation’s sponsorship process.

 

2. Distinguish Identification, Assessment & Reporting

 

A mature reporting process should distinguish between three separate stages.

Identification: Has the organisation recognised that something has changed?

Assessment: Has somebody with appropriate knowledge considered the sponsorship implications?

Reporting or other action: Has the required action been taken within the applicable timeframe?

This distinction matters because not every employment or business event requires an SMS report.

The compliance objective is not to report every change indiscriminately. It is to ensure that potentially relevant changes are identified and correctly assessed.

 

3. Audit the 10-Working-Day Worker Reporting Framework

 

Many specified changes affecting sponsored workers must generally be reported within 10 working days, unless the applicable sponsor guidance provides otherwise.

The audit should identify worker events during the review period and establish:

 

• what happened;
• when it happened;
• when the organisation became aware of it;
• whether the event was reportable;
• what reporting deadline applied;
• whether a report was submitted;
• when it was submitted;
• whether the information reported was accurate; and
• whether evidence of the report has been retained.

 

The specific rule applicable to the event should always be checked rather than assuming that every worker change is governed in exactly the same way.

 

4. Audit the 20-Working-Day Organisation Reporting Framework

 

Specified changes relating to the sponsoring organisation are generally subject to a 20-working-day reporting or action framework.

The audit should examine relevant organisational events, including where applicable:

 

• changes to organisation details;
• changes of address;
• changes affecting branches;
• changes to key personnel;
• changes in direct ownership;
• mergers;
• acquisitions;
• takeovers;
• demergers;
• TUPE transfers;
• restructuring; and
• relevant insolvency events.

 

The auditor should establish whether the event required an SMS report, another form of sponsor action or potentially a new sponsor licence application.

This distinction is important because sponsor licences are not transferable and some corporate changes have consequences extending beyond updating information on the SMS.

 

5. Audit Employment Start & Non-Start Events

 

The audit should test whether the organisation monitors whether sponsored workers actually commence employment as expected.

Review:

 

• the expected employment start date;
• the actual start date;
• payroll commencement;
• attendance records;
• any delayed commencement;
• cases where the worker did not start; and
• the sponsorship assessment and action taken.

 

The organisation should not rely solely on the recruitment team assuming that HR or the sponsorship function knows whether a sponsored worker has started.

The process should contain a clear confirmation point.

 

6. Audit Sponsored Worker Leavers

 

Leaver processes should be tested to establish whether the sponsorship team receives information when sponsored employment ends.

The audit should compare:

 

• resignation dates;
• dismissal dates;
• contract end dates;
• HR termination records;
• final payroll dates;
• actual last working dates; and
• SMS reporting records.

 

The organisation should be able to demonstrate how a sponsored worker leaving employment triggers sponsorship assessment and any required reporting.

Where different dates appear across systems, the underlying facts should be established.

 

7. Audit Changes in Job Role & Duties

 

Changes in role and duties require careful assessment because not every change has the same immigration consequence.

The audit should identify:

 

• promotions;
• internal transfers;
• changes in job title;
• changes in substantive duties;
• changes in responsibility;
• changes in reporting line;
• changes in occupation classification where relevant; and
• changes associated with organisational restructuring.

 

The auditor should determine whether the change could be dealt with through sponsor reporting under the applicable rules or whether it was sufficiently significant to engage the change of employment requirements.

A significant change should not automatically be treated as something that can be regularised simply by submitting an SMS report after the event.

The correct immigration requirement should be established from the facts.

 

8. Audit Salary Changes

 

Salary changes should be identified through both HR and payroll rather than relying solely on the worker’s personnel file.

The audit should examine:

 

• salary reductions;
• changes resulting from altered hours;
• periods of unpaid leave;
• periods of reduced pay;
• promotion-related changes;
• allowances where relevant;
• unexpected payroll variations; and
• other changes capable of affecting sponsorship requirements.

 

A reduction from the salary stated on the CoS can require reporting and may also require assessment of whether the worker continues to satisfy the applicable sponsorship requirements.

The audit should therefore trace:

Salary Event → HR/Payroll Identification → Sponsorship Assessment → Required Action → Evidence

 

9. Do Not Treat Every Salary Increase as Reportable

 

An ordinary increase in a sponsored worker’s salary does not generally require an SMS report merely because pay has increased, subject to specific exceptions identified in the sponsor guidance.

This does not mean salary increases should be excluded from the audit.

An increase can accompany another potentially relevant event, such as:

 

• a promotion;
• a change in job title;
• materially different duties;
• a change in working hours;
• an internal transfer; or
• a wider restructuring of the role.

 

The auditor should therefore establish why salary changed and assess the employment event as a whole.

 

10. Audit Changes in Working Hours

 

Changes in working hours can affect salary and the basis on which the worker is sponsored.

The audit should identify:

 

• permanent increases or reductions in hours;
• moves between full-time and part-time arrangements;
• temporary reductions;
• changes connected with absence;
• contractual changes;
• pay consequences; and
• whether sponsorship implications were assessed.

 

The audit should reconcile hours with salary and payroll rather than reviewing each element separately.

 

11. Audit Changes in Normal Work Location

 

The organisation should be capable of identifying substantive changes to a sponsored worker’s normal work location.

The audit should examine:

 

• moves between branches;
• moves to new offices;
• client-site arrangements where relevant;
• changes to the worker’s principal place of work;
• permanent remote-working arrangements;
• hybrid-working arrangements; and
• whether the relevant sponsorship assessment was made.

 

A change in normal work location can require reporting, including circumstances where the worker moves to a new branch or client site not previously recorded or moves permanently to full-time remote working with little or no workplace attendance.

 

12. Distinguish Hybrid Working from a Reportable Location Change

 

Moving to a hybrid working pattern does not, by itself, necessarily require an SMS report.

The sponsor should nevertheless retain appropriate records of the worker’s working arrangements and continue to assess changes affecting the normal work location.

The audit should distinguish between:

 

• occasional home working;
• hybrid working involving home and an established workplace;
• a substantive change in normal workplace;
• assignment to a new branch or client site; and
• permanent full-time remote working with little or no workplace attendance.

 

Day-to-day variations in location should not automatically be treated as reportable events.

The assessment should focus on the substantive working arrangement.

 

13. Audit Unauthorised Absence Reporting

 

The sponsor should have a process capable of identifying unauthorised absence that engages the reporting requirements.

Current sponsor guidance includes a reporting requirement where a sponsored worker is absent from work without permission for more than 10 consecutive working days.

The audit should establish:

 

• how unauthorised absence is recorded;
• who monitors the duration;
• who is alerted when the relevant threshold is approached or exceeded;
• when the sponsorship team becomes aware;
• whether the applicable reporting requirement was assessed; and
• whether required action was taken within the applicable timeframe.

 

The audit should test actual absence cases rather than relying solely on the existence of an absence policy.

 

14. Audit Unpaid & Reduced-Pay Absence

 

Periods of unpaid or reduced-pay absence should also be included within the reporting audit.

Current sponsor guidance contains provisions concerning absence without pay or on reduced pay for more than four weeks in total in a calendar year, subject to applicable exceptions and route-specific requirements.

The audit should establish:

 

• how unpaid or reduced-pay absence is recorded;
• whether separate periods are aggregated where required;
• whether payroll information reaches HR and the sponsorship function;
• whether an applicable permitted exception applies;
• whether the worker continues to meet relevant sponsorship requirements; and
• whether required reporting or other action was taken.

 

This is an area where payroll, HR and sponsorship records need to operate together.

 

15. Audit Immigration Status Changes

 

The organisation should have a process for escalating relevant changes to a sponsored worker’s immigration circumstances.

This can include circumstances where:

 

• the worker obtains new immigration permission;
• the worker changes immigration route;
• the worker obtains permission no longer dependent on sponsorship;
• an extension application is made;
• an application is refused;
• immigration permission expires; or
• another event potentially affects the sponsorship relationship.

 

The audit should establish how the sponsorship team becomes aware of such changes and what assessment is undertaken.

 

16. Test HR-to-SMS Escalation

 

A common reporting weakness arises where the relevant event is recorded correctly by one part of the organisation but never reaches the person responsible for sponsorship.

For example:

Manager knows duties changed → HR updates job description → Payroll updates salary → SMS user is never informed

Each individual department may believe it has completed its task, while the sponsor reporting requirement remains unassessed.

The audit should therefore test how information moves from:

 

• line managers;
• HR;
• payroll;
• recruitment;
• finance;
• operations;
• legal or compliance teams; and
• senior management.

 

The sponsorship function should not operate in an information silo.

 

17. Test Corporate-to-SMS Escalation

 

The same principle applies to organisational events.

Senior management, finance or corporate teams may know about a transaction long before the sponsorship team becomes aware of it.

The audit should therefore test the escalation of events such as:

 

• acquisitions;
• disposals;
• mergers;
• takeovers;
• ownership changes;
• TUPE transfers;
• restructuring;
• branch changes; and
• insolvency events.

 

A useful process is:

Corporate Event → Early Immigration Escalation → Sponsor Impact Assessment → Required Action → Deadline → Evidence

Waiting until a corporate transaction has completed before considering sponsor implications can create avoidable compliance risk.

 

18. Test Reporting Decisions Where No Report Was Made

 

A reporting audit should deliberately include events that did not result in an SMS report.

For each selected event, establish:

 

• whether the event was identified;
• whether sponsorship implications were considered;
• which rule was applied;
• why the event was considered non-reportable;
• whether another form of action was required; and
• whether the reasoning can be evidenced.

 

This helps distinguish a properly considered decision not to report from an event that was simply overlooked.

 

19. Retain Evidence of Material Reporting Decisions

 

For significant or potentially ambiguous events, retaining an appropriate record of the reporting assessment can strengthen the audit trail.

A record can identify:

 

• the event;
• the relevant facts;
• the sponsor requirement considered;
• the decision reached;
• the action taken;
• the decision-maker; and
• the date of the assessment.

 

Routine employment administration does not need to be converted into unnecessary legal paperwork.

The objective is to ensure that material sponsorship decisions can subsequently be understood and evidenced.

 

20. Audit Late Reports

 

Where a report appears to have been made late, the auditor should establish the full chronology.

Record:

 

• the date of the underlying event;
• when the relevant department became aware;
• when the sponsorship function became aware;
• the applicable reporting deadline;
• the date the report was made;
• why the delay occurred;
• whether the underlying issue is continuing; and
• whether similar cases may exist.

 

The root cause may lie in identification, escalation, assessment, workload, knowledge or governance.

Remediation should address the cause rather than merely recording that the individual report was late.

 

21. Audit Potentially Missed Reports

 

Where an event appears never to have been reported, the organisation should avoid making assumptions about the appropriate retrospective response.

The audit should first establish:

What happened? → What rule applied? → Was reporting required? → Is the issue continuing? → What action is now appropriate?

Depending on the circumstances, specialist advice may be appropriate before action is taken.

The organisation should not conceal the historical position, rewrite records or create documentation suggesting that an action occurred when it did not.

 

22. Determine Whether Reporting Failures Are Systemic

 

One missed report may be an isolated mistake. Multiple missed reports involving the same process can indicate a wider control failure.

For example:

 

• multiple unreported promotions may indicate managers do not escalate role changes;
• repeated salary issues may indicate weak HR-to-payroll-to-sponsorship integration;
• multiple location discrepancies may indicate remote-working changes are not assessed;
• late leaver reports may indicate HR termination workflows do not notify SMS users; and
• corporate reporting failures may indicate the sponsorship function is excluded from transaction planning.

 

Where a pattern is identified, the audit should expand testing to determine the affected population and period.

The principle is:

Finding → Pattern → Root Cause → Population → Remediation

 

23. Audit Reporting Controls Prospectively

 

An effective audit should not only examine historical events. It should test what would happen when the next relevant event occurs.

The auditor can use practical scenarios such as:

 

• A sponsored worker is promoted tomorrow. What happens?
• Payroll reduces a sponsored worker’s salary. Who is notified?
• A worker permanently moves to another branch. Who assesses the change?
• A sponsored worker is absent without permission. Who monitors the duration?
• A worker takes extended unpaid leave. Who identifies the sponsorship issue?
• The company acquires another business. When is immigration compliance involved?
• The Level 1 User leaves unexpectedly. Who manages outstanding reports?

 

The answers should identify actual people, systems and escalation routes rather than rely on statements such as “HR would deal with it”.

 

24. The Sponsor Reporting Audit Test

 

At the end of the reporting audit, the organisation should be able to answer:

Do we know which business events can have sponsorship implications?

Do the people who first encounter those events know they must escalate them?

Does the information reach the sponsorship function promptly?

Is the correct sponsor requirement applied?

Can we distinguish reportable changes from changes requiring different immigration action?

Are worker reports made within the applicable 10-working-day framework where required?

Are organisational reports or actions completed within the applicable 20-working-day framework where required?

Can we evidence reporting decisions and completion?

Would our system identify the next reportable event without relying on luck or individual memory?

The strongest reporting control is therefore not simply an SMS user who knows how to submit a report.

It is an organisation-wide process capable of converting relevant business events into timely sponsorship decisions:

Event → Identification → Escalation → Assessment → Action → Evidence → Verification

 

 

Back to top

 

Section K: Auditing Sponsored Roles, Salary & Payroll

 

A sponsor licence compliance audit should test whether each sponsored worker’s actual employment remains consistent with the basis on which they are sponsored.

This requires more than checking a job title or confirming the salary recorded on the Certificate of Sponsorship. The audit should reconcile the complete employment position:

CoS → Contract → Actual Role → Duties → Occupation Classification → Salary → Hours → Payroll

The objective is to establish whether the organisation’s sponsorship records, employment documentation, payroll data and operational reality tell a consistent story.

 

1. Start with the Sponsored Role

 

For each worker selected for review, establish the role described when sponsorship was granted.

Relevant information can include:

 

• job title;
• job description;
• occupation classification where relevant;
• salary;
• working hours;
• work location;
• employment dates;
• reporting line;
• level of responsibility; and
• other material information contained on the CoS.

 

This provides the starting point against which the worker’s current employment can be tested.

The audit should then establish what has happened since the CoS was assigned.

 

2. Compare the CoS with the Employment Contract

 

The employment contract should be compared with the Certificate of Sponsorship.

Check whether the documents are consistent in relation to:

 

• job title;
• duties;
• salary;
• hours;
• work location;
• start date;
• employment duration where relevant; and
• other terms capable of affecting sponsorship.

 

Any discrepancy should be investigated rather than assumed to be an administrative difference.

The auditor should establish which record reflects the actual employment arrangement and whether the difference has sponsorship implications.

 

3. Compare the Contract with the Actual Role

 

A contract can remain unchanged even where the worker’s role has evolved substantially.

The audit should therefore establish what the worker actually does.

Evidence can include:

 

• current job descriptions;
• organisation charts;
• performance objectives;
• manager evidence;
• departmental information;
• project responsibilities;
• internal promotion records;
• work allocation records; and
• the worker’s own account of their role.

 

The substantive duties should then be compared with the sponsored position.

The question is not merely:

“Does the worker still have the same job title?”

It is:

“Is the worker still performing the role for which the organisation is sponsoring them?”

 

4. Audit Role Drift

 

Role drift occurs where a worker’s responsibilities gradually change without the organisation recognising that the sponsored position has materially altered.

This can happen through:

 

• promotion;
• restructuring;
• staff shortages;
• departmental transfers;
• business growth;
• changes in client requirements;
• temporary responsibilities becoming permanent;
• management changes; or
• informal redistribution of duties.

 

Because these changes may occur incrementally, they can be missed by HR and the sponsorship function.

The audit should therefore compare current duties with both the original sponsored role and any subsequent documented changes.

 

5. Test the Occupation Classification

 

Where an occupation code or other occupational classification is relevant to sponsorship, the audit should test whether the classification remains appropriate to the substantive role.

The review should consider:

 

• the worker’s actual duties;
• the nature of the role;
• the level of responsibility;
• the skills required;
• the organisational context;
• the applicable occupation description; and
• whether subsequent role changes affect the original classification.

 

The job title alone should not determine the classification.

Two employers can use the same job title for materially different roles, while different job titles can sometimes describe substantively similar work.

The audit should therefore focus on what the worker actually does.

 

6. Test Whether the Position Remains an Eligible Role

 

The audit should consider whether the position continues to satisfy the applicable requirements for an eligible role.

This should be assessed against the worker’s actual employment rather than relying solely on the position described when the CoS was originally assigned.

The review can consider:

 

• whether the role actually exists;
• whether the worker performs the stated duties;
• whether the relevant skill or occupational requirements are met;
• whether the applicable occupation classification is appropriate;
• whether salary requirements are satisfied;
• whether working hours are consistent with the sponsorship basis;
• whether the business can explain the need for the role; and
• whether the evidence supports the organisation’s account of the position.

 

The current eligible-role framework should be applied rather than relying solely on historic terminology or the fact that the role was previously accepted for sponsorship.

 

7. Test Whether the Role Is Genuine

 

The audit should also identify circumstances that could raise questions about whether the sponsored role genuinely exists as described.

Relevant indicators can include:

 

• the worker performing substantially different duties;
• little evidence that the stated role exists operationally;
• responsibilities inconsistent with the sponsored position;
• the role appearing inconsistent with the organisation’s business activities;
• salary or hours inconsistent with the stated position;
• an unexplained mismatch between the job description and operational reality;
• the apparent role being a sham; or
• evidence suggesting the position was created principally to facilitate immigration permission.

 

The audit should not infer a problem merely because a role is unusual or specialist.

The assessment should be based on objective evidence of the role, business and worker’s actual activities.

 

8. Audit Promotions

 

Promotions should be included within the audit because they can affect several aspects of sponsorship simultaneously.

A promotion may involve changes to:

 

• job title;
• duties;
• level of responsibility;
• reporting line;
• occupation classification;
• salary;
• working hours; and
• work location.

 

The audit should identify promotions affecting sponsored workers and establish whether the sponsorship implications were assessed before or when the change took effect.

The fact that a promotion increased the worker’s salary does not, by itself, determine whether sponsorship action was required.

The substantive change to the role should be considered.

 

9. Audit Internal Transfers

 

Internal transfers can create similar issues.

The audit should identify workers who have moved:

 

• between departments;
• between teams;
• between branches;
• between business units;
• between client assignments where relevant; or
• into materially different functions.

 

The auditor should determine whether the transfer changed the worker’s duties, occupation classification, salary, hours, work location or other relevant sponsorship circumstances.

An internal transfer should not be assumed to be immigration-neutral simply because the legal employer remains unchanged.

 

10. Distinguish Reportable Role Changes from Change of Employment

 

Where a sponsored worker’s role has changed, the audit should determine the correct immigration consequence.

Depending on the circumstances, a change may:

 

• require no sponsor report;
• require an SMS report;
• require wider sponsorship assessment; or
• be sufficiently significant to engage the change of employment requirements.

 

The audit should therefore establish:

 

• what changed;
• when it changed;
• whether the substantive duties changed;
• whether the relevant occupation classification changed;
• whether salary or hours changed;
• whether the applicable sponsorship requirements continued to be met;
• what immigration assessment was undertaken; and
• what action was taken.

 

A material role change should not automatically be treated as something that can be corrected retrospectively through an SMS report.

 

11. Reconcile Salary Across Records

 

Salary should be tested across multiple sources.

For each sampled worker, compare:

CoS Salary → Contractual Salary → Current Salary → Payroll → Payslips

The audit should identify:

 

• the salary stated on the CoS;
• the salary stated in the employment contract;
• subsequent salary changes;
• current basic salary;
• actual payments;
• working hours;
• allowances where relevant;
• deductions where relevant;
• periods of unpaid leave;
• periods of reduced pay; and
• other remuneration issues capable of affecting sponsorship.

 

Any difference should be explained through evidence.

 

12. Audit Salary Reductions

 

Salary reductions require particular attention because they can affect both reporting obligations and the worker’s continuing eligibility for sponsorship.

The audit should identify:

 

• when the salary was reduced;
• why the reduction occurred;
• whether working hours also changed;
• whether the reduction was temporary or permanent;
• whether it resulted from absence;
• whether the sponsorship team was informed;
• whether the applicable salary requirements continued to be met;
• whether reporting was required; and
• whether any other immigration action was necessary.

 

The audit should use actual payroll information to verify the position rather than relying solely on HR records.

 

13. Audit Salary Increases in Context

 

An ordinary salary increase does not generally require an SMS report simply because the worker is being paid more, subject to specific exceptions in the sponsor guidance.

Salary increases should nevertheless remain within the audit because they can provide evidence of another change.

For example, an increase may result from:

 

• promotion;
• materially increased responsibility;
• a new role;
• an internal transfer;
• different working hours; or
• restructuring.

 

The audit should therefore ask:

Why did the salary increase?

If the answer reveals another employment change, that event should be assessed separately for sponsorship purposes.

 

14. Audit Working Hours

 

Salary cannot always be assessed correctly without understanding the worker’s actual working hours.

The audit should compare:

 

• hours stated on the CoS;
• contractual hours;
• current normal hours;
• payroll information;
• timesheets where relevant;
• changes in working patterns;
• part-time arrangements;
• temporary reductions; and
• changes associated with absence.

 

The auditor should investigate any difference capable of affecting the salary calculation or applicable sponsorship requirements.

 

15. Audit Payroll Payments

 

Payroll provides important evidence of what has actually happened rather than what the employment documents say should happen.

The audit should select an appropriate period and compare expected salary with actual payments.

Potential anomalies include:

 

• unexpected reductions;
• missing payments;
• changes in basic pay;
• significant fluctuations;
• periods of nil pay;
• reduced pay;
• unexplained deductions;
• changes associated with working hours;
• payments inconsistent with contractual salary; and
• payments inconsistent with the sponsorship record.

 

An anomaly should be investigated before conclusions are drawn.

There may be a legitimate explanation, but the sponsor should be capable of evidencing it.

 

16. Investigate Periods of Unpaid or Reduced Pay

 

Periods of unpaid or reduced pay should be specifically identified during payroll testing.

Current sponsor guidance contains provisions concerning absence without pay or on reduced pay for more than four weeks in total in a calendar year, subject to applicable exceptions and route-specific provisions.

The audit should establish:

 

• why pay was reduced or stopped;
• the dates involved;
• the total period affected;
• whether the absence fell within an applicable exception;
• whether HR knew about the change;
• whether the sponsorship team was informed;
• whether the worker continued to meet relevant sponsorship requirements; and
• whether any required reporting or other action was taken.

 

Separate periods should be considered collectively where the applicable sponsor provision requires the total absence within the calendar year to be assessed.

 

17. Review Allowances, Deductions & Other Payments

 

Where allowances, deductions or other payments are relevant to the sponsorship assessment, the audit should establish exactly how the worker’s remuneration is structured.

The review can include:

 

• basic gross pay;
• guaranteed allowances where relevant;
• variable payments;
• overtime where relevant;
• salary sacrifice arrangements;
• deductions;
• benefits;
• temporary payments; and
• other remuneration components.

 

The organisation should not assume that every payment appearing on a payslip can be counted in the same way for immigration purposes.

The applicable route and salary rules should be applied to the worker’s actual remuneration structure.

 

18. Test Payroll Against Absence Records

 

Payroll anomalies should be reconciled with absence records.

For example, a reduction in pay may correspond with:

 

• sickness absence;
• parental leave;
• unpaid leave;
• unauthorised absence;
• a temporary reduction in hours; or
• another employment event.

 

The audit should establish whether the event was correctly identified, recorded and assessed for sponsorship purposes.

This provides a useful cross-check because payroll can reveal events that were not escalated through HR.

 

19. Test Payroll Against Attendance & Working Patterns

 

The audit should also consider whether payroll, attendance and working patterns are mutually consistent.

For example, unexplained differences may arise where:

 

• the worker is recorded as full-time but payroll indicates substantially reduced hours;
• the worker is being paid but attendance records show an extended unexplained absence;
• the worker has moved location but HR and sponsorship records remain unchanged; or
• the worker’s duties have changed following an operational transfer that was never escalated.

 

No single discrepancy necessarily establishes non-compliance.

The purpose is to identify matters requiring explanation and evidence.

 

20. Audit Work Locations Alongside Roles

 

Role testing should include where the work is actually being performed.

A worker may retain the same job title and salary while their operational circumstances change significantly.

The audit should compare:

 

• the work location stated for sponsorship purposes;
• the contractual location;
• the current normal work location;
• branch or client-site arrangements;
• remote-working arrangements;
• hybrid-working arrangements; and
• any changes during the review period.

 

Relevant changes in normal work location should be assessed against the current sponsor reporting requirements.

 

21. Compare Manager Evidence with Worker Evidence

 

Where appropriate, the auditor can test the sponsored role by speaking separately with the worker and their manager.

Questions can cover:

 

• the worker’s main duties;
• day-to-day responsibilities;
• reporting lines;
• working hours;
• normal work location;
• recent changes;
• management responsibilities; and
• how the role fits within the department.

 

The objective is not to coach participants into providing matching answers.

It is to establish whether independent accounts correspond with the documentary evidence and operational reality.

A useful test is:

CoS Says → Contract Says → Manager Says → Worker Says → Payroll Shows → Reality Demonstrates

 

22. Test HR-to-Payroll-to-Sponsorship Information Flow

 

The audit should establish how employment changes move between HR, payroll and the sponsorship function.

For example:

Manager approves salary change → HR updates record → Payroll changes pay → Sponsorship team assesses immigration implications → Required action taken

The audit should identify whether this chain breaks down at any stage.

Potential weaknesses include:

 

• managers changing duties without informing HR;
• HR updating salary without notifying sponsorship personnel;
• payroll implementing changes without immigration assessment;
• temporary pay changes becoming permanent;
• promotions being processed as routine HR changes; and
• working-hour changes not being escalated.

 

The strongest control identifies sponsorship implications before a material employment change is implemented wherever practicable.

 

23. Expand Testing Where Anomalies Are Found

 

Where the audit identifies an unexplained role, salary or payroll discrepancy, the organisation should consider whether other sponsored workers may be affected by the same process.

For example:

 

• one unassessed promotion may indicate a wider promotion-control weakness;
• one payroll discrepancy may indicate an incorrect payroll configuration;
• one occupation classification issue may justify reviewing similar roles;
• one unexplained reduction in hours may indicate poor HR-to-sponsorship escalation;
• one role-drift case may indicate managers do not understand sponsor requirements; and
• one unreported salary reduction may justify reviewing other sponsored workers affected by the same pay exercise.

 

The audit should follow:

Anomaly → Establish Facts → Identify Root Cause → Define Potential Population → Expand Testing → Determine Exposure

 

24. Document the Employment Timeline

 

Where a worker has experienced multiple changes, it can be useful to create an employment timeline.

This can record:

 

• initial sponsorship;
• employment commencement;
• original role;
• salary changes;
• changes in hours;
• promotions;
• changes in duties;
• internal transfers;
• work-location changes;
• significant absence;
• SMS reports;
• immigration applications; and
• current employment circumstances.

 

The timeline can expose periods where employment changed before the organisation considered the sponsorship consequences.

 

25. The Role, Salary & Payroll Audit Test

 

At the end of the review, the organisation should be able to answer:

What role was the worker sponsored to perform?

What role are they performing now?

Do their actual duties support the sponsored position?

Does the occupation classification remain appropriate?

Does the role continue to meet the applicable eligible-role requirements?

What salary should the worker receive?

What salary have they actually received?

What hours do they actually work?

Have there been periods of unpaid or reduced pay?

Have promotions, transfers or role changes been assessed for sponsorship purposes?

Do HR, payroll, management and sponsorship records tell the same story?

The strongest evidence chain is:

CoS → Contract → Actual Role → Duties → Occupation Classification → Salary → Hours → Payroll

Where that chain is consistent, the sponsor is better placed to demonstrate that the worker’s actual employment corresponds with the basis on which sponsorship is being provided.

 

 

Back to top

 

Section L: Testing HR Systems & Processes

 

Sponsor compliance depends on the organisation’s wider HR systems identifying relevant events and escalating them for immigration assessment. A technically accurate sponsor policy will not protect the organisation if operational changes affecting sponsored workers occur without reaching the people responsible for the sponsor licence.

A sponsor licence compliance audit should therefore test the complete process through which employment and organisational events are identified, assessed, actioned and evidenced.

A useful control chain is:

Business Event → Identification → Escalation → Immigration Assessment → Action → Evidence → Verification

The audit should determine whether this chain works consistently across recruitment, onboarding, employment, absence, payroll, changes in role, changes in location and termination.

 

1. Map the Sponsor Compliance Process

 

The first stage is to map how sponsor compliance operates across the organisation.

This should identify:

 

• which departments generate information relevant to sponsorship;
• which individuals are expected to identify relevant events;
• how those events are escalated;
• who determines the immigration implications;
• who takes the required action;
• where evidence is retained;
• who checks that the action has been completed; and
• how unresolved matters are escalated.

 

The process map should reflect what happens in practice rather than merely reproducing the organisation’s written policy.

 

2. Test Recruitment Processes

 

The audit should examine how sponsorship considerations are incorporated into recruitment.

The process should establish:

 

• how vacancies are created and approved;
• how the duties and requirements of the role are defined;
• how the proposed occupation classification is assessed where relevant;
• how salary and working hours are established;
• how work location is identified;
• how the organisation determines whether the role is eligible for sponsorship;
• how immigration status and right to work are considered;
• how the need for sponsorship is identified;
• how the recruitment process is documented; and
• how the organisation retains an explanation and, where appropriate, evidence of how the worker was recruited.

 

The audit should test actual recruitment cases rather than relying solely on recruitment policy documents.

 

3. Test Sponsored Worker Onboarding

 

The onboarding process should ensure that sponsorship and right to work requirements are addressed before and when the worker starts employment.

The audit should test whether onboarding captures:

 

• identity information;
• immigration status;
• the prescribed right to work check;
• immigration permission expiry dates;
• date-of-entry evidence where required;
• current contact information;
• employment start date;
• job title and duties;
• salary;
• working hours;
• normal work location;
• relevant Appendix D records; and
• the information needed for ongoing compliance monitoring.

 

The audit should also test whether the worker’s actual commencement is confirmed rather than assuming that a planned start date became the actual start date.

 

4. Test Right to Work Integration

 

Right to work should form part of the organisation’s broader HR compliance process rather than operate as an isolated document check.

The audit should establish:

 

• who determines which checking method applies;
• who conducts the check;
• how the worker’s identity is verified;
• how employment restrictions are assessed;
• where evidence is retained;
• how time-limited permission is recorded;
• how follow-up checks are triggered;
• how Employer Checking Service cases are managed where required; and
• how relevant immigration changes are communicated to the sponsorship function.

 

A failure at any stage can affect both wider right to work compliance and sponsor compliance.

 

5. Test Immigration Expiry Monitoring

 

The organisation should have a reliable process for monitoring time-limited immigration permission.

The audit should establish:

 

• where expiry dates are recorded;
• how dates are verified;
• when reminder alerts are generated;
• who receives the alerts;
• what action is expected;
• how outstanding immigration applications are handled;
• when the Employer Checking Service is used where applicable;
• how follow-up right to work checks are completed; and
• how unresolved cases are escalated.

 

The auditor should test the system using actual workers rather than simply confirming that an expiry-date field exists within the HR platform.

A control that generates an alert nobody acts upon is not an effective control.

 

6. Test Worker Contact-Detail Processes

 

HR systems should support the sponsor’s obligation to maintain relevant sponsored worker contact information, including the required history.

The audit should establish how the organisation records changes to:

 

• UK residential address;
• personal email address; and
• telephone number.

 

The process should be tested to determine whether:

 

• workers know how to update their details;
• changes reach HR;
• records are updated promptly;
• previous information is preserved; and
• the required contact-detail history can be retrieved.

 

Particular attention should be paid to HR systems that overwrite existing information when a worker submits a change.

The sponsor should be able to produce the relevant history rather than only the worker’s latest details.

 

7. Test Absence Monitoring

 

Absence monitoring should be tested both as a record-keeping control and as a mechanism for identifying events requiring sponsorship assessment.

The audit should determine:

 

• how absence is recorded;
• which absences are recorded;
• who monitors prolonged absence;
• how unauthorised absence is identified;
• how unpaid or reduced-pay absence is identified;
• whether separate periods are aggregated where required;
• how managers escalate relevant absence;
• when the sponsorship function becomes involved; and
• how required actions are evidenced.

 

The process should be capable of identifying unauthorised absence of more than 10 consecutive working days and absence without pay or on reduced pay for more than four weeks in total in a calendar year, subject to applicable exceptions and route-specific provisions.

 

8. Test Manager Escalation of Absence

 

Line managers are often the first people to know that a sponsored worker is absent.

The audit should therefore establish whether managers understand what they need to record and when information must be escalated.

A useful test is:

Worker Absent → Manager Records Absence → HR Receives Information → Threshold Monitored → Sponsorship Assessment → Required Action

If the organisation relies on managers recognising immigration reporting rules themselves, the control may be unnecessarily fragile.

Managers should ordinarily have clear triggers for escalation, with specialist sponsorship personnel determining the immigration consequence.

 

9. Test Role & Duty Change Processes

 

The organisation should have a mechanism for identifying changes to sponsored workers’ roles before those changes become embedded operationally.

The audit should examine how the organisation handles:

 

• promotions;
• new job titles;
• changes in substantive duties;
• additional management responsibilities;
• departmental transfers;
• restructuring;
• temporary duties becoming permanent; and
• other material changes to the sponsored position.

 

The control should trigger sponsorship assessment rather than assuming every role change can be addressed through an SMS report.

Depending on the circumstances, a change may require reporting, no report, or a change of employment application.

 

10. Test Salary Change Processes

 

Salary changes should trigger appropriate communication between managers, HR, payroll and the sponsorship function.

The audit should identify how the organisation handles:

 

• salary reductions;
• salary increases;
• promotion-related changes;
• changes in working hours;
• unpaid leave;
• reduced pay;
• allowances where relevant;
• salary sacrifice arrangements where relevant; and
• unexpected payroll adjustments.

 

A salary reduction can engage reporting and wider sponsorship requirements and should be assessed carefully.

An ordinary salary increase does not generally require reporting merely because salary has increased, subject to specific exceptions in the sponsor guidance. However, the underlying reason for the increase should be considered where it accompanies a promotion, change in duties, change in hours or another relevant event.

 

11. Test HR-to-Payroll Integration

 

The audit should determine whether approved employment changes are accurately reflected in payroll and whether unexpected payroll changes are communicated back to HR.

A useful reconciliation is:

HR Record → Contractual Position → Payroll Instruction → Actual Payment → Sponsorship Record

The auditor should look for:

 

• salary changes implemented without HR documentation;
• HR-approved changes not reflected in payroll;
• reduced payments caused by absence;
• changes in hours;
• unexpected deductions;
• periods of nil pay;
• temporary changes continuing beyond their intended period; and
• payroll events that were never assessed for sponsorship purposes.

 

12. Test Work-Location Change Processes

 

HR and management systems should be capable of identifying substantive changes to a sponsored worker’s normal work location.

The audit should test processes covering:

 

• moves between offices;
• moves between branches;
• assignment to new client sites where relevant;
• relocation;
• permanent remote working;
• hybrid working;
• departmental moves affecting location; and
• new organisational premises.

 

A change in normal work location can require sponsor reporting, including a move to a new branch or client site not previously recorded or permanent full-time remote working with little or no workplace attendance.

Moving to hybrid working does not, by itself, necessarily require an SMS report. The organisation should nevertheless retain appropriate records of working arrangements and assess substantive changes in the worker’s normal location.

 

13. Test Leaver Processes

 

The leaver process should ensure that sponsored worker departures reach the sponsorship function promptly.

The audit should test:

 

• resignations;
• dismissals;
• fixed-term contract expiry;
• redundancies;
• workers who cease attending;
• internal transfers where relevant;
• actual last working dates;
• final payroll dates; and
• required SMS action.

 

A useful process is:

Employment Ending → HR Notification → Sponsorship Identification → Required Report → Evidence → File Closure

The sponsorship team should not discover that a sponsored worker has left only when conducting a later file review.

 

14. Test Corporate Change Escalation

 

Corporate events can have significant sponsor licence consequences and should be escalated for immigration assessment at an early stage.

The audit should establish whether the organisation has a mechanism for identifying:

 

• mergers;
• acquisitions;
• takeovers;
• demergers;
• changes in direct ownership;
• TUPE transfers;
• restructuring;
• branch changes;
• changes to legal entity information; and
• relevant insolvency events.

 

Specified organisational changes are generally subject to a 20-working-day reporting or action framework, but the precise requirement depends on the event.

Some corporate changes can require action beyond an SMS report, including potentially a new sponsor licence application. Sponsor licences are not transferable.

The appropriate control is therefore:

Proposed Corporate Event → Early Immigration Assessment → Sponsor Consequences Identified → Required Action Planned → Completion → Verification

 

15. Test Key Personnel Change Processes

 

The audit should establish what happens when someone involved in sponsor management changes role, leaves the organisation or becomes unavailable.

Relevant events can include:

 

• the Authorising Officer leaving;
• the Key Contact changing;
• a Level 1 User leaving;
• a user changing role;
• extended absence of a principal SMS user;
• remaining Level 2 User transition requirements; and
• changes affecting a user’s eligibility or suitability.

 

The process should ensure that sponsor administration continues without inappropriate credential sharing or dependence on a departed employee.

 

16. Test SMS Access & MFA Administration

 

HR processes should also connect with SMS access management.

Where an SMS user joins, changes role or leaves, the organisation should consider whether access needs to be created, amended or removed.

The audit should test:

Employee Event → SMS Access Review → Correct Individual Account → Current Contact Details → MFA → Appropriate Permission → Verification

The organisation should not rely on shared credentials, passwords or one-time passcodes as a business-continuity solution.

The audit should also identify inactive SMS accounts, establish when users last accessed the system and confirm that the organisation maintains at least one eligible active Level 1 User. Current Home Office guidance treats an SMS User account as inactive after 12 months without access and recommends that a Level 1 User accesses the SMS at least once a month.

 

17. Test Policy Against Practice

 

Written policies should be compared with actual operational behaviour.

The auditor should select a process described in the policy and trace a real case through it.

For example, if the policy states that managers must notify HR immediately of a sponsored worker’s role change, the audit should identify an actual promotion and establish:

 

• when the manager decided on the promotion;
• when HR was informed;
• when the sponsorship function was informed;
• what immigration assessment was undertaken;
• when the change took effect;
• what action was required; and
• whether completion was evidenced.

 

The relevant comparison is:

Policy Says → Staff Say → Evidence Shows

 

18. Test Whether Staff Understand Escalation Triggers

 

Relevant personnel do not necessarily need to become immigration specialists, but they should understand which events need to be escalated.

Managers and HR staff should know to escalate potentially relevant events such as:

 

• promotion;
• significant duty changes;
• salary reduction;
• working-hours changes;
• prolonged or unauthorised absence;
• unpaid leave;
• change in normal work location;
• termination;
• immigration status changes; and
• corporate changes.

 

The sponsorship or immigration function can then determine what action, if any, is required.

This separation reduces the risk of non-specialists making incorrect immigration decisions while ensuring relevant information is not lost.

 

19. Test Exception Handling

 

Compliance systems should be capable of handling cases that do not follow the normal process.

The audit should examine what happens where:

 

• a worker cannot provide expected right to work evidence;
• an immigration application remains outstanding;
• payroll identifies unexpected nil or reduced pay;
• a manager implements a change without prior HR approval;
• a worker changes location unexpectedly;
• HR learns late about a promotion;
• a sponsored worker stops attending work;
• a key SMS user leaves unexpectedly;
• records are missing; or
• a reporting deadline may already have been missed.

 

The organisation should have an escalation route for exceptions rather than allowing staff to improvise responses without appropriate assessment.

 

20. Test Data Quality Across Systems

 

Sponsor compliance information may be distributed across several systems.

These can include:

 

• the SMS;
• HR systems;
• payroll;
• recruitment systems;
• right to work records;
• absence systems;
• time-recording systems;
• manager records;
• immigration case-management systems; and
• corporate records.

 

The audit should identify key data points that should correspond across these systems.

Examples include:

HR Salary ↔ Payroll Salary

HR Role ↔ CoS Role

HR Location ↔ Actual Location

HR Start Date ↔ Payroll Start Date

HR End Date ↔ SMS Reporting

Immigration Expiry ↔ Right to Work Monitoring

Absence Record ↔ Payroll ↔ Sponsorship Assessment

Unexplained differences should be investigated.

 

21. Test Whether Systems Preserve Required History

 

Some HR systems are designed primarily to display the current employment position rather than preserve the historical information required for sponsor compliance.

The audit should therefore determine whether the organisation can reconstruct relevant histories, including:

 

• worker contact details;
• job changes;
• salary changes;
• working-hours changes;
• work-location changes;
• absence;
• immigration permission;
• right to work checks; and
• sponsor reporting decisions.

 

A system that simply overwrites previous information may require additional controls to preserve the evidence needed for sponsor compliance.

 

22. Test Business Continuity

 

The organisation should be able to maintain sponsor compliance when key individuals are absent or leave.

The audit should ask:

 

• Who covers the Level 1 User?
• Who monitors reporting deadlines during absence?
• Who can access relevant compliance records?
• Who receives immigration-expiry alerts?
• Who can identify sponsored workers?
• Who understands outstanding remediation actions?
• Who handles an urgent corporate change?
• Who escalates a potentially missed report?

 

The system should not depend on one person’s inbox, memory or personal spreadsheet.

 

23. Test Management Oversight

 

Sponsor compliance should have an appropriate level of management oversight.

The audit should establish whether senior personnel receive information about:

 

• the number of sponsored workers;
• significant compliance findings;
• overdue actions;
• right to work issues;
• reporting failures;
• upcoming immigration expiries;
• key personnel changes;
• corporate events affecting sponsorship;
• repeat compliance weaknesses; and
• significant changes to sponsor requirements.

 

The appropriate level of reporting will depend on the size and complexity of the organisation, but material sponsor risks should not remain invisible to those responsible for governance.

 

24. Test Previous Remediation

 

Where a previous audit, compliance review or internal incident identified a weakness, the current audit should test whether remediation actually solved the problem.

For each previous finding, establish:

 

• what went wrong;
• what action was agreed;
• who owned the action;
• whether it was implemented;
• what evidence demonstrates implementation;
• whether the revised process has been used; and
• whether re-testing confirms that it works.

 

The correct sequence is:

Finding → Remediation → Implementation → Verification → Closure

A rewritten policy or completed training session should not automatically be treated as evidence that the underlying control weakness has been resolved.

 

25. Test the Next Event

 

One of the most effective ways to assess an HR control is to ask what would happen if a relevant event occurred tomorrow.

For example:

 

• A sponsored worker is promoted tomorrow. What happens?
• Their salary is reduced. Who is told?
• They permanently move to another branch. Who assesses the change?
• They stop attending work. Who monitors the absence?
• They take extended unpaid leave. Who identifies the issue?
• Their immigration permission is approaching expiry. Who acts?
• The company acquires another business. When is sponsor compliance considered?
• The principal Level 1 User resigns. Who takes over?

 

The answers should identify actual systems, people and escalation routes.

If the answer is dependent on somebody remembering what to do, the control may require strengthening.

 

26. Document the Control Framework

 

The audit should document significant HR controls in a way that allows their effectiveness to be tested.

A useful format is:

 

Control element	Audit question
Trigger	What business event activates the process?
Identification	Who first recognises the event?
Escalation	How does it reach the sponsorship function?
Assessment	Who determines the immigration consequence?
Action	Who completes the required action?
Evidence	Where is completion recorded?
Verification	Who checks that the control worked?

 

This approach allows the organisation to identify precisely where a process has failed rather than describing the problem generically as “human error”.

 

27. The HR Systems & Processes Audit Test

 

At the end of the HR systems review, the organisation should be able to answer:

Do we know which business events can affect sponsor compliance?

Do the people who first encounter those events know what to escalate?

Does information reach the sponsorship function quickly enough?

Are immigration consequences assessed before significant changes are implemented where practicable?

Do HR, payroll, right to work, absence and SMS records reconcile?

Can we preserve and retrieve the required historical evidence?

Can the system operate when key individuals are absent?

Are exceptions escalated rather than improvised?

Does management know about material compliance risks?

Do we verify that remediation actually works?

The objective is a compliance system in which relevant events move reliably through:

Business Event → Identification → Escalation → Immigration Assessment → Action → Evidence → Verification

That process is more reliable than depending on individual knowledge or periodic file reviews alone because it embeds sponsor compliance into the organisation’s day-to-day HR operations.

 

 

Back to top

 

Section M: Interviewing Key Personnel, Managers & Sponsored Workers

 

A sponsor licence compliance audit should test whether the people responsible for operating sponsor compliance understand their roles and whether their account of how the organisation works is consistent with the documentary evidence.

Interviews are particularly valuable because policies, HR records and the Sponsor Management System may show how a process is intended to operate, while the people involved can reveal how it actually operates in practice.

The objective is not to coach staff to provide identical answers. It is to test whether there is a credible and consistent relationship between:

Policy Says → Staff Say → Evidence Shows

Material differences between these three sources should be investigated.

 

1. Decide Who Should Be Interviewed

 

The people interviewed should reflect the scope and risks identified during the audit.

Depending on the organisation, this can include:

 

• the Authorising Officer;
• the Key Contact;
• Level 1 Users;
• remaining Level 2 Users during the applicable transitional period;
• HR personnel;
• recruitment personnel;
• payroll personnel;
• line managers;
• finance or corporate personnel where relevant;
• members of the compliance or legal team; and
• a sample of sponsored workers.

 

Not every audit requires interviews with every category of person.

The selection should be proportionate to the organisation, sponsored population, audit scope and findings emerging from the documentary review.

 

2. Interview the Authorising Officer

 

The Authorising Officer has overall responsibility for the sponsor licence and for the actions of the organisation’s SMS users.

The audit should therefore establish whether the Authorising Officer has sufficient oversight of the sponsor compliance framework.

Questions can cover:

 

• the size and nature of the sponsored workforce;
• how sponsor compliance responsibilities are allocated;
• who operates the SMS;
• how significant compliance issues are escalated;
• how reporting deadlines are monitored;
• how sponsored worker changes are identified;
• how organisational changes are identified;
• how compliance risks are reported to management;
• how previous audit findings are monitored;
• what happens when key personnel are absent;
• how changes to sponsor guidance are implemented; and
• how the Authorising Officer obtains assurance that the sponsor system is working.

 

The Authorising Officer does not necessarily need to perform every operational sponsorship task personally.

However, the audit should identify a weakness where the individual formally holds the role but has little meaningful knowledge of how the sponsor licence is managed.

 

3. Test Authorising Officer Oversight

 

The audit should distinguish between delegation and lack of oversight.

Operational tasks can be delegated to appropriately authorised personnel, but the organisation should still be able to demonstrate governance over the sponsor licence.

Evidence of oversight can include:

 

• regular compliance reporting;
• review of significant sponsorship issues;
• oversight of audit findings;
• monitoring of overdue remediation;
• approval or awareness of material process changes;
• escalation of significant breaches;
• oversight of key personnel arrangements; and
• periodic review of sponsor compliance performance.

 

The precise governance model will depend on the organisation’s size and structure.

The key question is whether responsibility for the licence exists in substance rather than only on the SMS.

 

4. Interview Level 1 Users

 

Level 1 Users should understand the sponsorship functions they are expected to perform.

The audit can test their understanding of:

 

• SMS access and security;
• multi-factor authentication;
• Certificate of Sponsorship administration;
• worker reporting;
• organisation reporting;
• key personnel changes;
• reporting deadlines;
• record keeping;
• internal escalation processes;
• outstanding sponsor actions;
• how potentially missed reports are handled; and
• where supporting evidence is retained.

 

The auditor should compare the Level 1 User’s explanation with actual SMS activity and the organisation’s documented procedures.

 

5. Test SMS Security Knowledge

 

SMS users should understand that access is personal and should not be shared.

The audit can ask:

 

• Who uses this SMS account?
• Does anybody else know the password?
• How are one-time authentication codes handled?
• What happens if the user is absent?
• How are contact details kept current?
• What happens when an SMS user leaves?
• Who reviews whether users still require access?

 

Passwords, user credentials and multi-factor authentication codes should not be shared as a means of providing cover.

The expected model is:

Correct Individual → Individual Account → Current Contact Details → MFA → Appropriate Access → Secure Use

 

6. Interview Remaining Level 2 Users Where Relevant

 

Where the sponsor still has existing Level 2 Users during the 2026 transitional arrangements, the audit should establish whether those individuals understand the changing user framework.

The review should determine:

 

• whether the user still requires access;
• what functions they currently perform;
• whether they are eligible to become a Level 1 User;
• whether an upgrade is planned;
• whether the account should instead be deactivated; and
• who is responsible for completing the transition by 8 March 2027.

 

No new Level 2 Users have been appointable since 9 September 2026, so remaining Level 2 access should be treated as a transitional position requiring active management.

 

7. Interview HR Personnel

 

HR personnel are often central to sponsor compliance because they receive information about sponsored workers before the sponsorship team does.

The audit should test whether HR understands which events require escalation for immigration assessment.

Scenario questions can cover:

 

• a sponsored worker is promoted;
• their duties change;
• their salary is reduced;
• their working hours change;
• they move to another branch;
• they begin permanent remote working;
• they take extended unpaid leave;
• they are absent without permission;
• their immigration permission is approaching expiry;
• they resign; or
• their employment is terminated.

 

HR personnel do not necessarily need to determine the immigration consequence themselves.

They should, however, know which events need to be escalated and to whom.

 

8. Interview Recruitment Personnel

 

Recruitment teams can affect sponsor compliance before employment begins.

The audit can test whether recruiters understand processes relating to:

 

• identifying candidates who require sponsorship;
• right to work checks;
• role eligibility;
• job descriptions;
• salary and working hours;
• work locations;
• recruitment evidence;
• offers of employment;
• proposed start dates;
• delayed starts; and
• workers who do not commence employment.

 

The auditor should establish whether recruitment information moves reliably into HR and the sponsorship process.

 

9. Interview Payroll Personnel

 

Payroll can identify changes that are not immediately visible from the SMS or personnel file.

The audit should establish whether payroll personnel know how to escalate relevant events involving sponsored workers.

Questions can cover:

 

• salary reductions;
• changes in working hours;
• periods of nil pay;
• reduced pay;
• unpaid leave;
• unexpected deductions;
• changes following promotion;
• final salary payments; and
• other unexplained payroll anomalies.

 

The audit should determine whether payroll knows which employees are sponsored or has an effective process for ensuring relevant payroll events reach the appropriate HR or sponsorship personnel.

 

10. Interview Line Managers

 

Line managers can be particularly important because they are often the first people to know when the reality of a sponsored worker’s employment changes.

Managers may know about:

 

• changes in duties;
• promotions;
• additional responsibilities;
• changes in reporting lines;
• work-location changes;
• remote-working arrangements;
• changes in working hours;
• absence;
• performance issues;
• workers ceasing to attend; and
• planned termination of employment.

 

The audit should establish whether managers understand which events must be communicated to HR or the sponsorship function.

The organisation should not depend on managers understanding the detailed immigration rules themselves.

The stronger control is for managers to recognise defined escalation triggers.

 

11. Use Scenario-Based Questions

 

Scenario questions can provide a more reliable assessment than asking staff whether they understand sponsor compliance.

For example:

“One of your sponsored workers is promoted next week. What do you do?”

“A sponsored employee stops attending work without permission. Who do you tell?”

“Payroll tells you a sponsored worker has moved onto reduced pay. What happens next?”

“A sponsored worker permanently moves to another office. Who assesses the change?”

“The principal Level 1 User leaves unexpectedly. How does sponsor administration continue?”

These questions test whether staff can translate policy into action.

The answers should identify actual escalation routes, responsible individuals and systems rather than vague responses such as “HR would sort it out”.

 

12. Interview Sponsored Workers Where Appropriate

 

Sponsored worker interviews can help test whether the employment described in the organisation’s records corresponds with the worker’s actual experience.

Depending on the audit scope, questions can cover factual matters such as:

 

• job title;
• main duties;
• day-to-day responsibilities;
• line manager;
• department;
• normal working hours;
• normal work location;
• remote or hybrid working arrangements;
• salary;
• recent changes to the role;
• absence procedures;
• how personal contact details are updated; and
• how changes affecting employment are communicated.

 

The purpose is evidence validation rather than interrogation.

The worker’s account should be considered alongside the CoS, contract, payroll, HR records, manager evidence and SMS information.

 

13. Compare Worker & Manager Accounts

 

Interviewing both the sponsored worker and their manager can provide a useful test of operational reality.

Compare their accounts of:

 

• the worker’s main duties;
• level of responsibility;
• reporting structure;
• working hours;
• normal work location;
• recent role changes; and
• how absence and employment changes are managed.

 

Minor differences in terminology should not automatically be treated as compliance failures.

The audit should focus on substantive inconsistencies.

For example, a material concern may arise where the CoS describes one role, the manager describes another and the worker confirms that their day-to-day duties are materially different from both.

 

14. Compare Interviews with Documentary Evidence

 

Interview evidence should be tested against records rather than considered in isolation.

A useful comparison is:

CoS → Contract → HR → Payroll → Manager → Worker → SMS

For example:

 

• if the manager says the worker was promoted, check HR and sponsorship records;
• if the worker says their hours changed, check payroll and contractual records;
• if HR says all location changes are escalated, test actual location-change cases;
• if payroll says sponsored worker reductions are notified automatically, identify an actual reduction and trace the notification; and
• if the Level 1 User says all worker changes are reported promptly, compare event dates with SMS reporting dates.

 

The audit should seek evidence that the process works, not simply confirmation from staff that a process exists.

 

15. Test Knowledge of Reporting Timescales

 

Personnel directly responsible for sponsor administration should understand the importance of applicable reporting deadlines.

Many specified sponsored worker changes are generally subject to a 10-working-day reporting framework, while specified organisational changes are generally subject to a 20-working-day reporting or action framework, although the precise requirement should be checked for the particular event.

The audit should establish whether operational staff understand that relevant events need to be escalated promptly enough for the sponsorship function to assess and act within the applicable deadline.

A process that gives the Level 1 User information only after the reporting deadline has expired is not effective even if the Level 1 User understands the rules.

 

16. Test Knowledge of Absence Escalation

 

Managers and HR personnel should understand the organisation’s process for escalating significant absence.

The audit can use scenarios involving:

 

• unauthorised absence approaching or exceeding 10 consecutive working days;
• repeated periods of unpaid leave;
• reduced-pay absence;
• long-term sickness;
• parental or other permitted leave;
• a worker who stops attending unexpectedly; and
• absence affecting payroll.

 

The objective is not necessarily for managers to memorise every sponsor-rule exception.

They should know when the circumstances require escalation for specialist assessment.

 

17. Test Knowledge of Role Changes

 

Managers and HR staff should understand that changes to a sponsored worker’s role can require immigration assessment.

The audit can ask what would happen if:

 

• the worker is promoted;
• their job title changes;
• their substantive duties change;
• they move into another department;
• they acquire management responsibilities;
• they temporarily cover another role and the arrangement becomes permanent; or
• they transfer into a materially different position.

 

Staff should not assume that every role change can be resolved through an SMS report.

Depending on the circumstances, a change may require reporting, no reporting action or a change of employment application.

 

18. Test Knowledge of Work-Location Changes

 

The audit should establish whether relevant personnel understand the distinction between ordinary flexible working and a substantive change in normal work location.

Scenario testing can include:

 

• occasional home working;
• hybrid working;
• moving permanently to another branch;
• assignment to a new client site;
• relocation to another office; and
• moving to permanent full-time remote working with little or no workplace attendance.

 

Staff do not necessarily need to decide whether the change is reportable themselves.

They should understand when a change needs to be escalated for sponsorship assessment.

 

19. Test Knowledge of Corporate Changes

 

Where appropriate, senior management, HR, finance, legal or corporate personnel should be interviewed about how business changes are escalated to the sponsorship function.

Relevant scenarios can include:

 

• a proposed acquisition;
• a sale of part of the business;
• a merger;
• a takeover;
• a change in direct ownership;
• a TUPE transfer;
• a demerger;
• a restructuring;
• a new branch; and
• an insolvency event.

 

The audit should establish whether immigration implications are considered early enough for the organisation to meet applicable sponsor requirements.

This is particularly important because some corporate events can require action beyond an SMS update and can potentially require a new sponsor licence application.

 

20. Test Whether Staff Know Where Records Are Kept

 

Relevant personnel should be able to locate or explain how to access the records needed for sponsor compliance.

The audit can test retrieval of:

 

• right to work evidence;
• Certificates of Sponsorship;
• employment contracts;
• job descriptions;
• salary information;
• payroll records;
• absence records;
• worker contact-detail histories;
• recruitment records;
• date-of-entry evidence where required;
• SMS reporting evidence; and
• previous compliance findings.

 

The organisation should not depend on one individual knowing where compliance evidence is stored.

 

21. Identify Single-Person Dependency

 

Interviews frequently expose compliance processes that depend heavily on one employee.

Warning signs can include:

 

• only one person understands the SMS;
• only one person receives immigration-expiry alerts;
• only one person knows where worker files are stored;
• reporting decisions exist only in one person’s email account;
• nobody can explain the process when the usual administrator is absent;
• SMS access continuity depends on credential sharing; or
• senior personnel have little knowledge of sponsorship because one administrator manages everything.

 

The audit should identify where knowledge, access or responsibility needs to be distributed appropriately without weakening accountability.

 

22. Distinguish Training from Understanding

 

Evidence that staff attended sponsor compliance training does not necessarily establish that they understand the processes relevant to their role.

The audit should test whether training has translated into operational behaviour.

For example:

 

• Can managers recognise events that need escalation?
• Can HR explain the sponsored worker change process?
• Can payroll identify relevant pay anomalies?
• Can Level 1 Users explain how reports are managed?
• Can the Authorising Officer explain how oversight is exercised?

 

The relevant sequence is:

Training → Understanding → Behaviour → Evidence

If training has occurred but relevant events continue to be missed, the control has not achieved its intended result.

 

23. Avoid Artificial Interview Coaching

 

Preparing staff for an audit should focus on ensuring they understand their genuine responsibilities and the organisation’s actual processes.

It should not involve giving people scripted answers designed to create an appearance of compliance.

Artificial coaching can obscure the weaknesses that the internal audit is intended to identify.

A better approach is to:

 

• confirm responsibilities;
• explain escalation routes;
• provide appropriate training;
• correct unclear procedures;
• ensure staff know where records are kept; and
• test understanding through realistic scenarios.

 

Where an individual does not understand a relevant process, the audit should record the knowledge gap and address it through remediation.

 

24. Investigate Materially Inconsistent Answers

 

Differences between interview answers should be investigated rather than automatically treated as evidence of non-compliance.

The auditor should establish:

 

• whether the individuals were describing different aspects of the process;
• whether terminology caused confusion;
• whether the written policy is unclear;
• whether different departments follow different procedures;
• whether one individual has outdated information;
• whether the process has changed recently; or
• whether the evidence demonstrates a substantive compliance weakness.

 

The purpose is to establish the underlying facts.

Where necessary, the audit should return to documentary evidence and transactional testing to determine which account reflects operational reality.

 

25. Record Interview Findings

 

Material interview findings should be documented so they can be connected to the wider audit.

A useful structure is:

Role → Expected Knowledge → Response → Evidence Tested → Finding → Remediation

For example:

 

Element	Example
Role	Line manager of sponsored workers
Expected knowledge	Knows that material changes to duties should be escalated to HR
Response	Manager states that promotions are handled within the department without immigration escalation
Evidence tested	Two sponsored workers promoted during the review period
Finding	Role changes were not consistently escalated for sponsorship assessment
Remediation	Introduce mandatory sponsored-worker change trigger within the promotion process and provide targeted manager training

 

This links interview evidence to an identifiable control weakness and practical remediation.

 

26. Use Interviews to Verify Remediation

 

Interviews can also be used after remediation to establish whether revised procedures have been understood and embedded.

For example, where an audit identified poor escalation of role changes, the organisation can subsequently test whether managers:

 

• recognise the relevant trigger;
• know who to notify;
• understand when notification should occur;
• can locate the revised procedure; and
• have used the new process in practice.

 

This provides stronger evidence of remediation than merely recording that a new policy was circulated.

 

27. The Interview Audit Test

 

At the end of the interview stage, the organisation should be able to answer:

Does the Authorising Officer understand how sponsor compliance is governed?

Do SMS users understand their responsibilities and security requirements?

Do HR and recruitment teams recognise relevant sponsorship triggers?

Does payroll know how to escalate material changes affecting sponsored workers?

Do managers know which employment events need to be escalated?

Do sponsored workers’ accounts of their roles correspond with organisational records?

Can staff explain where compliance evidence is held?

Can the organisation operate effectively when key individuals are absent?

Has training resulted in practical understanding?

Do independent accounts correspond with the documentary evidence?

The central comparison remains:

Policy Says → Staff Say → Evidence Shows

Where all three are aligned, the organisation has stronger evidence that sponsor compliance is embedded in operational practice rather than existing only within written policies and personnel files.

 

 

Back to top

 

Section N: Common Problems Found During Sponsor Compliance Audits

 

Sponsor licence compliance audits frequently identify problems that are not immediately visible from the Sponsor Management System or an individual sponsored worker file.

Some findings are isolated administrative errors. Others reveal a wider weakness in the systems used to manage sponsored workers.

The purpose of the audit is therefore not simply to count errors. It should establish what caused each problem, how widely it extends and whether the organisation’s controls are capable of preventing recurrence.

A useful principle is:

One Error = Finding → Repeated Error = Pattern → Pattern = Potential Control Failure

 

1. HR Records Do Not Match the SMS

 

One of the most common audit findings is a discrepancy between HR information and the sponsor’s SMS records.

Differences can relate to:

 

• job title;
• salary;
• working hours;
• work location;
• employment start date;
• employment end date;
• contact information;
• role or duties; and
• other employment changes.

 

A discrepancy does not automatically establish a sponsor breach.

The audit should determine which record is accurate, when the difference arose and whether the underlying event required sponsor reporting or another form of immigration action.

 

2. Sponsored Worker Files Are Incomplete

 

Worker files may contain some of the required evidence while other records are missing, inaccessible or stored elsewhere.

Potential gaps include:

 

• right to work evidence;
• date-of-entry evidence where required;
• employment contracts;
• job descriptions;
• contact-detail histories;
• absence records;
• recruitment evidence;
• salary documentation;
• work-location information;
• evidence of employment changes; and
• SMS reporting records.

 

The audit should distinguish between evidence that was never created, evidence that was not retained and evidence that exists but cannot currently be located.

Each can require a different remedial response.

 

3. Historical Records Cannot Be Retrieved

 

An organisation may be able to produce current information but struggle to evidence the historical position.

This can occur where:

 

• HR systems overwrite previous data;
• documents were stored in former employees’ email accounts;
• records were migrated between systems;
• responsibility changed between teams;
• old personnel files were archived inconsistently; or
• the organisation never established a central compliance record.

 

The problem is particularly significant where the sponsor needs to demonstrate a history of employment, contact information, absence, immigration status or sponsorship action.

Audit remediation should therefore address both legitimate recovery of historical evidence and future record preservation.

 

4. Worker Contact Histories Are Missing

 

A common system weakness is that HR records contain only the sponsored worker’s current contact information.

Appendix D requires relevant history of the worker’s UK residential address, personal email address and telephone number to be retained and kept up to date.

The audit may identify that:

 

• previous addresses have been overwritten;
• old telephone numbers have disappeared;
• only work email addresses are recorded;
• workers do not know how to report changes;
• historic information cannot be exported; or
• the HR system was never configured to preserve changes.

 

Where this affects one worker because of system design, the audit should test whether the same issue affects the wider sponsored population.

 

5. Date-of-Entry Evidence Is Missing

 

Where applicable, the sponsor may need to retain evidence establishing that a sponsored worker entered the UK during the relevant period of entry clearance.

An audit may identify that the organisation completed a right to work check but did not separately retain appropriate date-of-entry evidence.

This distinction has become particularly important as immigration status has moved towards digital evidence and physical entry-clearance vignettes have been phased out in relevant cases during 2026.

The audit should establish:

 

• whether date-of-entry evidence was required;
• whether it was obtained;
• whether it can be retrieved;
• whether alternative legitimate travel evidence exists where appropriate; and
• whether the onboarding process needs to be changed for future workers.

 

6. Right to Work Checks Are Defective

 

The audit may identify a right to work document or record in the worker file but find that the prescribed checking process was not completed correctly.

Potential problems include:

 

• using the wrong checking method;
• using the wrong Home Office service;
• completing the check after employment commenced;
• failing to verify that the person presenting for work corresponds with the individual checked;
• failing to consider work restrictions;
• not retaining appropriate evidence;
• missing follow-up checks;
• incorrect immigration expiry dates; and
• failure to use the Employer Checking Service where required.

 

The audit should distinguish between sponsor record-keeping obligations and the separate requirements relevant to establishing a statutory excuse against liability for illegal working.

 

7. Immigration Expiry Monitoring Is Weak

 

Another common weakness is an organisation recording immigration expiry dates but lacking a reliable process for acting upon them.

Examples include:

 

• incorrect dates entered into HR systems;
• alerts generated too late;
• alerts sent to former employees;
• no named owner;
• follow-up checks not diarised;
• outstanding immigration applications not tracked; and
• no escalation where updated evidence is unavailable.

 

The audit should test the complete process:

Expiry Date → Alert → Owner → Follow-Up → Evidence → Verification

 

8. Salary Records Do Not Match Payroll

 

A sponsored worker’s personnel file may record one salary while payroll shows another.

Possible causes include:

 

• salary reductions;
• changes in working hours;
• unpaid leave;
• reduced-pay absence;
• payroll errors;
• deductions;
• promotion;
• temporary arrangements becoming permanent; or
• HR records not being updated.

 

The audit should establish the actual remuneration history before assessing the sponsorship consequences.

A salary discrepancy should not be dismissed as a payroll issue merely because the CoS and HR record remain unchanged.

 

9. Salary Reductions Were Not Escalated

 

A salary reduction may have been processed correctly by payroll without anybody considering the sponsorship implications.

This can happen where payroll treats the change as an ordinary employment matter.

The audit should determine:

 

• why salary changed;
• when the change occurred;
• whether hours also changed;
• whether the worker continued to meet the applicable sponsorship requirements;
• whether the sponsorship team was informed;
• whether reporting was required; and
• whether any wider immigration action was necessary.

 

Repeated failures of this kind indicate a weakness in the HR-to-payroll-to-sponsorship information flow.

 

10. Salary Increases Are Incorrectly Treated as Automatically Reportable

 

Audits can also identify unnecessary or incorrect reporting practices.

An ordinary salary increase does not generally require an SMS report merely because the worker is being paid more, subject to specific exceptions in the sponsor guidance.

The correct question is whether the increase accompanied another relevant change, such as:

 

• a promotion;
• different duties;
• a new role;
• a change in working hours; or
• an internal transfer.

 

The audit should test whether staff understand the underlying sponsor requirements rather than following an indiscriminate rule that every salary change must be reported.

 

11. Sponsored Workers’ Roles Have Drifted

 

Role drift can occur gradually as a worker takes on new responsibilities without formal consideration of the sponsorship implications.

The worker may retain the same job title while their substantive duties change considerably.

The audit may identify:

 

• additional management responsibilities;
• movement into another department;
• materially different technical duties;
• temporary responsibilities becoming permanent;
• changes following restructuring;
• promotion without sponsorship assessment; or
• an occupation classification that no longer reflects the substantive role.

 

The audit should compare the CoS, contract, current job description, manager evidence and worker evidence.

 

12. Role Changes Were Treated as Simple SMS Updates

 

Another potential problem is an assumption that every role change can be corrected by updating or reporting through the SMS.

Depending on the circumstances, a change may:

 

• require no report;
• require sponsor reporting;
• require wider immigration assessment; or
• be sufficiently significant to engage the change of employment requirements.

 

The audit should establish the substantive nature of the change and the requirement that applied at the time.

A retrospective SMS report should not be treated as an automatic solution to every historical role discrepancy.

 

13. The Actual Role Raises Eligible-Role Concerns

 

An audit may identify that the worker’s actual position no longer corresponds with the role described for sponsorship purposes.

The review should consider whether the substantive position continues to meet the applicable eligible-role requirements.

Potential concerns can include:

 

• duties materially different from those described;
• an inappropriate occupation classification;
• salary or hours inconsistent with the sponsored role;
• the role not operating within the business as described;
• insufficient evidence supporting the stated position; or
• circumstances raising questions about whether the role genuinely exists as represented.

 

The current eligible-role framework should be applied rather than relying solely on historic descriptions such as whether there was a “genuine vacancy”.

 

14. Recruitment Evidence Is Weak

 

The absence of a general resident labour market test does not mean that sponsors can ignore how sponsored workers were recruited.

An audit may identify that the organisation cannot explain or evidence the recruitment process.

Potential weaknesses include:

 

• no record of how the candidate was identified;
• missing vacancy information;
• missing recruitment agency correspondence;
• no selection records;
• unclear evidence of why the role was created;
• no explanation of the recruitment route; or
• missing records where historic or route-specific formal recruitment requirements applied.

 

The sponsor should be capable of explaining and, where appropriate, evidencing how the worker was recruited.

 

15. Work Locations Are Inaccurate

 

Work-location discrepancies are increasingly relevant where organisations operate across multiple offices, client sites and remote-working arrangements.

The audit may find that:

 

• a worker moved branch;
• a worker began working at a new client site;
• the contractual location changed;
• the worker moved to permanent remote working;
• the SMS still reflects an old normal work location; or
• HR and operational records disagree about where the worker normally works.

 

The audit should determine whether the change was reportable and whether the organisation’s processes are capable of identifying future location changes.

 

16. Hybrid Working Is Misunderstood

 

An audit may reveal either under-reporting or unnecessary reporting because staff do not distinguish between hybrid working and a substantive change in normal work location.

Moving to hybrid working does not, by itself, necessarily require an SMS report.

However, the organisation should retain appropriate records of the working arrangement and assess changes such as:

 

• a permanent move to another branch;
• a new client site not previously recorded;
• a substantive change in normal workplace; or
• permanent full-time remote working with little or no workplace attendance.

 

The audit should focus on the worker’s substantive normal working arrangements rather than occasional day-to-day variations.

 

17. Absence Records Are Incomplete

 

Appendix D requires sponsors to retain relevant records of sponsored worker absences.

Common audit problems can include:

 

• absence recorded only by individual managers;
• incomplete central records;
• missing historical absence data;
• unpaid leave recorded only in payroll;
• unauthorised absence not distinguished from authorised leave;
• separate periods not capable of being aggregated; and
• absence information not reaching the sponsorship team.

 

The audit should determine whether the weakness affects record keeping, reporting, salary compliance or a combination of these areas.

 

18. Unauthorised Absence Is Not Escalated

 

The sponsor guidance includes a reporting requirement relating to sponsored workers absent without permission for more than 10 consecutive working days.

An audit may identify that managers record absence but nobody monitors the sponsorship threshold.

The weakness may therefore be in escalation rather than attendance recording itself.

A stronger control is:

Absence Recorded → Duration Monitored → Threshold Identified → Sponsorship Escalation → Assessment → Required Action

 

19. Unpaid or Reduced-Pay Absence Is Not Monitored

 

Current sponsor guidance also contains provisions relating to absence without pay or on reduced pay for more than four weeks in total in a calendar year, subject to applicable exceptions and route-specific provisions.

Common problems include:

 

• separate absence periods not being aggregated;
• payroll knowing about reduced pay but HR not knowing;
• HR knowing about leave but sponsorship personnel not being informed;
• no assessment of an applicable exception;
• salary compliance not being reconsidered; and
• required reporting or other action being missed.

 

The audit should test the complete HR-payroll-sponsorship chain.

 

20. HR Events Do Not Reach the Sponsorship Team

 

Many sponsor compliance failures originate from weak internal communication rather than lack of knowledge within the sponsorship team.

For example:

Manager changes role → HR updates record → Payroll updates salary → Sponsorship team is not informed

The organisation may therefore have competent Level 1 Users but still fail to comply because the relevant information never reaches them.

The audit should identify which business events depend on cross-department escalation and test whether those routes work in practice.

 

21. Reporting Decisions Are Not Documented

 

An organisation may correctly decide that an event did not require an SMS report but retain no evidence that sponsorship implications were considered.

This can make a later audit difficult, particularly where the event involved:

 

• changes in duties;
• salary changes;
• working-hours changes;
• work-location changes;
• hybrid working;
• absence;
• internal transfers; or
• corporate changes.

 

For material or potentially ambiguous events, an appropriate record of the assessment can help demonstrate that the issue was considered rather than overlooked.

 

22. Reports Are Made Late

 

Late reporting can indicate a weakness at several different stages of the process.

The audit should establish whether the delay resulted from:

 

• late identification;
• manager delay;
• HR delay;
• poor escalation;
• uncertainty over the rules;
• lack of SMS user availability;
• administrative backlog;
• inadequate ownership; or
• failure to monitor deadlines.

 

Many specified worker changes are generally subject to a 10-working-day reporting framework, while specified organisational changes are generally subject to a 20-working-day reporting or action framework, although the specific requirement should always be checked.

Remediation should address the cause of delay rather than simply reminding staff that reports need to be made more quickly.

 

23. Potentially Reportable Events Were Never Assessed

 

A significant finding can arise where employment or business events occurred but there is no evidence that anyone considered their sponsorship implications.

This is different from a documented decision that no report was required.

The audit should test:

Event → Was It Identified? → Was Sponsorship Considered? → What Requirement Applied? → What Action Was Taken?

Where the chain stops before assessment, the organisation should investigate whether similar events may also have been missed.

 

24. Corporate Changes Were Not Escalated

 

Sponsorship teams are sometimes informed about corporate changes only after the transaction has completed.

Potential events include:

 

• mergers;
• acquisitions;
• takeovers;
• demergers;
• changes in direct ownership;
• TUPE transfers;
• restructuring;
• branch changes; and
• relevant insolvency events.

 

This can be a significant problem because some corporate events have consequences extending beyond an SMS report and can potentially require a new sponsor licence application.

Sponsor licences are not transferable.

The control should therefore bring sponsor compliance into the transaction process early enough for the applicable requirements to be assessed and actioned.

 

25. Key Personnel Records Are Out of Date

 

The audit may identify that sponsor key personnel information no longer reflects the organisation’s current arrangements.

Problems can include:

 

• an outdated Authorising Officer;
• an outdated Key Contact;
• former employees retaining SMS access;
• users whose roles have changed;
• incorrect user contact information;
• insufficient Level 1 User cover; or
• responsibilities that exist only informally.

 

The audit should determine whether the issue is limited to an administrative update or reflects a wider governance weakness.

 

26. Remaining Level 2 Users Have Not Been Addressed

 

Following the September 2026 changes to SMS user arrangements, an audit may identify remaining Level 2 Users whose transitional position has not been actively managed.

No new Level 2 Users have been appointable since 9 September 2026.

The sponsor should therefore establish whether existing Level 2 Users:

 

• still require access;
• are eligible for Level 1 access;
• need to be upgraded;
• should be deactivated; and
• have a clear transition owner and a deadline of 8 March 2027.

 

Leaving transitional users unreviewed creates avoidable access and governance risk.

 

27. SMS Access & MFA Controls Are Weak

 

The 2026 introduction of multi-factor authentication has increased the importance of individual SMS account management.

Audit findings may include:

 

• outdated user email addresses;
• outdated telephone details;
• shared credentials;
• shared passwords;
• sharing of one-time passcodes;
• accounts associated with former employees;
• users retaining unnecessary access;
• SMS accounts that have become or are at risk of becoming inactive through prolonged non-use;
• no active Level 1 User remaining; and
• no contingency arrangement when a principal user is absent.

 

The appropriate control is:

Correct Individual → Individual Account → Current Contact Details → MFA → Appropriate Access → No Credential Sharing

 

28. The Sponsor Relies on One Person

 

Single-person dependency is a recurring compliance risk.

The audit may find that one individual:

 

• operates the SMS;
• holds all sponsor knowledge;
• maintains the sponsored worker list;
• receives all expiry alerts;
• stores reporting evidence;
• understands the worker files;
• manages Home Office correspondence; and
• controls the remediation tracker.

 

This may work while that person is available but can fail quickly during sickness, holiday, resignation or unexpected absence.

Business continuity should be addressed without weakening individual SMS security or encouraging credential sharing.

 

29. Written Policies Do Not Reflect Actual Practice

 

A sponsor may have detailed written procedures that staff do not follow.

The audit may identify that:

 

• managers have never seen the policy;
• HR follows a different process;
• the policy refers to outdated systems;
• responsibilities have moved to different employees;
• reporting deadlines are incorrect;
• new working practices are not covered; or
• the documented escalation route is not used.

 

The relevant test is:

Policy Says → Staff Say → Evidence Shows

A policy should describe and support an effective operational process rather than exist principally as an audit document.

 

30. Training Has Not Changed Behaviour

 

Training records can demonstrate that staff attended a compliance session, but attendance alone does not establish effective compliance.

The audit should identify whether relevant personnel can apply the training to real situations.

For example:

 

• Do managers escalate promotions?
• Does HR identify work-location changes?
• Does payroll escalate salary reductions?
• Do SMS users understand current reporting requirements?
• Does the Authorising Officer understand sponsor governance?

 

If the same errors continue after training, the organisation should investigate whether the problem lies in the training, the process, the systems or management oversight.

 

31. Previous Audit Findings Remain Open

 

A repeated finding is generally more significant from a governance perspective than an issue identified and effectively remediated.

The audit should examine previous:

 

• internal audit findings;
• mock audit findings;
• Home Office compliance issues;
• right to work review findings;
• internal incident reports; and
• remediation plans.

 

For each issue, determine whether:

Finding → Remediation → Implementation → Verification → Closure

actually occurred.

An action should not be treated as closed merely because a policy was amended or training was delivered.

 

32. Remediation Was Implemented but Never Verified

 

An organisation may respond quickly to an audit finding but fail to test whether the corrective action works.

For example:

 

• a new absence procedure was issued but managers still do not escalate absence;
• an expiry-alert system was introduced but alerts go to the wrong person;
• contact-history functionality was changed but previous data is still overwritten;
• a payroll escalation process was introduced but sponsored workers are not correctly identified; or
• new SMS cover was appointed but the replacement user cannot perform the required functions.

 

The audit cycle should therefore continue beyond implementation:

Find → Remediate → Verify → Monitor → Re-test

 

33. Problems Are Corrected Individually but Root Causes Remain

 

Another common weakness is correcting each affected worker without addressing the system that produced the error.

For example:

 

• one worker’s address history is reconstructed but the HR system still overwrites address changes;
• one salary discrepancy is corrected but payroll changes still bypass sponsorship review;
• one role change is assessed but managers remain unaware of escalation requirements;
• one late report is submitted but reporting deadlines are still not tracked; or
• one missing right to work record is located but document retention remains inconsistent.

 

Effective remediation should therefore operate at two levels:

Case Correction + Control Correction

 

34. Historical Records Are Reconstructed Inappropriately

 

Where records are missing, there can be pressure to make the file appear complete.

The organisation should not create, alter or backdate documents in a way that falsely suggests evidence existed or an action was taken at an earlier date.

Where legitimate reconstruction is possible, the audit trail should accurately explain:

 

• what information was missing;
• what evidence has subsequently been located;
• what has been reconstructed;
• the source of the reconstructed information;
• when the reconstruction took place; and
• what control has been introduced to prevent recurrence.

 

Transparency is preferable to creating an inaccurate historical record.

 

35. Audit Findings Are Treated as Automatic Home Office Outcomes

 

An internal compliance finding should not automatically be equated with a particular Home Office enforcement outcome.

The significance of a finding depends on the applicable requirement and the surrounding facts, including:

 

• the nature of the issue;
• the number of workers affected;
• the duration;
• whether the problem is continuing;
• whether it is isolated or systemic;
• the evidence available;
• the sponsor’s wider compliance position; and
• the action taken to address the issue.

 

Depending on the circumstances, Home Office action can include measures such as reducing or setting a CoS allocation to zero, downgrading a licence, suspending a licence, revoking a licence or referring matters to other authorities.

The existence of an internal audit finding does not, by itself, determine that any particular consequence will follow.

 

36. The Audit Does Not Distinguish Isolated Errors from Systemic Failure

 

One of the most important functions of the audit is to determine the scale of a problem.

Where a finding is identified, ask:

Is this one case?

Are similar cases likely?

What process produced the error?

Who else passed through that process?

How far back could the problem extend?

Is the weakness still operating today?

This converts a file-level finding into a meaningful assessment of compliance exposure.

 

37. Common Sponsor Compliance Audit Findings: Summary

 

Finding	Potential Underlying Weakness
HR and SMS information differs	Employment changes not escalated
Missing worker documents	Weak Appendix D record keeping
Missing contact history	HR system overwrites historic information
Missing date-of-entry evidence	Incomplete sponsored worker onboarding
Defective right to work checks	Incorrect checking process or poor training
Missed follow-up checks	Weak immigration expiry monitoring
Salary discrepancy	HR, payroll and sponsorship systems not integrated
Unassessed role change	Managers do not escalate promotions or duty changes
Role drift	No periodic reconciliation of actual duties
Incorrect work location	Location changes not escalated
Missing absence records	Weak attendance and record-keeping controls
Late SMS reports	Slow identification, escalation or assessment
Missed corporate reporting	Sponsorship excluded from corporate-change planning
Outdated SMS users	Weak access governance
Shared SMS credentials	Poor security and business-continuity arrangements
Single-person dependency	Insufficient compliance resilience
Policy not followed	Compliance not embedded operationally
Repeated previous finding	Remediation ineffective or not verified

 

38. The Common Findings Test

 

For every material problem identified during the sponsor compliance audit, the organisation should establish:

What went wrong?

What requirement applied?

When did the problem begin?

Is it still continuing?

Who or what is affected?

Is the issue isolated or systemic?

What caused it?

What immediate action is required?

What control needs to change?

How will remediation be verified?

The audit should therefore move beyond identifying individual errors:

Finding → Scope → Root Cause → Exposure → Remediation → Verification

This is what converts a sponsor licence compliance audit from a document-checking exercise into a meaningful assessment of the organisation’s ability to manage its sponsor duties.

 

 

Back to top

 

Section O: What to Do if an Audit Finds Sponsor Compliance Breaches

 

Finding a potential sponsor compliance breach does not complete the audit. The organisation should establish the facts, determine the applicable requirement, understand the scale and significance of the issue and decide what action is required.

The response should be structured rather than reactive.

A useful framework is:

Establish Facts → Confirm Requirement → Determine Scope → Assess Exposure → Take Required Action → Remediate Control → Document → Verify

The appropriate response will depend on the nature of the finding. A missing document, late SMS report, salary discrepancy, unassessed role change and potentially ineligible sponsored role do not necessarily require the same response.

 

1. Establish the Facts Before Taking Action

 

The first step is to establish exactly what happened.

The audit should identify:

 

• the worker or workers affected;
• the relevant dates;
• the applicable sponsor requirement;
• what the organisation was required to do;
• what actually happened;
• what evidence exists;
• what evidence is missing;
• whether the issue is historical or continuing;
• which personnel or systems were involved; and
• whether the same circumstances may affect other sponsored workers.

 

Remedial action should be based on verified facts rather than an initial assumption about the seriousness of the finding.

 

2. Distinguish a Discrepancy from a Breach

 

Not every discrepancy identified during an audit necessarily amounts to a breach of sponsor duties.

For example, the audit may identify:

 

• different job titles across two systems;
• different salary figures;
• a work-location discrepancy;
• an apparent missing SMS report;
• an incomplete worker file;
• a difference between contractual and actual hours; or
• a right to work document stored outside the expected file.

 

The auditor should investigate the underlying facts before classifying the issue.

The relevant sequence is:

Discrepancy → Investigation → Applicable Requirement → Finding

This reduces the risk of treating administrative differences as breaches while also preventing genuine compliance problems from being dismissed as clerical errors.

 

3. Confirm Which Sponsor Requirement Applied

 

Once the facts are established, the organisation should identify the sponsor requirement that applied at the relevant time.

This is particularly important where:

 

• sponsor guidance has changed;
• the event occurred several years earlier;
• different immigration routes are involved;
• different reporting requirements apply to different events;
• an exception may apply;
• a transitional provision may be relevant; or
• the issue involves both sponsor duties and another legal regime such as right to work.

 

The audit should avoid assessing a historical event solely against a later rule if that was not the requirement that applied when the event occurred.

However, current controls should also be assessed against the requirements that apply now.

 

4. Determine Whether the Problem Is Historical or Continuing

 

The organisation should establish whether the problem has ended or remains active.

Examples of continuing issues can include:

 

• a sponsored worker still performing materially different duties;
• salary remaining below the required level;
• an unresolved immigration status issue;
• incorrect work-location information;
• an inappropriate SMS user retaining access;
• missing MFA or access controls;
• a continuing absence issue;
• an unaddressed corporate change;
• an ineffective reporting process; or
• a record-keeping system that continues to lose required history.

 

Continuing problems may require immediate action to prevent further non-compliance.

 

5. Determine the Affected Population

 

A finding affecting one sponsored worker should prompt consideration of whether other workers passed through the same process.

For example:

 

• one missing contact history may indicate an HR-system limitation affecting all sponsored workers;
• one defective right to work check may indicate that staff have been using the wrong process generally;
• one unreported salary reduction may indicate that payroll changes are not escalated;
• one role-drift case may indicate that managers do not report changes in duties;
• one missing date-of-entry record may indicate an onboarding weakness; or
• one late leaver report may indicate that termination workflows do not notify SMS users.

 

The audit should therefore ask:

Who else could have been affected by the same control?

This determines whether testing needs to expand.

 

6. Establish the Compliance Timeline

 

For significant findings, construct a chronology.

This can record:

 

• when the relevant event occurred;
• when the organisation became aware of it;
• when HR recorded it;
• when payroll acted;
• when the sponsorship team became aware;
• when any SMS action occurred;
• when the issue was discovered by the audit;
• what corrective action followed; and
• when remediation was completed.

 

A timeline is particularly useful for missed or late reporting, role changes, salary changes, absence, right to work issues and corporate events.

 

7. Identify the Root Cause

 

Correcting the immediate problem without identifying its cause leaves the organisation exposed to recurrence.

Potential root causes include:

 

• lack of staff knowledge;
• unclear responsibility;
• poor manager escalation;
• weak HR-to-SMS communication;
• weak HR-to-payroll integration;
• outdated policies;
• system configuration problems;
• missing alerts;
• single-person dependency;
• inadequate training;
• insufficient management oversight;
• failure to monitor changes in sponsor requirements; or
• a process that was never designed to identify the relevant event.

 

The audit should avoid using “human error” as the final explanation without considering why the system allowed the error to occur and remain undetected.

 

8. Assess the Compliance Exposure

 

The organisation should assess the significance of the finding in context.

Relevant factors can include:

 

• the nature of the requirement;
• the number of workers affected;
• the duration of the issue;
• whether it is continuing;
• whether it is isolated or systemic;
• whether the worker remained eligible for sponsorship;
• whether salary requirements remained satisfied;
• whether right to work is affected;
• whether reporting requirements were missed;
• the quality of the available evidence;
• whether previous similar findings exist;
• the effectiveness of existing controls; and
• the organisation’s ability to remediate the problem.

 

This assessment should inform prioritisation without assuming that an internal audit finding automatically produces a particular Home Office outcome.

 

9. Take Immediate Protective Action Where Necessary

 

Some findings may require immediate action before the wider remediation programme is completed.

Depending on the facts, this can include:

 

• escalating an immigration status concern;
• preventing an unassessed employment change from proceeding;
• reviewing a potentially non-compliant salary arrangement;
• addressing inappropriate SMS access;
• removing access belonging to former personnel;
• addressing a right to work issue;
• reviewing a sponsored worker’s current duties;
• addressing an unresolved reporting issue; or
• obtaining specialist advice on a material corporate change.

 

The action should be proportionate to the actual issue and based on the applicable legal and sponsor requirements.

 

10. Correct Current Records Where Appropriate

 

Where current records are inaccurate, they should be corrected through the appropriate process.

This may involve:

 

• updating HR information;
• correcting payroll data;
• updating worker contact details;
• correcting internal job information;
• updating work-location records;
• removing inappropriate system access;
• obtaining missing current evidence; or
• taking appropriate SMS action where permitted and required.

 

Correcting the current position should not involve altering the historical record to suggest that the correct information or action existed earlier than it did.

 

11. Do Not Automatically Submit a Retrospective SMS Report

 

Where an audit identifies an apparently missed report, the organisation should establish the applicable requirement and facts before deciding what action to take.

The review should establish:

 

• what event occurred;
• when it occurred;
• whether it was reportable;
• which reporting requirement applied;
• whether another immigration process was required instead;
• whether the underlying issue is continuing;
• whether any subsequent action has already been taken; and
• what action is now appropriate.

 

A late SMS report should not be treated as a universal remedy for every historical sponsorship issue.

This is particularly important for material role changes, corporate events and other circumstances where the requirement may extend beyond sponsor reporting.

 

12. Address Missed Worker Reporting Carefully

 

Many specified sponsored worker changes are generally subject to a 10-working-day reporting framework unless the applicable sponsor guidance provides otherwise.

Where an apparent late or missed worker report is identified, document:

 

• the underlying event;
• the event date;
• when relevant personnel became aware;
• when the sponsorship function became aware;
• the applicable reporting requirement;
• the reason reporting did not occur correctly;
• whether the matter is continuing;
• what action has now been taken; and
• what control failure caused the issue.

 

The response should address both the individual case and the reporting process that failed.

 

13. Address Corporate Change Findings Urgently

 

Potential failures involving mergers, acquisitions, takeovers, direct ownership changes, demergers, TUPE transfers, restructuring or other material corporate events should be escalated promptly.

Specified organisational changes are generally subject to a 20-working-day reporting or action framework, but the precise requirement depends on the event.

Some changes can have consequences beyond an SMS update and may require a new sponsor licence application.

Sponsor licences are not transferable.

Where an audit identifies a potentially unaddressed corporate event, the organisation should establish the legal structure, transaction history, affected sponsored workers and applicable sponsor requirements before deciding on remediation.

 

14. Address Role & Duty Findings Carefully

 

Where a worker’s actual duties differ from the sponsored role, establish:

 

• what the worker was sponsored to do;
• what they currently do;
• when the duties changed;
• why they changed;
• whether the occupation classification remains appropriate;
• whether the position remains an eligible role;
• whether salary and hours remain compliant;
• whether the change was previously assessed;
• whether reporting was required; and
• whether the change was significant enough to engage the change of employment requirements.

 

The organisation should not assume that an SMS report can retrospectively resolve a role change that required a different immigration process.

 

15. Address Salary & Payroll Findings

 

Where salary or payroll discrepancies are identified, establish the actual payment history.

Reconcile:

CoS → Contract → HR Salary → Hours → Payroll → Payslips

The investigation should identify:

 

• the expected salary;
• the salary actually paid;
• the period affected;
• working hours;
• the reason for any reduction;
• whether unpaid or reduced-pay absence was involved;
• whether applicable salary requirements remained satisfied;
• whether reporting was required; and
• whether similar payroll arrangements affect other sponsored workers.

 

Where the issue results from a payroll or HR system configuration, remediation should extend beyond the individual worker.

 

16. Address Absence Findings

 

Where an audit identifies absence-related concerns, the organisation should determine whether the issue affects record keeping, reporting, salary compliance or several areas simultaneously.

Relevant considerations include:

 

• whether absence records exist;
• whether the absence was authorised;
• the duration;
• whether unauthorised absence exceeded 10 consecutive working days;
• whether unpaid or reduced-pay absence exceeded four weeks in total in the calendar year;
• whether an applicable exception applied;
• whether payroll reflected the absence;
• whether the sponsorship team was informed; and
• whether required action was taken.

 

The underlying absence-monitoring and escalation process should also be reviewed.

 

17. Address Right to Work Findings Separately

 

A right to work finding may create issues under the statutory illegal working regime as well as sponsor compliance requirements.

Where a check appears missing or defective, establish:

 

• whether a prescribed check was actually conducted;
• when it was conducted;
• which method was used;
• whether evidence exists elsewhere;
• whether the worker had and continues to have permission to work;
• whether any work restrictions apply;
• whether a statutory excuse exists;
• whether Appendix D requirements were met;
• whether a follow-up check was required; and
• whether the issue affects other employees.

 

Having immigration permission and having completed a prescribed right to work check are related but distinct issues.

Significant right to work concerns should be escalated promptly for appropriate assessment.

 

18. Recover Missing Evidence Legitimately

 

Where evidence is missing from a worker file, the organisation should determine whether legitimate contemporaneous records exist elsewhere.

Potential sources can include:

 

• HR systems;
• payroll;
• recruitment systems;
• corporate records;
• archived files;
• email records;
• immigration case records;
• manager records;
• travel evidence where relevant; and
• other business systems.

 

If evidence is recovered, the organisation should retain it appropriately and document the circumstances where necessary.

The distinction between locating existing evidence and creating new evidence of a historical event should be maintained.

 

19. Do Not Backdate or Fabricate Records

 

The organisation should not attempt to make the historical compliance position appear better than it was.

It should not:

 

• backdate right to work checks;
• create false historical absence records;
• alter documents to conceal discrepancies;
• create an SMS decision record pretending it existed earlier;
• invent recruitment evidence;
• change payroll history inaccurately; or
• ask staff to provide a misleading account of past events.

 

Where a record is legitimately reconstructed, it should be clear that reconstruction occurred later and should identify the evidence on which it is based.

An accurate record of a historic failure and its remediation is preferable to an inaccurate record suggesting that no failure occurred.

 

20. Correct the Case & Correct the Control

 

Effective remediation should generally address two separate questions:

 

a. What needs to be done about the affected case?

 

b. What needs to change to prevent recurrence?

 

For example:

 

Audit finding	Case correction	Control correction
Missing contact history	Recover legitimate historic information where possible	Configure HR process to preserve future contact history
Late role-change assessment	Assess current worker position and required action	Add sponsorship review to promotion workflow
Salary reduction not escalated	Assess worker’s salary position and reporting requirements	Create payroll-to-sponsorship escalation trigger
Missing follow-up right to work check	Assess current status and take lawful current action	Repair immigration-expiry monitoring process
Late leaver reporting	Assess and address affected worker record	Integrate sponsorship notification into leaver workflow

 

Correcting only the individual file leaves the underlying compliance risk in place.

 

21. Assign an Owner to Every Remedial Action

 

Each material finding should have a named owner.

Depending on the issue, this may be:

 

• the Authorising Officer;
• a Level 1 User;
• HR;
• payroll;
• recruitment;
• a line manager;
• IT or systems personnel;
• finance;
• legal or compliance personnel; or
• senior management.

 

Responsibility should be sufficiently specific that it is clear who is accountable for completing the action.

“HR” or “management” may be too vague where several individuals could assume somebody else is dealing with the finding.

 

22. Set a Remediation Deadline

 

Audit findings should have realistic completion dates reflecting their significance and complexity.

Higher-risk or continuing issues may require immediate or accelerated action, while wider system changes may take longer to implement.

Where permanent remediation cannot be completed immediately, consider whether an appropriate interim control is required.

For example:

 

• manual monitoring while an automated alert system is being repaired;
• temporary secondary review of salary changes;
• central approval of sponsored-worker promotions;
• manual review of immigration expiry dates; or
• additional oversight while SMS access arrangements are restructured.

 

Interim controls should themselves have an owner and review date.

 

23. Record Remediation Evidence

 

The organisation should retain evidence showing what was done in response to the finding.

Depending on the issue, evidence can include:

 

• corrected records;
• SMS action evidence;
• revised procedures;
• system screenshots;
• training records;
• updated responsibility matrices;
• payroll corrections;
• right to work evidence;
• management approvals;
• sample re-testing; and
• formal closure records.

 

The evidence should demonstrate more than the intention to remediate.

It should show that the required action was actually completed.

 

24. Verify That Remediation Works

 

Completion of an action is not the same as effective remediation.

The organisation should test whether the revised control works in practice.

For example:

 

• if an expiry-alert process was repaired, test whether alerts generate correctly;
• if managers received training, test a subsequent role change;
• if payroll escalation was introduced, trace a later salary change;
• if contact-history functionality was changed, confirm that old data is preserved;
• if an absence process was revised, test a later absence case; and
• if SMS cover was introduced, confirm the replacement user can perform the required functions securely.

 

The remediation sequence should be:

Finding → Action → Implementation → Evidence → Re-test → Closure

 

25. Escalate Significant Findings

 

Material findings should be escalated to the appropriate level within the organisation.

This can include issues involving:

 

• potential illegal working;
• multiple affected sponsored workers;
• material salary concerns;
• potentially ineligible roles;
• significant unassessed role changes;
• systemic reporting failures;
• significant corporate changes;
• repeated previous findings;
• potentially inaccurate information provided to the Home Office; or
• other matters capable of creating material sponsor licence exposure.

 

The escalation process should ensure that significant compliance risk is visible to those responsible for the sponsor licence and organisational governance.

 

26. Consider When Specialist Legal Advice Is Appropriate

 

Some audit findings can be resolved through routine internal correction. Others may require specialist legal assessment before the organisation acts.

Advice may be appropriate where there is uncertainty about:

 

• whether a breach has occurred;
• whether a historical event was reportable;
• whether retrospective action should be taken;
• whether a role change requires a change of employment application;
• whether salary arrangements remain compliant;
• whether a role satisfies current sponsorship requirements;
• whether a corporate event affects the sponsor licence;
• whether a new sponsor licence application is required;
• right to work exposure;
• potentially inaccurate information previously supplied to the Home Office;
• the treatment of multiple or systemic failures; or
• preparation for known Home Office scrutiny.

 

Obtaining advice before taking irreversible or potentially inappropriate action can be particularly important in complex historical cases.

 

27. Do Not Assume a Finding Determines the Home Office Outcome

 

An internal audit finding should not automatically be treated as equivalent to a particular Home Office enforcement decision.

The Home Office response to sponsor non-compliance depends on the applicable rules and circumstances.

Depending on the facts, possible action can include measures such as:

 

• reducing or setting a Certificate of Sponsorship allocation to zero;
• downgrading a sponsor licence;
• suspending a sponsor licence;
• revoking a sponsor licence; or
• referring relevant matters to other authorities.

 

Where a sponsor licence is suspended, the sponsor cannot assign any Certificates of Sponsorship while the suspension remains in force. Where a sponsor is downgraded to a B-rating and required to follow an action plan, the action-plan fee must normally be paid within 10 working days, the action plan runs for 3 months, and the sponsor cannot normally assign Certificates of Sponsorship to new workers while B-rated. A sponsor can ordinarily be B-rated and subject to an action plan only twice within a rolling four-year period.

The significance of an audit finding depends on factors such as its nature, duration, scale, whether it is continuing, the workers affected, the evidence available and whether the problem is isolated or systemic.

The audit should therefore describe and assess the actual finding rather than attempt to predict an automatic enforcement outcome.

 

28. Maintain a Central Remediation Record

 

Audit findings should be managed through a central remediation record rather than dispersed across emails, meeting notes and individual files.

For each finding, record:

 

• finding reference;
• requirement;
• evidence;
• affected worker or population;
• risk assessment;
• root cause;
• immediate action;
• longer-term remediation;
• owner;
• deadline;
• status;
• completion evidence;
• verification method;
• re-test result; and
• closure date.

 

This creates a clear audit trail from identification through to verified remediation.

 

29. Use Audit Findings to Improve the Wider Compliance Framework

 

Audit findings should inform the organisation’s wider sponsor compliance programme.

For example:

 

• repeated reporting delays may justify redesigned escalation workflows;
• role-change findings may justify adding immigration review to promotion approvals;
• payroll discrepancies may justify automated sponsored-worker flags;
• missing contact histories may require HR-system changes;
• weak manager knowledge may require targeted training;
• corporate reporting failures may require immigration review within transaction checklists; and
• single-person dependency may require improved business-continuity arrangements.

 

The audit should therefore produce organisational improvement rather than simply a list of corrected worker files.

 

30. The Sponsor Compliance Breach Response Test

 

For every material audit finding, the organisation should be able to answer:

What happened?

Which requirement applied?

When did it happen?

Is the issue still continuing?

Who or what is affected?

Is it isolated or systemic?

What caused it?

What immediate action was required?

Was Home Office reporting or another immigration action required?

What control has been changed?

Who owns the remediation?

What evidence proves that remediation was completed?

Has the revised control been re-tested?

The complete response framework is:

Establish Facts → Confirm Requirement → Determine Scope → Assess Exposure → Take Required Action → Remediate Control → Document → Verify

This ensures that sponsor compliance findings are addressed transparently and systematically while strengthening the organisation’s ability to prevent the same problem from recurring.

 

 

Back to top

 

Section P: Risk-Grading Sponsor Compliance Audit Findings

 

Once audit findings have been identified and investigated, the organisation should prioritise them according to their compliance significance.

Risk grading helps distinguish an urgent issue affecting the organisation’s current sponsorship position from a lower-level administrative weakness that can be addressed through planned improvement.

The purpose is not to predict how the Home Office would categorise or respond to a particular finding. Internal audit risk grades are management tools used to determine priority, ownership, escalation and remediation.

A useful assessment sequence is:

Finding → Requirement → Evidence → Scope → Exposure → Risk Grade → Remediation Priority

 

1. Risk-Grade the Finding, Not Its Appearance

 

An audit finding should be graded according to the underlying compliance exposure rather than how serious it initially appears.

For example, a missing document may be:

 

• a filing error where valid contemporaneous evidence exists elsewhere;
• a record-keeping failure affecting one worker;
• evidence of a system that never retained the required documents; or
• part of a wider problem affecting the entire sponsored workforce.

 

Those circumstances should not necessarily receive the same internal risk grade.

The auditor should investigate before grading.

 

2. Use Internal Risk Categories Consistently

 

An organisation can use internal categories such as:

 

• Critical;
• Material;
• Control Weakness; and
• Improvement.

 

These are internal audit classifications only.

They are not Home Office terminology, do not correspond automatically with Home Office enforcement categories and should not be presented as predicting the action the Home Office would take.

The value of the categories lies in using them consistently across the audit.

 

3. Critical Findings

 

An internal Critical classification can be reserved for findings requiring immediate senior attention because the audit identifies potentially serious and current compliance exposure.

Depending on the facts, examples could include:

 

• a potentially significant right to work issue;
• a sponsored worker apparently performing a materially different or potentially ineligible role;
• a potentially serious salary compliance issue;
• a significant unaddressed corporate change affecting the sponsor licence;
• a systemic failure affecting a substantial sponsored worker population;
• potentially inaccurate material information having been provided to the Home Office;
• a continuing issue capable of affecting the organisation’s current ability to comply with sponsor duties; or
• a repeat significant failure that previous remediation did not resolve.

 

The classification should follow investigation of the facts rather than being applied automatically because a particular topic is involved.

A Critical finding would ordinarily justify immediate escalation, defined interim controls where appropriate and accelerated remediation.

 

4. Material Findings

 

A Material classification can be used for substantive sponsor compliance failures requiring prompt remediation but which, on the evidence available, do not justify the organisation’s highest internal category.

Examples may include:

 

• a confirmed late or missed sponsor report;
• significant gaps in Appendix D records;
• an unassessed role change;
• a salary reduction that was not escalated appropriately;
• a failure to maintain required worker information;
• a significant work-location discrepancy;
• weak immigration expiry monitoring;
• repeated reporting delays;
• inappropriate SMS access; or
• multiple workers affected by the same compliance error.

 

Again, the classification depends on the circumstances. A reporting failure affecting one historical event may warrant different treatment from a continuing reporting failure affecting numerous workers.

 

5. Control Weakness Findings

 

A Control Weakness can identify a process that increases the risk of future non-compliance even where the audit has not established a substantive current breach.

Examples can include:

 

• over-reliance on one Level 1 User;
• poor business-continuity arrangements;
• managers not understanding escalation triggers;
• weak HR-to-payroll communication;
• absence alerts that depend on manual monitoring;
• unclear ownership of sponsored worker changes;
• inconsistent evidence retention;
• insufficient management oversight;
• outdated internal sponsor procedures; or
• an HR system that does not preserve required historical information.

 

A control weakness should not be ignored merely because no substantive breach has yet resulted from it.

The purpose of proactive auditing is to identify these weaknesses before they produce a compliance failure.

 

6. Improvement Findings

 

An Improvement finding can be used where the existing process broadly operates but could be strengthened.

Examples can include:

 

• improving documentation of material reporting decisions;
• centralising records currently held across several systems;
• improving management reporting;
• adding secondary checks to higher-risk processes;
• improving audit trails;
• making responsibilities clearer;
• enhancing training materials; or
• introducing additional reconciliation checks.

 

Improvement findings can increase resilience without suggesting that the organisation is necessarily in breach of a sponsor requirement.

 

7. Assess the Nature of the Requirement

 

The risk assessment should consider what type of sponsor requirement is affected.

The finding may concern:

 

• record keeping;
• sponsor reporting;
• worker monitoring;
• right to work;
• salary;
• role eligibility;
• Certificate of Sponsorship administration;
• SMS security;
• key personnel;
• corporate changes;
• prevention of abuse of the sponsorship system; or
• another sponsor duty.

 

The nature of the requirement is one factor in the assessment, but it should not be considered in isolation from the facts.

 

8. Assess Whether the Finding Is Continuing

 

A continuing compliance problem will generally require different management treatment from a historic issue that has ended.

The audit should ask:

 

• Is the affected worker still sponsored?
• Is the worker still performing the relevant role?
• Is the salary issue continuing?
• Does the inaccurate information remain on current systems?
• Does the defective process remain operational?
• Does an inappropriate SMS user still have access?
• Are workers continuing to pass through the affected process?

 

Where exposure is continuing, immediate containment or interim controls may be required while permanent remediation is developed.

 

9. Assess the Number of Workers Affected

 

The audit should establish the affected population wherever possible.

A useful distinction is between:

 

• one worker;
• a defined group;
• all workers sponsored through a particular process;
• all workers managed by a particular department or location; and
• the entire sponsored workforce.

 

Where the exact population is not yet known, the finding should remain open while further testing establishes the scope.

The risk grade may need to change as additional evidence emerges.

 

10. Assess the Duration of the Problem

 

The length of time for which a problem existed can be relevant to its significance.

The audit should identify:

 

• when the problem began;
• how long it continued;
• whether it remains active;
• how many employment or sponsorship events occurred during that period; and
• whether earlier controls should reasonably have detected it.

 

A short-lived isolated administrative error may present a different exposure from a control failure that has existed across several years.

 

11. Assess Whether the Finding Is Isolated or Systemic

 

This is one of the most important elements of risk grading.

The auditor should ask:

Did one person make one mistake?

Or did the organisation’s process produce the mistake?

A systemic problem may be indicated where:

 

• the same error appears across multiple worker files;
• different employees make the same mistake;
• a system is configured incorrectly;
• an escalation route does not exist;
• staff consistently misunderstand the same requirement;
• the organisation lacks ownership of the process; or
• a previous finding has recurred.

 

A repeated error should prompt investigation of the underlying control.

 

12. Assess the Quality of the Evidence

 

Risk grading should take account of how confidently the organisation can establish what happened.

Evidence may be:

 

• complete and contemporaneous;
• available across several consistent sources;
• partially complete;
• recoverable from another system;
• dependent on retrospective recollection;
• internally inconsistent; or
• unavailable.

 

A lack of evidence can itself create a record-keeping concern while also making it harder to determine the underlying facts.

The audit should distinguish:

“We have evidence that this did not happen”

from:

“We cannot establish whether this happened.”

Those are materially different findings.

 

13. Assess Whether the Worker Remained Compliant

 

Where the finding concerns a sponsored worker, the audit should consider whether the worker continued to satisfy the applicable sponsorship requirements.

This can involve examining:

 

• immigration status;
• role;
• duties;
• eligible-role requirements;
• occupation classification;
• salary;
• working hours;
• work location;
• absence;
• right to work; and
• other relevant conditions.

 

A record-keeping failure concerning a worker whose substantive employment remained compliant may present a different issue from a finding showing that the worker’s actual employment itself departed materially from the basis of sponsorship.

 

14. Assess Whether Home Office Action Was Required

 

The risk assessment should identify whether the underlying event required action by the sponsor.

This may include:

 

• an SMS report;
• a change to sponsor records;
• a change of employment application;
• a new sponsor licence application following a relevant corporate change;
• right to work action;
• another immigration application; or
• another step required by the sponsor guidance.

 

The audit should not assume that every historical discrepancy could have been resolved by submitting an SMS report.

The nature of the action that was required is relevant to assessing the finding.

 

15. Assess Reporting Delay in Context

 

Where reporting was late, the audit should establish how late it was and why.

Many specified worker changes are generally subject to a 10-working-day reporting framework, while specified organisational changes are generally subject to a 20-working-day reporting or action framework, subject to the particular requirement applying to the event.

The assessment should consider:

 

• the underlying event;
• the applicable deadline;
• the length of the delay;
• whether the sponsor eventually reported;
• whether the underlying position was otherwise compliant;
• why the delay occurred;
• whether similar reports were also late; and
• whether the reporting control has since been corrected.

 

This provides a more meaningful assessment than treating every late report as identical.

 

16. Assess Repeat Findings More Seriously

 

A finding that has previously been identified but remains unresolved or has recurred can indicate a governance or remediation weakness.

The audit should check:

 

• when the issue was previously identified;
• what remediation was agreed;
• whether the action was completed;
• whether it was verified;
• why the issue recurred; and
• whether management was aware of the continuing problem.

 

Repeat findings can demonstrate that the organisation’s previous remediation did not address the root cause.

 

17. Consider the Effectiveness of Existing Controls

 

The audit should consider whether other controls reduced or detected the problem.

For example:

 

• a manager failed to escalate a salary change, but payroll exception reporting identified it immediately;
• an incorrect expiry date was entered, but a secondary immigration review corrected it;
• a worker file was incomplete, but the missing evidence existed securely within another approved system; or
• a role change was initially missed, but a periodic HR-to-SMS reconciliation identified it promptly.

 

Effective secondary controls can be relevant to understanding the overall exposure.

However, they should not be used to ignore the primary control weakness that allowed the error to occur.

 

18. Consider Detectability

 

A useful internal risk consideration is whether the organisation’s normal controls would have identified the problem without the audit.

Ask:

Would this issue eventually have been detected?

Which control would have detected it?

How quickly?

Or was the audit the first realistic opportunity to identify it?

A weakness that can continue indefinitely without generating an alert may require stronger remediation than one reliably detected through an existing secondary control.

 

19. Consider the Likelihood of Recurrence

 

Risk grading should also consider whether the same issue is likely to happen again.

Recurrence may be more likely where:

 

• the root cause remains active;
• staff have not been trained;
• the relevant system remains unchanged;
• ownership remains unclear;
• the process depends on manual memory;
• the organisation is growing rapidly;
• the sponsored workforce is increasing;
• the relevant event occurs frequently; or
• previous remediation has already failed.

 

This helps prioritise preventive action as well as correction of historical cases.

 

20. Avoid False Numerical Precision

 

Some organisations use numerical risk scores. These can be useful where they form part of an established internal audit framework, but they should not create false precision.

For example, assigning a finding a score of 17 rather than 16 does not necessarily provide meaningful insight into sponsor compliance exposure.

Where numerical scoring is used, the methodology should remain transparent and should support rather than replace professional assessment.

The organisation should still be able to explain in words:

 

• what happened;
• why it matters;
• who is affected;
• whether it is continuing;
• what needs to be done; and
• why the remediation has the assigned priority.

 

21. Allow Risk Grades to Change

 

An initial risk grade should not become fixed if subsequent investigation changes the facts.

A finding may increase in significance where:

 

• additional affected workers are discovered;
• the issue is found to be continuing;
• the problem proves systemic;
• important evidence cannot be located;
• the substantive employment position is more serious than initially understood; or
• a previous related finding is discovered.

 

Conversely, a finding may be reduced where investigation establishes that:

 

• the apparent discrepancy has a documented explanation;
• contemporaneous evidence is located;
• the affected population is narrower than initially thought;
• the event was not reportable under the applicable rule; or
• another effective control addressed the issue at the relevant time.

 

The audit record should explain significant changes in grading.

 

22. Link Risk Grade to Remediation Priority

 

The risk grade should influence how quickly and at what level a finding is addressed.

A practical internal framework can be:

 

Internal Grade	Typical Management Response
Critical	Immediate escalation, urgent factual and legal assessment, containment where appropriate, senior ownership and accelerated remediation
Material	Prompt remediation, named owner, defined deadline, management visibility and formal verification
Control Weakness	Planned corrective action to strengthen the process and prevent future non-compliance
Improvement	Enhancement to governance, evidence, efficiency or resilience

 

This table is an internal management framework and does not represent Home Office classifications or enforcement thresholds.

 

23. Link Risk Grade to Escalation

 

The organisation should define which findings require escalation to different levels of management.

For example, higher-risk findings may need to be reported to:

 

• the Authorising Officer;
• senior HR leadership;
• legal or compliance personnel;
• executive management;
• the board or relevant governance committee; or
• external immigration advisers.

 

The escalation model should reflect the organisation’s size and governance structure.

The important point is that significant sponsor licence exposure should not remain confined to the individual who discovered it.

 

24. Link Risk Grade to Re-Testing

 

Higher-risk findings should generally receive more intensive verification after remediation.

For example:

 

• a Critical finding may justify immediate re-testing after corrective action and further follow-up testing;
• a Material finding may require formal evidence review and transactional re-testing;
• a Control Weakness may be tested when the revised process has operated through sufficient real events; and
• an Improvement may be reviewed through the normal audit programme.

 

The purpose is to confirm that the risk has actually been reduced rather than merely recording that an action was completed.

 

25. Record the Reason for the Risk Grade

 

Every material risk grade should have a clear rationale.

The audit record can state:

 

• the requirement affected;
• the facts established;
• the evidence available;
• the affected population;
• the duration;
• whether the issue is continuing;
• whether it is isolated or systemic;
• the root cause;
• the potential compliance exposure;
• the internal grade assigned; and
• the reason for that grade.

 

This allows another reviewer to understand how the organisation reached its assessment.

 

26. Do Not Confuse Internal Risk Grades with Home Office Outcomes

 

Internal risk grading should remain separate from any assessment the Home Office may make.

The Home Office applies the sponsor guidance and its own compliance and enforcement processes to the facts before it.

Depending on the circumstances, Home Office action can include measures such as:

 

• reducing or setting a Certificate of Sponsorship allocation to zero;
• downgrading a sponsor licence;
• suspending a sponsor licence;
• revoking a sponsor licence; or
• referring relevant matters to other authorities.

 

An internal finding labelled Critical does not mean that licence revocation would necessarily follow.

Equally, an organisation should not assume that a finding given a lower internal grade could never be relevant to a Home Office assessment.

The internal framework exists to help the organisation manage its own compliance response.

 

27. Example Sponsor Audit Risk-Grading Framework

 

Assessment Factor	Questions to Consider
Requirement	Which sponsor or related compliance requirement is affected?
Substantive position	Does the underlying employment remain compliant?
Population	How many workers or processes are affected?
Duration	How long has the issue existed?
Current status	Is the problem continuing?
Systemic nature	Is this an isolated error or a control failure?
Evidence	Can the organisation establish what happened?
Required action	Was reporting, immigration action or another step required?
Previous findings	Has the issue happened before?
Detectability	Would existing controls have found the problem?
Recurrence	Could the same problem happen again?
Remediation	Can the issue be corrected and the control strengthened?

 

28. The Risk-Grading Test

 

Before assigning the final internal risk grade, the organisation should be able to answer:

What requirement is affected?

What actually happened?

How strong is the evidence?

How many workers are affected?

How long has the problem existed?

Is it still continuing?

Is it isolated or systemic?

Does the underlying sponsored employment remain compliant?

Was Home Office reporting or another immigration action required?

Has the same problem happened before?

Would existing controls have detected it?

How likely is recurrence?

What action is required now?

The final internal grade should support a practical decision about remediation:

Finding → Evidence → Scope → Exposure → Risk Grade → Owner → Action → Verification

Used consistently, risk grading helps the organisation direct attention and resources towards the sponsor compliance issues that require the most urgent and effective response without attempting to substitute an internal audit label for the Home Office’s own assessment.

 

 

Back to top

 

Section Q: Creating a Sponsor Compliance Remediation Plan

 

A sponsor compliance audit should result in a structured remediation plan where weaknesses or breaches have been identified. The plan should convert audit findings into specific actions, assign responsibility, set appropriate deadlines and provide a mechanism for verifying that the underlying problem has actually been resolved.

A remediation plan should answer six questions for every material finding:

What went wrong? → What needs to change? → Who owns it? → By when? → What evidence proves completion? → How will effectiveness be verified?

The objective is not simply to close audit actions. It is to reduce the risk of the same sponsor compliance failure recurring.

 

1. Create a Central Remediation Tracker

 

All material findings should be recorded within a central remediation tracker.

The tracker can include:

 

• finding reference;
• audit area;
• applicable requirement;
• description of the finding;
• supporting evidence;
• affected worker or population;
• internal risk grade;
• root cause;
• immediate corrective action;
• longer-term control remediation;
• action owner;
• target completion date;
• interim controls;
• current status;
• completion evidence;
• verification method;
• re-test result; and
• formal closure date.

 

This provides a single record showing how each audit finding moved from identification through remediation to verified closure.

 

2. Link Every Action to a Specific Finding

 

Remediation should remain traceable to the underlying audit finding.

For example:

Finding: Salary reductions affecting sponsored workers are not consistently escalated to the sponsorship team.

Case action: Review affected workers and determine whether salary, reporting or other sponsorship action is required.

Control action: Introduce a mandatory payroll-to-sponsorship escalation process for relevant salary reductions.

Verification: Test subsequent salary changes to confirm the new process operates effectively.

This structure is stronger than recording a generic action such as “improve payroll compliance”.

 

3. Separate Immediate Correction from System Remediation

 

Many findings require two levels of action.

The first is correcting the individual case.

The second is correcting the system that allowed the problem to occur.

The remediation plan should therefore distinguish:

Case Correction + Control Correction

For example:

 

Finding	Case Correction	Control Correction
Missing contact history	Recover legitimate historical information where possible	Change HR process so previous contact details are preserved
Late role-change assessment	Assess affected worker’s current sponsorship position	Add sponsorship assessment to promotion and transfer workflows
Salary reduction not escalated	Review affected worker’s pay and applicable requirements	Create payroll-to-sponsorship escalation trigger
Missing follow-up right to work check	Establish current right to work position and take appropriate action	Repair immigration expiry and follow-up monitoring
Late leaver report	Assess and address the affected sponsorship record	Integrate sponsorship notification into the leaver process

 

A remediation plan that corrects worker files without addressing the underlying control can leave the organisation exposed to the same problem recurring.

 

4. Prioritise Findings According to Risk

 

The remediation plan should reflect the internal risk assessment.

Higher-risk findings may require:

 

• immediate escalation;
• urgent factual investigation;
• specialist legal assessment;
• immediate protective action;
• temporary controls;
• senior management ownership;
• accelerated remediation; and
• early re-testing.

 

Lower-risk control improvements can be managed through a longer-term compliance improvement programme.

Prioritisation should be based on actual exposure rather than the ease with which an action can be completed.

 

5. Deal with Continuing Problems First

 

Where a compliance problem is still operating, the remediation plan should identify what can be done immediately to contain or address the continuing exposure.

Examples can include:

 

• reviewing a worker currently performing potentially different duties;
• assessing an ongoing salary issue;
• addressing inappropriate SMS access;
• reviewing an unresolved right to work issue;
• correcting a defective immigration expiry process;
• addressing an ongoing absence issue;
• reviewing a corporate change with unresolved sponsor consequences; or
• introducing an interim manual control while a defective system is repaired.

 

The organisation should not postpone a continuing material issue simply because the wider remediation programme will take several months.

 

6. Define Specific Remediation Actions

 

Each action should describe what actually needs to be done.

Weak actions include:

 

• “improve compliance”;
• “review process”;
• “train staff”;
• “update files”;
• “monitor more closely”; or
• “ensure reporting is timely”.

 

More effective actions are specific.

For example:

 

• add a mandatory sponsored-worker flag to the payroll system;
• introduce immigration review before sponsored-worker promotions take effect;
• configure the HR system to preserve previous contact details;
• introduce a monthly reconciliation between HR and the SMS;
• add sponsorship assessment to the corporate transaction checklist;
• create automated immigration-expiry alerts with named escalation owners;
• review and remove inappropriate SMS access;
• introduce secondary review of sponsored-worker salary reductions; or
• create an absence escalation trigger for sponsored workers.

 

Specific actions are easier to implement, monitor and verify.

 

7. Assign a Named Owner

 

Every material remediation action should have a clearly identified owner.

Depending on the finding, responsibility may sit with:

 

• the Authorising Officer;
• a Level 1 User;
• HR;
• payroll;
• recruitment;
• legal or compliance;
• IT or systems personnel;
• finance;
• a line manager;
• corporate personnel; or
• senior management.

 

Where possible, the tracker should identify a named individual rather than a department alone.

This reduces the risk of responsibility becoming diffused between teams.

 

8. Separate Action Ownership from Oversight

 

The individual responsible for implementing an action does not necessarily need to be the person responsible for overseeing the remediation programme.

For example:

Payroll Manager → implements salary escalation control

Level 1 User → tests sponsorship operation

Authorising Officer → oversees closure of material finding

This can provide stronger governance than allowing the same individual to identify, remediate and approve closure of every issue.

 

9. Set Realistic Deadlines

 

Each action should have a target completion date reflecting the nature of the risk and the work required.

Deadlines should take account of:

 

• whether the problem is continuing;
• the internal risk grade;
• the number of workers affected;
• whether immediate action is required;
• system-development requirements;
• dependencies on other teams;
• availability of evidence;
• the need for specialist advice; and
• the time required to test the revised process.

 

A deadline should be challenging enough to drive remediation without being so unrealistic that actions routinely become overdue.

 

10. Introduce Interim Controls Where Necessary

 

Some permanent solutions take time to implement.

Where a material risk remains during that period, the organisation should consider an appropriate interim control.

Examples can include:

 

• manual immigration-expiry monitoring while an automated system is repaired;
• manual review of all sponsored-worker salary changes;
• temporary central approval of sponsored-worker promotions;
• manual reconciliation of work locations;
• additional review of right to work evidence;
• weekly review of relevant absence cases; or
• temporary secondary review of SMS reporting.

 

Interim controls should themselves have:

 

• an owner;
• a start date;
• a defined process;
• evidence of operation; and
• an end or review point.

 

A temporary control should not quietly become an unmanaged permanent process.

 

11. Define Completion Evidence in Advance

 

The remediation plan should identify what evidence will demonstrate that an action has been completed.

For example:

 

Remediation Action	Possible Completion Evidence
Revise promotion workflow	Updated workflow, system configuration and approval process
Repair expiry monitoring	System configuration and successful alert testing
Remove inappropriate SMS access	Current SMS user review and access evidence
Introduce manager training	Training materials, attendance and knowledge testing
Preserve contact history	HR-system configuration and test worker history
Introduce payroll escalation	Documented process and evidence from a subsequent salary event

 

Defining the evidence in advance makes it harder for actions to be closed simply because somebody states that they have been completed.

 

12. Distinguish Completion from Effectiveness

 

An action can be completed without solving the underlying problem.

For example:

 

• a new policy can be issued but ignored;
• training can be delivered but not understood;
• an alert can be configured but sent to the wrong person;
• a workflow can be introduced but bypassed by managers;
• a new spreadsheet can be created but not maintained; or
• an SMS user can be appointed but not understand the role.

 

The remediation plan should therefore distinguish:

Implementation Evidence

from:

Effectiveness Evidence

Both may be required before a material finding is closed.

 

13. Review the Wider Affected Population

 

Where a finding resulted from a systemic control weakness, remediation should include review of the population that may have been affected.

For example, if the audit identifies that salary reductions were not escalated during a particular period, the organisation may need to identify:

 

• all sponsored workers during that period;
• which workers experienced salary changes;
• which changes were reductions;
• which were associated with reduced hours or absence;
• whether applicable salary requirements remained satisfied;
• whether reporting was required; and
• whether any further action is necessary.

 

Correcting only the first case discovered can leave similar historical problems unidentified.

 

14. Reconstruct Historical Records Carefully

 

Where remediation involves missing historical records, the organisation should distinguish between recovering legitimate evidence and creating a misleading historical record.

The remediation record should state:

 

• what was missing;
• what searches were undertaken;
• what existing evidence was recovered;
• what information has been reconstructed;
• the source used for reconstruction;
• when reconstruction occurred; and
• what future control has been introduced.

 

Documents should not be backdated or altered to suggest that evidence existed contemporaneously when it did not.

 

15. Update Policies Where the Process Has Changed

 

Where remediation changes an operational process, relevant policies and procedures should be updated to reflect the revised control.

This can include procedures relating to:

 

• recruitment;
• onboarding;
• right to work;
• immigration expiry monitoring;
• absence;
• promotions;
• salary changes;
• working hours;
• work locations;
• leavers;
• SMS administration;
• corporate changes; and
• sponsor reporting.

 

The written procedure should describe the process that staff are actually expected to follow.

 

16. Use Targeted Training

 

Training should respond to the cause of the finding rather than automatically requiring the entire organisation to attend generic sponsor compliance training.

For example:

 

• line managers may need training on escalation triggers;
• payroll may need training on sponsored-worker salary changes;
• HR may need training on role, location and absence changes;
• recruitment may need training on sponsorship onboarding and recruitment evidence;
• SMS users may need updated reporting and security training; and
• senior management may need awareness of corporate-change implications.

 

Targeted training is more likely to change behaviour because it connects sponsor compliance to the decisions individuals actually make.

 

17. Test Whether Training Changed Behaviour

 

Training attendance should not automatically close a finding.

The organisation should test whether relevant staff can apply what they learned.

This can involve:

 

• scenario testing;
• knowledge checks;
• manager interviews;
• review of subsequent employment changes;
• testing later payroll events;
• reviewing later absence cases; or
• checking whether escalation routes are being used.

 

The assurance chain is:

Training → Understanding → Behaviour → Evidence

 

18. Strengthen Escalation Routes

 

Where the root cause is a communication failure, remediation should define when and how information reaches the sponsorship function.

For example:

Manager → HR → Sponsorship

Payroll → HR → Sponsorship

Recruitment → HR → Sponsorship

Corporate Team → Sponsorship

Worker → Manager/HR → Sponsorship

The process should identify:

 

• the trigger event;
• who first receives the information;
• who must be notified;
• how quickly escalation must occur;
• how escalation is evidenced; and
• who acts if the normal owner is unavailable.

 

19. Build Preventive Controls into Business Processes

 

The strongest remediation can prevent a compliance-sensitive event from progressing without appropriate assessment.

Examples include:

 

• a sponsorship review field within promotion approval;
• a sponsored-worker flag within payroll;
• immigration review within location-change workflows;
• automated expiry alerts;
• absence threshold alerts;
• mandatory sponsorship notification within leaver processes;
• SMS access review within employee offboarding; and
• immigration review within merger and acquisition checklists.

 

Embedding sponsor compliance within ordinary business processes is generally more resilient than relying on staff to remember separate immigration procedures.

 

20. Escalate Overdue Remediation

 

The remediation tracker should identify overdue actions and provide an escalation mechanism.

For each overdue material action, establish:

 

• why the deadline was missed;
• whether the underlying risk remains active;
• whether an interim control exists;
• whether additional resources are required;
• whether the owner remains appropriate;
• whether the target date needs formal revision; and
• whether senior management needs to be informed.

 

Repeatedly extending deadlines without addressing the underlying obstacle can itself indicate weak compliance governance.

 

21. Re-Test Remediated Findings

 

Material remediation should be re-tested before formal closure.

Re-testing should use evidence appropriate to the original finding.

For example:

 

• test subsequent promotions after changing the role-change process;
• test subsequent salary changes after introducing payroll escalation;
• test later absences after changing absence monitoring;
• review a new sponsored worker after revising onboarding;
• test contact-detail changes after changing HR-system functionality;
• review subsequent SMS reports after improving reporting controls; and
• test system access after revising SMS-user governance.

 

The objective is to demonstrate that the revised control works in operational conditions.

 

22. Define Formal Closure Criteria

 

A material audit finding should not be closed simply because its target date has passed or the action owner reports completion.

Closure criteria can include:

 

• case-level corrective action completed;
• affected population reviewed where necessary;
• root cause addressed;
• permanent control implemented;
• interim controls withdrawn appropriately;
• relevant policy updated;
• relevant staff trained;
• completion evidence retained;
• effectiveness verified;
• re-testing passed; and
• appropriate management approval obtained.

 

The precise closure requirements should reflect the risk and nature of the finding.

 

23. Maintain an Audit Trail of Closure

 

The organisation should retain a clear record showing why a finding was considered resolved.

The closure record can include:

 

• original finding;
• risk grade;
• root cause;
• actions taken;
• completion dates;
• supporting evidence;
• re-test methodology;
• re-test results;
• residual issues;
• closure approval; and
• future monitoring requirements.

 

This allows the organisation to demonstrate that audit findings were actively managed rather than simply removed from an action list.

 

24. Report Remediation Progress to Management

 

Material remediation should be visible to appropriate management.

Management information can include:

 

• number of open findings;
• findings by internal risk grade;
• overdue actions;
• Critical or Material findings;
• repeat findings;
• systemic issues;
• remediation completion rates;
• failed re-tests;
• significant emerging risks; and
• areas requiring additional resources or decisions.

 

The purpose is not to create reporting for its own sake. It is to ensure those responsible for sponsor governance can see whether material compliance weaknesses are being resolved.

 

25. Use Remediation Findings to Shape Future Audits

 

The remediation programme should inform future sponsor compliance audits.

Areas with:

 

• significant previous findings;
• repeat failures;
• failed remediation;
• high volumes of sponsored workers;
• frequent employment changes;
• complex payroll arrangements;
• significant organisational change; or
• heavy dependence on manual controls

 

may justify more frequent or deeper testing.

This creates a risk-based audit programme rather than repeating the same audit scope regardless of previous findings.

 

26. Preserve Evidence of Compliance Improvement

 

The remediation programme itself can become important evidence of sponsor governance.

The organisation should be able to demonstrate:

We identified the problem.

We established its scope.

We assessed the cause.

We corrected affected cases.

We changed the control.

We verified that the control works.

We continue to monitor it.

This is stronger than simply showing that an internal audit once took place.

 

27. The Sponsor Compliance Remediation Cycle

 

A mature sponsor compliance programme should treat remediation as part of a continuing assurance cycle:

Test → Find → Risk-Grade → Remediate → Verify → Monitor → Re-Test

Each stage serves a different purpose:

 

• Test — examine records, systems and operational reality;
• Find — identify discrepancies, breaches and control weaknesses;
• Risk-Grade — determine significance and priority;
• Remediate — correct the case and underlying control;
• Verify — establish that remediation has been implemented effectively;
• Monitor — check that the control continues to operate; and
• Re-Test — confirm through future audit activity that the weakness has not returned.

 

This prevents the compliance audit from becoming a one-off exercise.

 

28. The Remediation Plan Test

 

Before closing the remediation programme, the organisation should be able to answer:

Does every material finding have a defined action?

Have we corrected the affected case?

Have we addressed the root cause?

Have we reviewed the wider affected population where necessary?

Does every action have a named owner?

Does every action have an appropriate deadline?

Are interim controls operating where permanent remediation is not yet complete?

Do we have evidence that each action was implemented?

Have relevant policies and processes been updated?

Have relevant personnel been trained?

Have we tested whether the revised control actually works?

Are overdue actions escalated?

Have material findings been formally re-tested before closure?

Can we demonstrate the complete remediation history?

The final assurance chain should be:

Requirement → Finding → Root Cause → Action → Owner → Evidence → Verification → Closure → Monitoring

A structured remediation plan ensures that sponsor compliance audit findings lead to measurable improvements in the organisation’s systems rather than becoming a list of problems that gradually disappears into an audit report.

 

 

Back to top

 

Section R: Preparing for a Home Office Compliance Visit

 

A sponsor licence compliance audit can form an important part of preparing for possible Home Office scrutiny. It allows the organisation to identify weaknesses internally, correct problems where appropriate and test whether its records, people and systems accurately reflect the reality of its sponsored workforce.

An internal sponsor compliance audit and a Home Office compliance visit are not the same process.

Internal Compliance Audit = The Sponsor Tests Itself

Home Office Compliance Visit = The Home Office Tests the Sponsor

Detailed Home Office compliance visit procedure, including how visits are conducted and what can happen following a visit, should be considered separately. The purpose of this section is to explain how internal audit work can improve compliance visit readiness.

 

1. Maintain Readiness Before a Visit Is Announced

 

The strongest approach is to maintain sponsor compliance on an ongoing basis rather than attempting to create compliance readiness only after Home Office scrutiny becomes likely.

An organisation should be capable of demonstrating, through its ordinary systems:

 

• who it sponsors;
• why those workers are sponsored;
• what roles they perform;
• where they work;
• what they are paid;
• what hours they work;
• their current immigration status;
• how their attendance and absence are monitored;
• how relevant changes are identified;
• how sponsor reporting is managed;
• how required records are retained; and
• who is responsible for sponsor compliance.

 

Compliance visit preparation should therefore be an extension of normal sponsor governance rather than a separate emergency exercise.

 

2. Complete the Internal Audit Before Focusing on Presentation

 

Where a Home Office compliance visit is known or anticipated, the priority should be establishing the organisation’s actual compliance position.

The organisation should resist the temptation to begin by reorganising files or preparing staff responses without first determining whether substantive problems exist.

The preparation sequence should be:

Audit → Establish Facts → Identify Findings → Remediate → Verify → Prepare for Scrutiny

This ensures that visit preparation is based on the real compliance position.

 

3. Review Outstanding Audit Findings

 

Before a compliance visit, review all open sponsor compliance findings.

For each finding, establish:

 

• what the issue is;
• which requirement is affected;
• which workers or processes are affected;
• whether the issue is continuing;
• its internal risk grade;
• what remediation has been completed;
• what remains outstanding;
• whether an interim control exists;
• who owns the action; and
• when permanent remediation will be completed.

 

An open finding should not simply be removed from an audit tracker because a compliance visit is approaching.

The organisation should understand and be able to evidence its actual status.

 

4. Verify Sponsor Licence Information

 

Check that the organisation’s sponsor licence information remains accurate.

This should include, where relevant:

 

• organisation details;
• addresses;
• branches;
• key personnel;
• Authorising Officer;
• Key Contact;
• Level 1 Users;
• remaining Level 2 Users during the applicable transitional period;
• SMS user contact information;
• relevant corporate information; and
• other information maintained through the sponsor licence.

 

Any discrepancy should be investigated to determine whether an update or report was required and, if so, whether it was completed within the applicable framework.

 

5. Review Key Personnel & SMS Access

 

Compliance visit preparation should include a current review of SMS users and access controls.

Test:

 

• whether each user is still appropriate;
• whether former employees retain access;
• whether user contact information is current;
• whether access reflects actual responsibilities;
• whether multi-factor authentication requirements are being followed;
• whether credentials or one-time passcodes are being shared;
• whether remaining Level 2 Users are being managed under the transitional arrangements;
• whether any SMS accounts are inactive or at risk of becoming inactive;
• whether Level 1 access is being maintained in line with current Home Office recommendations; and
• whether adequate active Level 1 User cover exists.

 

The control should remain:

Correct Individual → Individual Account → Current Contact Details → MFA → Appropriate Access → No Credential Sharing

 

6. Confirm the Sponsored Worker Population

 

The organisation should be able to identify its current sponsored workforce accurately.

The population should be reconciled across relevant systems, including:

 

• SMS records;
• HR records;
• payroll;
• immigration records;
• right to work records;
• departmental records; and
• leaver information.

 

Investigate workers appearing in one system but not another.

The organisation should also understand relevant historical sponsored worker records where these remain within applicable retention requirements.

 

7. Test a Sample of Sponsored Worker Files

 

Do not assume that files are compliant because documents exist within them.

Sample testing should establish whether the file tells a consistent story.

For each worker tested, consider:

CoS → Immigration Status → Contract → Actual Duties → Salary → Payroll → Hours → Work Location → Attendance → SMS

The information should be reconciled rather than reviewed as separate documents.

Where one file identifies a potentially systemic problem, expand testing across the relevant population.

 

8. Check Appendix D Records

 

Review whether required sponsor records are available and retrievable in accordance with Appendix D.

Depending on the worker and circumstances, this can include relevant evidence relating to:

 

• right to work;
• immigration status;
• date of entry where required;
• UK residential address history;
• personal email address history;
• telephone number history;
• absence;
• recruitment;
• employment;
• salary; and
• other records required under the sponsor guidance.

 

For sponsored-worker records, applicable Appendix D retention requirements should be checked. Unless otherwise specified, relevant documents are generally retained throughout sponsorship until the earlier of one year after sponsorship ends or the date on which a compliance officer has examined and approved them, where that occurs sooner after sponsorship ends.

Other legal or regulatory requirements may require documents to be retained for longer.

 

9. Check Date-of-Entry Evidence

 

Where current permission resulted from entry clearance sponsored by the organisation, check whether the required evidence establishing entry during the relevant validity period is available.

This should be considered separately from the right to work check.

With the move towards eVisas and the 2026 phasing out of physical entry-clearance vignettes in relevant cases, the organisation should ensure its onboarding process captures appropriate evidence under the current Appendix D requirements.

If evidence is missing historically, investigate whether legitimate contemporaneous or alternative travel evidence can be recovered.

 

10. Review Right to Work Compliance

 

Check right to work evidence across an appropriate sample of the workforce and sponsored worker population.

The review should establish:

 

• which prescribed checking method applied;
• whether the correct process was followed;
• whether the check was completed at the correct time;
• whether identity was verified appropriately;
• whether the permission allowed the work undertaken;
• whether restrictions were considered;
• whether evidence was retained;
• whether follow-up checks were required; and
• whether immigration expiry monitoring operated correctly.

 

Under the right to work framework applying from 1 October 2026, the applicable checking methods can include the Home Office online service, an appropriate Right to Work Digital Verification Service Provider or a manual document check, depending on the individual’s circumstances and the evidence available.

For sponsored workers using an online check, ensure the appropriate GOV.UK right to work checking service has been used and that the required evidence is retained.

 

11. Reconcile Salary & Payroll

 

Salary information should be tested against actual payroll rather than relying solely on the CoS or employment contract.

Reconcile:

CoS → Contract → HR → Working Hours → Payroll → Payslips

Investigate:

 

• salary reductions;
• changes in working hours;
• unpaid leave;
• reduced-pay absence;
• unexplained deductions;
• payroll anomalies;
• promotions;
• salary changes associated with role changes; and
• periods where actual pay differs from expected pay.

 

The organisation should understand the reason for any discrepancy and whether it had sponsorship implications.

 

12. Verify Actual Roles & Duties

 

Compliance readiness requires more than ensuring that the job title on the HR system matches the CoS.

The audit should establish what sponsored workers actually do.

Compare:

 

• CoS role;
• employment contract;
• current job description;
• actual duties;
• occupation classification;
• manager evidence;
• worker evidence;
• salary;
• working hours; and
• departmental structure.

 

The organisation should be able to demonstrate that the substantive sponsored role continues to meet the applicable requirements, including the current eligible-role framework.

 

13. Review Promotions & Internal Transfers

 

Review promotions, internal transfers and significant changes in duties affecting sponsored workers.

For each relevant change, determine:

 

• what changed;
• when it changed;
• whether sponsorship personnel were informed;
• whether the occupation classification remained appropriate;
• whether the role remained eligible;
• whether salary and hours remained compliant;
• whether an SMS report was required; and
• whether the change was significant enough to engage the change of employment requirements.

 

Do not assume that every historical role change can be resolved through an SMS update.

 

14. Verify Work Locations

 

Check where sponsored workers actually perform their roles.

Compare:

 

• CoS information;
• SMS information;
• employment contracts;
• HR records;
• manager evidence;
• worker evidence;
• branch records;
• client-site arrangements; and
• remote or hybrid working arrangements.

 

Distinguish ordinary hybrid working and day-to-day variations from substantive changes in normal work location that may require sponsor assessment or reporting.

Particular attention may be appropriate where a worker has moved permanently to another branch, begun working at a new client site or moved to permanent full-time remote working with little or no workplace attendance.

 

15. Review Attendance & Absence Monitoring

 

The organisation should be able to demonstrate how sponsored worker attendance and absence are monitored.

Test:

 

• where absence is recorded;
• who monitors it;
• whether records are retained;
• how unauthorised absence is identified;
• how extended absence is escalated;
• how unpaid or reduced-pay absence reaches payroll and sponsorship personnel;
• whether separate absence periods can be aggregated where necessary; and
• how required sponsor action is identified.

 

The sponsor guidance includes reporting requirements relating to unauthorised absence for more than 10 consecutive working days.

It also contains provisions relating to absence without pay or on reduced pay for more than four weeks in total in a calendar year, subject to applicable exceptions and route-specific provisions.

 

16. Review Sponsor Reporting History

 

Review SMS reporting activity against actual employment and organisational events.

Do not limit the review to reports that appear on the SMS.

Instead, identify relevant events independently and trace them forward:

Event → Identification → Escalation → Assessment → Action → Evidence

Potential events include:

 

• employment start or non-start;
• leavers;
• role changes;
• salary changes;
• working-hours changes;
• work-location changes;
• relevant absence;
• changes affecting immigration status;
• key personnel changes; and
• organisational changes.

 

This approach can identify events that should have been assessed but never reached the SMS team.

 

17. Check Reporting Timescales

 

Where reports were required, compare the underlying event date with the reporting date.

Many specified sponsored worker changes are generally subject to a 10-working-day reporting framework, while specified organisational changes are generally subject to a 20-working-day reporting or action framework.

The specific requirement should always be checked for the particular event.

Where reporting was late, understand why and whether the same control weakness could affect other cases.

 

18. Review Corporate Changes

 

Consider whether the organisation has undergone relevant corporate changes during the review period.

This can include:

 

• mergers;
• acquisitions;
• takeovers;
• changes in direct ownership;
• demergers;
• TUPE transfers;
• restructuring;
• branch changes; and
• relevant insolvency events.

 

Some corporate events can have consequences extending beyond an SMS update and may require a new sponsor licence application.

Sponsor licences are not transferable.

Potentially unresolved corporate-change issues should therefore be assessed carefully before a Home Office compliance visit.

 

19. Test Evidence Retrieval

 

Compliance visit readiness depends not only on whether evidence exists but whether the organisation can retrieve it reliably.

Test whether relevant personnel can locate:

 

• worker files;
• right to work evidence;
• immigration records;
• CoS information;
• contracts;
• job descriptions;
• payroll evidence;
• absence records;
• contact-detail histories;
• recruitment evidence;
• reporting evidence;
• corporate records; and
• previous compliance documentation.

 

If documents technically exist but cannot be located without extensive searching or dependence on one employee, the organisation should consider whether its evidence-management controls are sufficiently reliable.

 

20. Test Key Personnel Understanding

 

Key personnel should understand their genuine responsibilities and how the organisation operates its sponsor licence.

The Authorising Officer should be able to explain the governance framework, while Level 1 Users should understand the operational functions relevant to their roles.

Questions can test:

 

• responsibilities;
• SMS administration;
• reporting;
• escalation routes;
• worker monitoring;
• record keeping;
• access security;
• business continuity;
• significant audit findings; and
• how compliance assurance is obtained.

 

The objective is genuine understanding rather than memorisation of prepared responses.

 

21. Test Managers’ Understanding

 

Managers of sponsored workers should know which operational changes need to be escalated.

Scenario testing can include:

 

• a worker is promoted;
• their duties change;
• their hours change;
• they move location;
• they begin permanent remote working;
• they are absent without permission;
• they take extended unpaid leave;
• they stop attending work; or
• their employment is ending.

 

Managers do not necessarily need detailed knowledge of sponsor reporting rules. They should understand the organisation’s escalation process.

 

22. Test Sponsored Worker Evidence

 

A sample of sponsored workers can be used to test whether employment reality corresponds with the sponsor’s records.

Relevant factual areas can include:

 

• job title;
• actual duties;
• line manager;
• department;
• salary;
• working hours;
• normal work location;
• remote or hybrid arrangements;
• recent employment changes; and
• absence arrangements.

 

Sponsored workers should not need to demonstrate detailed knowledge of sponsor licence law.

The purpose is to verify the factual reality of their employment.

 

23. Compare Independent Sources

 

Compliance visit preparation should test whether different evidence sources tell the same substantive story.

For example:

CoS says → Contract says → HR says → Payroll says → Manager says → Worker says → SMS says

Perfectly identical wording is neither necessary nor expected.

The concern is substantive inconsistency.

If the CoS describes one role, payroll reflects a different working arrangement, the manager describes materially different duties and the worker confirms another position, the organisation should investigate before Home Office scrutiny.

 

24. Do Not Artificially Coach Staff

 

Preparation should ensure staff understand their actual responsibilities and processes. It should not involve scripting answers intended to create an appearance of compliance.

Instead:

 

• clarify responsibilities;
• correct inaccurate procedures;
• provide necessary training;
• explain escalation routes;
• ensure staff can retrieve relevant evidence;
• address genuine knowledge gaps; and
• test understanding through realistic scenarios.

 

Where staff give inconsistent answers during the internal audit, investigate why.

The solution should be to correct the underlying process or knowledge gap rather than teach everybody to repeat the same answer.

 

25. Do Not Create a False Historical Record

 

A known compliance visit can create pressure to make files appear complete.

The organisation should not:

 

• backdate documents;
• alter historical records misleadingly;
• create false absence records;
• invent recruitment evidence;
• backdate right to work checks;
• fabricate reporting decisions;
• rewrite payroll history inaccurately; or
• ask staff or workers to give misleading accounts.

 

Where legitimate historical evidence is recovered or records are reconstructed from reliable sources, the audit trail should accurately explain what was done and when.

 

26. Review Previous Remediation

 

If the organisation has previously undertaken compliance audits, mock audits or remedial work, review whether the resulting actions were actually effective.

Test:

Previous Finding → Agreed Action → Implementation → Evidence → Verification → Current Position

Particular attention should be given to repeat findings.

A problem that was previously identified but has returned may indicate that the original remediation addressed the symptom rather than the root cause.

 

27. Create a Compliance Evidence Map

 

For larger or more complex sponsors, an evidence map can help demonstrate where relevant compliance information is held and who owns it.

For example:

 

Compliance Area	Primary Evidence Source	Responsible Function
Sponsored worker population	SMS and HR system	HR / Sponsorship
Right to work	Right to work records	HR
Salary	Payroll and employment records	Payroll / HR
Role and duties	CoS, job description and manager records	HR / Manager / Sponsorship
Absence	HR or attendance system	HR / Managers
Work location	HR and operational records	HR / Managers
Sponsor reporting	SMS and internal reporting records	Level 1 Users
Immigration expiry	HR or immigration monitoring system	HR / Sponsorship
Corporate changes	Corporate and governance records	Legal / Finance / Senior Management

 

The map can also expose areas where responsibility or evidence ownership is unclear.

 

28. Coordinate Across Departments

 

Sponsor compliance is rarely controlled by the immigration or HR team alone.

Compliance visit preparation may require coordination between:

 

• HR;
• recruitment;
• payroll;
• finance;
• line management;
• legal;
• compliance;
• IT or systems teams;
• corporate teams; and
• senior management.

 

Each function should understand the information it owns and how that information connects with sponsor compliance.

 

29. Test Business Continuity

 

The organisation should consider what would happen if the person who normally manages sponsorship were unavailable on the day compliance evidence was required.

Test whether:

 

• appropriate alternative personnel exist;
• records are centrally accessible;
• SMS access remains secure and operational;
• reporting can continue;
• immigration expiry monitoring continues;
• Home Office correspondence is monitored;
• compliance issues can still be escalated; and
• the organisation does not depend on shared credentials.

 

Business continuity is particularly important where sponsor compliance has historically depended on one individual.

 

30. Keep an Accurate Record of Outstanding Issues

 

Not every remediation project will necessarily be complete before a compliance visit.

Where an issue remains open, the organisation should know:

 

• what the issue is;
• when it was identified;
• its current status;
• what action has already been taken;
• what remains outstanding;
• who owns it;
• whether an interim control exists;
• the target completion date; and
• how final remediation will be verified.

 

A controlled and evidenced remediation programme is different from an unidentified or unmanaged compliance failure.

 

31. Avoid Last-Minute Cosmetic Compliance

 

Compliance visit preparation should not focus on making records look orderly while leaving substantive weaknesses unresolved.

Examples of cosmetic preparation include:

 

• reformatting policies that staff do not follow;
• reorganising files without checking their contents;
• briefing staff with scripted answers;
• correcting current HR data without investigating historical discrepancies;
• creating checklists that have never operated in practice; or
• closing audit findings without verification.

 

The stronger approach is to establish the true position, correct what can properly be corrected and retain an accurate audit trail.

 

32. Test the Organisation Through a Mock Audit

 

A mock sponsor compliance audit can be used to test whether the organisation can demonstrate compliance under realistic conditions.

Testing can include:

 

• selecting worker files without advance notice;
• requesting documents from relevant systems;
• reconciling HR, payroll and SMS information;
• asking Level 1 Users to demonstrate relevant processes;
• interviewing managers;
• interviewing sponsored workers;
• testing reporting scenarios;
• testing evidence retrieval;
• reviewing current audit findings; and
• checking whether previous remediation remains effective.

 

The objective should be to expose weaknesses internally rather than create a rehearsed performance.

 

33. Understand the Boundary with the Home Office Compliance Visit

 

This internal audit should prepare the organisation to demonstrate genuine sponsor compliance, but it should not attempt to duplicate every procedural aspect of a Home Office inspection.

Detailed matters such as:

 

• how Home Office compliance officers conduct visits;
• the detailed interview process;
• the scope of officer questioning;
• the Home Office’s post-visit assessment;
• potential action plans;
• licence suspension procedure; and
• post-visit Home Office decision-making

 

belong within the dedicated Home Office compliance visit guidance.

The compliance audit page should remain focused on the sponsor’s internal preparation, testing and remediation.

 

34. The Home Office Compliance Visit Readiness Test

 

Before considering the organisation audit-ready, ask:

Is the sponsor licence information accurate?

Can we identify every current sponsored worker?

Can we retrieve the required worker records?

Do HR, payroll and SMS records reconcile?

Do sponsored workers perform the roles for which they are sponsored?

Do salary and working hours correspond with the sponsorship position?

Are actual work locations understood?

Are right to work checks and immigration expiry controls operating correctly?

Are absence records complete?

Have relevant worker and organisational changes been assessed and reported where required?

Are SMS users appropriate, secure and prepared for current MFA requirements?

Do key personnel understand their genuine responsibilities?

Do managers know what events to escalate?

Do staff accounts correspond with documentary evidence?

Have material audit findings been remediated or placed under controlled remediation?

Can the organisation continue operating its sponsor compliance systems if a key individual is absent?

The central readiness question is:

Do the organisation’s records, people, systems and operational reality tell a consistent and supportable story about how its sponsored workforce is managed?

Where the answer is yes, the organisation is in a stronger position to demonstrate that sponsor compliance is embedded within ordinary business operations rather than assembled only when Home Office scrutiny occurs.

 

 

Back to top

 

Section S: After the Audit: Maintaining Sponsor Licence Audit Readiness

 

A sponsor licence compliance audit should not be treated as a one-off exercise that ends when the report is issued or the remediation tracker is closed.

Sponsor compliance operates within a changing environment. Sponsored workers join and leave, salaries and duties change, managers move, businesses restructure, HR systems are replaced and Home Office requirements develop over time.

An organisation that was compliant when an audit was completed can therefore develop weaknesses afterwards.

The objective should be to move from periodic compliance checking towards an ongoing system of sponsor compliance assurance.

A useful cycle is:

Test → Find → Remediate → Verify → Monitor → Re-Test

 

1. Move from Audit Exercise to Compliance Programme

 

The audit should provide the foundation for an ongoing compliance programme.

This means using the findings to determine:

 

• which areas require continued monitoring;
• which controls require improvement;
• which departments need additional support;
• which risks require management visibility;
• which reconciliations should take place regularly;
• which employment events should trigger compliance review; and
• where future audit testing should concentrate.

 

The audit therefore becomes part of the sponsor’s governance framework rather than an isolated compliance project.

 

2. Keep the Audit Action Tracker Active

 

Where findings remain open after the formal audit, the remediation tracker should remain active until the relevant actions have been verified and formally closed.

Monitor:

 

• open findings;
• internal risk grades;
• action owners;
• target dates;
• overdue actions;
• interim controls;
• completion evidence;
• re-testing requirements;
• failed re-tests; and
• closure approvals.

 

The end of the audit fieldwork should not result in unresolved actions disappearing from management attention.

 

3. Verify Remediation Before Closing Findings

 

Remediation should be tested before material findings are treated as resolved.

For example:

 

• after changing the promotion process, test a subsequent sponsored-worker promotion;
• after changing salary escalation, test a later payroll change;
• after improving absence monitoring, test a later absence case;
• after repairing immigration-expiry alerts, confirm that alerts are generated and acted upon;
• after changing contact-detail retention, confirm that historical information remains available; and
• after improving SMS cover, test whether the organisation can operate securely when the principal user is unavailable.

 

The appropriate sequence is:

Remediation Implemented → Evidence Obtained → Control Tested → Effective? → Closure

 

4. Introduce Periodic HR-to-SMS Reconciliation

 

Periodic reconciliation between HR information and the Sponsor Management System can identify discrepancies before they become embedded.

Relevant fields can include:

 

• current sponsored worker population;
• employment status;
• job title;
• role;
• work location;
• salary;
• working hours;
• employment start date;
• employment end date; and
• relevant worker changes.

 

The purpose is not merely to identify different data. Each discrepancy should be investigated to establish which information is correct and whether sponsor action was required.

SMS ↔ HR

should become a routine assurance relationship rather than something tested only during a major audit.

 

5. Reconcile HR & Payroll

 

HR records should periodically be compared with payroll information for sponsored workers.

This can help identify:

 

• salary discrepancies;
• salary reductions;
• changes in working hours;
• unpaid leave;
• reduced-pay absence;
• unexpected deductions;
• workers remaining on payroll after leaving; and
• other unexplained payment anomalies.

 

The control can be represented as:

HR ↔ Payroll

Material discrepancies should be escalated for sponsorship assessment rather than treated solely as payroll administration.

 

6. Reconcile HR & Right to Work Records

 

The organisation should maintain assurance that workers recorded as employed have appropriate right to work evidence and that time-limited permission is monitored correctly.

Periodic testing can compare:

HR ↔ Right to Work Records ↔ Immigration Expiry Monitoring

This can identify:

 

• missing checks;
• incorrect expiry dates;
• overdue follow-up checks;
• workers missing from monitoring systems;
• incorrect checking methods;
• evidence-retention problems; and
• cases requiring further assessment.

 

7. Reconcile the CoS with the Current Role

 

A sponsored worker’s role can change gradually without a formal event being recognised as significant.

Periodic testing should therefore compare:

CoS ↔ Contract ↔ Current Job Description ↔ Actual Duties

This can help identify:

 

• role drift;
• unassessed promotions;
• internal transfers;
• material changes in responsibilities;
• occupation classification concerns;
• eligible-role concerns; and
• changes potentially engaging reporting or change of employment requirements.

 

The organisation should not rely solely on job titles when testing whether sponsored roles remain consistent with the basis of sponsorship.

 

8. Reconcile Contracts & Payroll

 

Contractual salary and hours should periodically be tested against actual payment and working arrangements.

The reconciliation can be expressed as:

Contract ↔ Salary ↔ Hours ↔ Payroll

Differences should be investigated rather than automatically treated as compliance failures.

The objective is to establish the reason for the discrepancy and whether it has sponsorship implications.

 

9. Reconcile Recorded & Actual Work Locations

 

Work-location monitoring should reflect the organisation’s actual operating model.

Periodic review can compare:

Recorded Location ↔ HR Location ↔ Manager Evidence ↔ Actual Working Arrangement

Particular attention may be appropriate where workers:

 

• move between branches;
• begin working at client sites;
• relocate permanently;
• change their normal workplace;
• move into permanent full-time remote working; or
• operate under evolving hybrid arrangements.

 

Ordinary hybrid working and day-to-day location variations should be distinguished from substantive changes that require sponsorship assessment.

 

10. Reconcile HR Events with Sponsor Reporting

 

One of the most effective ongoing controls is to identify relevant HR events independently and check whether they were assessed for sponsorship purposes.

The reconciliation is:

HR Events ↔ Sponsorship Assessment ↔ SMS Reporting

Relevant events can include:

 

• new starters;
• non-starters;
• promotions;
• role changes;
• salary reductions;
• working-hours changes;
• work-location changes;
• relevant absence;
• immigration changes; and
• leavers.

 

This approach can identify events that never reached the sponsorship team.

 

11. Use Exception Reporting

 

Exception reporting can make ongoing compliance monitoring more efficient by directing attention towards unusual or potentially significant events.

Depending on the organisation’s systems, exception reports can identify:

 

• sponsored workers with salary changes;
• sponsored workers with changed hours;
• extended absence;
• unpaid or reduced-pay periods;
• immigration permission approaching expiry;
• work-location changes;
• promotions;
• departmental transfers;
• workers leaving employment;
• workers missing from expected systems; and
• differences between HR and payroll.

 

The objective is not to assume every exception represents a breach.

The exception creates a trigger for assessment.

 

12. Maintain Immigration Expiry Monitoring

 

Immigration expiry monitoring should operate continuously.

A reliable process should identify:

 

• the worker;
• current immigration permission;
• relevant expiry date;
• when action should begin;
• who owns follow-up;
• whether a new application has been made;
• whether an Employer Checking Service check is required;
• what evidence has been obtained; and
• whether the worker continues to have the right to work.

 

The control should operate as:

Expiry → Alert → Owner → Action → Evidence → Verification

 

13. Continue Monitoring Sponsored Worker Absence

 

Absence monitoring should continue between formal audits.

The organisation should be capable of identifying and escalating relevant patterns, including:

 

• unauthorised absence;
• extended absence;
• unpaid leave;
• reduced-pay absence;
• repeated periods of absence;
• workers who stop attending unexpectedly; and
• absence affecting salary or sponsorship arrangements.

 

The sponsor guidance includes reporting requirements relating to unauthorised absence for more than 10 consecutive working days.

It also contains provisions relating to absence without pay or on reduced pay for more than four weeks in total in a calendar year, subject to applicable exceptions and route-specific provisions.

Systems should therefore be capable of identifying relevant thresholds and escalating cases for assessment.

 

14. Monitor Sponsored Worker Changes

 

Ongoing compliance requires employment changes to be identified as they happen.

Relevant triggers can include:

 

• promotion;
• changes in duties;
• changes in occupation classification;
• salary changes;
• changes in working hours;
• departmental transfers;
• work-location changes;
• changes to remote-working arrangements;
• absence;
• changes in immigration status; and
• termination of employment.

 

The process should operate as:

Business Event → Compliance Trigger → Assessment → Required Action → Evidence

 

15. Monitor Organisational Changes

 

Sponsor compliance should also be embedded within the organisation’s corporate-change processes.

Events requiring early immigration assessment can include:

 

• mergers;
• acquisitions;
• takeovers;
• changes in direct ownership;
• demergers;
• TUPE transfers;
• restructuring;
• branch changes;
• changes of address;
• changes affecting key personnel; and
• relevant insolvency events.

 

Specified organisational changes are generally subject to a 20-working-day reporting or action framework, although the precise requirement depends on the event.

Some corporate events can have consequences beyond an SMS report and may require a new sponsor licence application.

Sponsor licences are not transferable.

The strongest control brings immigration assessment into the planning stage rather than notifying the sponsorship team after the transaction has completed.

 

16. Review Key Personnel Regularly

 

Key personnel and SMS access should remain under review.

Check:

 

• whether the Authorising Officer remains appropriate;
• whether the Key Contact remains current;
• whether Level 1 Users still require access;
• whether former personnel have been removed;
• whether user contact information is current;
• whether appropriate SMS cover exists;
• whether MFA arrangements operate correctly;
• whether credentials remain personal and secure; and
• whether remaining Level 2 Users have been addressed under the applicable transitional arrangements.

 

No new Level 2 Users have been appointable since 9 September 2026, and sponsors should manage the transition of remaining Level 2 Users within the applicable timetable.

 

17. Maintain SMS Security & MFA Controls

 

SMS security should form part of ongoing compliance assurance rather than being reviewed only during an audit.

The organisation should maintain the control:

SMS User → Correct Individual Account → Current Contact Details → MFA → Appropriate Access → No Credential Sharing

Periodic checks should identify:

 

• unnecessary accounts;
• former employees;
• outdated contact information;
• inappropriate access;
• credential sharing;
• one-time passcode sharing;
• business-continuity weaknesses; and
• users who no longer perform sponsorship functions.

 

18. Preserve Institutional Knowledge

 

Sponsor compliance should not depend on one individual remembering how the system operates.

Institutional knowledge should be supported through:

 

• documented procedures;
• clear responsibility matrices;
• appropriate cross-training;
• secure SMS-user cover;
• centralised evidence;
• documented reporting decisions;
• accessible remediation records;
• handover procedures; and
• business-continuity arrangements.

 

The organisation should periodically ask:

What happens if the person who normally manages sponsorship is unavailable tomorrow?

If the answer is that key processes stop, the organisation has a resilience weakness.

 

19. Maintain Role-Specific Training

 

Training should reflect the responsibilities of different personnel.

For example:

 

• Authorising Officers may require governance and oversight training;
• Level 1 Users may require detailed operational sponsor training;
• HR teams may require training on employment-change triggers;
• recruitment teams may require onboarding and recruitment-record training;
• payroll teams may require salary and absence escalation training;
• managers may require training on changes that need escalation; and
• corporate personnel may require awareness of sponsor implications arising from business changes.

 

Not everybody needs detailed knowledge of every sponsor requirement.

They do need sufficient knowledge to perform their role within the compliance system.

 

20. Test Whether Training Is Working

 

Training should be tested through behaviour and evidence rather than attendance records alone.

Ask:

 

• Are managers now escalating promotions?
• Does payroll identify sponsored-worker salary reductions?
• Does HR preserve contact histories?
• Are work-location changes reaching the sponsorship team?
• Are Level 1 Users making timely assessments?
• Are corporate changes being escalated earlier?

 

The assurance chain remains:

Training → Understanding → Behaviour → Evidence

 

21. Monitor Changes to Sponsor Guidance

 

Sponsor compliance controls should evolve when Home Office requirements change.

The organisation should have a process for identifying relevant changes and determining whether internal action is required.

A practical framework is:

What Changed? → Does It Affect Us? → Which Workers or Processes? → What Must Change? → Who Owns It? → Has It Been Verified?

This can involve changes to:

 

• sponsor duties;
• reporting requirements;
• record keeping;
• Appendix D;
• SMS functionality;
• SMS security;
• Certificate of Sponsorship processes;
• eligible-role requirements;
• salary requirements;
• right to work procedures; and
• other sponsorship rules affecting the organisation.

 

22. Translate Rule Changes into Operational Changes

 

Identifying new Home Office guidance is not enough.

The organisation should determine what needs to change operationally.

For example, a sponsor requirement change may require:

 

• an HR-system change;
• a new data field;
• a revised onboarding process;
• new SMS-user arrangements;
• updated training;
• a payroll control;
• revised manager guidance;
• changes to recruitment evidence;
• updated policies; or
• re-testing of existing sponsored workers.

 

The implementation should then be verified.

The complete process is:

Guidance Change → Impact Assessment → Process Change → Implementation → Evidence → Verification

 

23. Use Management Information

 

Appropriate management information can help the Authorising Officer and senior management understand whether sponsor compliance controls remain effective.

Depending on the organisation, useful information can include:

 

• number of sponsored workers;
• immigration permissions approaching expiry;
• worker changes awaiting assessment;
• late or potentially late reports;
• significant absence cases;
• salary exceptions;
• open audit findings;
• overdue remediation;
• repeat findings;
• SMS-user changes;
• right to work exceptions; and
• significant organisational changes.

 

The purpose is to provide meaningful oversight rather than create large volumes of compliance reporting that nobody uses.

 

24. Use Event-Driven Audits

 

A full audit does not need to wait for an arbitrary calendar date where a significant event creates a reason for earlier review.

Event-driven audits can be appropriate following:

 

• rapid growth in sponsored worker numbers;
• a change of Authorising Officer;
• significant changes to the HR or payroll system;
• a merger or acquisition;
• a TUPE transfer;
• restructuring;
• significant changes to sponsor requirements;
• discovery of a material compliance failure;
• repeated late reporting;
• significant staff turnover within HR or sponsorship teams; or
• Home Office compliance activity.

 

The scope of the audit can be targeted towards the risk created by the event.

 

25. Use a Risk-Based Audit Frequency

 

There is no need to impose an arbitrary audit frequency that ignores the organisation’s circumstances.

The appropriate frequency should reflect factors such as:

 

• size of the sponsored workforce;
• rate of recruitment;
• frequency of employment changes;
• complexity of the organisation;
• number of locations;
• use of client sites;
• corporate-change activity;
• turnover within key personnel;
• previous audit findings;
• repeat failures;
• reliance on manual controls;
• changes to sponsor requirements; and
• the effectiveness of ongoing monitoring.

 

A sponsor with a stable workforce, mature controls and few findings may require a different audit programme from an organisation undergoing rapid recruitment, restructuring and repeated compliance changes.

 

26. Increase Testing Where Risk Increases

 

The audit programme should respond to changing risk.

Where risk increases, the organisation can increase:

 

• sample sizes;
• frequency of reconciliation;
• management reporting;
• worker-file testing;
• payroll testing;
• manager interviews;
• right to work testing;
• SMS reporting review; and
• remediation verification.

 

Where a problem appears systemic, testing should expand beyond the original sample.

 

27. Re-Test Higher-Risk Areas

 

Areas with significant previous findings should receive particular attention in later audits.

For example, if an earlier audit identified repeated failures relating to work-location reporting, a future audit should not simply assume that revised training solved the problem.

It should test actual subsequent location changes.

The same principle applies to:

 

• salary changes;
• role changes;
• absence;
• right to work;
• immigration expiry monitoring;
• contact histories;
• corporate changes;
• SMS access; and
• other previously weak controls.

 

Previous findings should therefore influence future audit scope.

 

28. Maintain Evidence of Ongoing Compliance Assurance

 

An organisation should be able to demonstrate not only that it completed an audit, but that sponsor compliance continues to be monitored.

Evidence can include:

 

• audit reports;
• remediation trackers;
• re-test records;
• HR-to-SMS reconciliations;
• payroll reviews;
• right to work reviews;
• expiry-monitoring records;
• training records;
• management reports;
• key personnel reviews;
• SMS access reviews;
• exception reports;
• policy updates; and
• records of responses to sponsor guidance changes.

 

This creates an evidence trail of active compliance governance.

 

29. Use a Sponsor Compliance Assurance Cycle

 

A mature sponsor compliance system can be represented as a continuous operational cycle:

Business Event → Compliance Trigger → Assessment → Action → Evidence → Monitoring → Audit Testing

For example:

Promotion → Sponsorship Trigger → Role Assessment → Required Action → Decision Record → Monitoring → Future Audit Test

or:

Salary Reduction → Payroll Trigger → Sponsorship Assessment → Required Action → Evidence → Reconciliation → Audit Test

This embeds sponsor compliance into the ordinary lifecycle of employment and business change.

 

30. Maintain the Sponsor Worker Audit Chain

 

The core sponsored worker reconciliation should remain available for periodic testing:

CoS → Immigration Status → Contract → Actual Duties → Salary → Payroll → Hours → Location → Attendance → SMS

Compliance is strongest where every source tells the same substantive story.

Where one source diverges, the organisation should investigate whether the difference is:

 

• an administrative discrepancy;
• a record-keeping problem;
• an unassessed employment change;
• a reporting issue;
• a substantive sponsorship concern; or
• evidence of a wider control failure.

 

31. Maintain the Audit Finding Framework

 

Future audit findings should continue to be managed through a consistent framework:

Requirement → Evidence → Finding → Exposure → Remediation → Verification

This prevents findings from becoming vague observations that cannot be translated into action.

Each material issue should remain traceable from the requirement being tested through to evidence of successful remediation.

 

32. Maintain the Sponsor Compliance Assurance Cycle

 

The overall compliance programme should operate continuously:

Test → Find → Remediate → Verify → Monitor → Re-Test

The cycle recognises that compliance controls can deteriorate after they have been tested.

Staff change. Systems change. Businesses change. Sponsored workers change. Home Office requirements change.

Verification and monitoring are therefore as important as the original audit.

 

33. The Ongoing Audit Readiness Test

 

An organisation maintaining sponsor licence audit readiness should be able to answer:

Do we know who our sponsored workers are?

Do our SMS, HR and payroll records reconcile?

Do our sponsored workers continue to perform the roles for which they are sponsored?

Do salary and working hours remain consistent with sponsorship requirements?

Do we know where sponsored workers normally work?

Are right to work and immigration expiry controls operating effectively?

Are absence records complete and relevant thresholds monitored?

Are employment changes identified and escalated promptly?

Are corporate changes assessed for sponsor implications?

Are SMS users current, secure and appropriately authorised?

Can required evidence be retrieved without depending on one individual?

Do managers and operational teams understand their escalation responsibilities?

Are changes to Home Office requirements translated into operational changes?

Are previous audit findings genuinely resolved?

Do we verify that remediation works?

Does our audit programme respond when risk changes?

The objective is not to remain permanently prepared for an inspection as a separate exercise.

It is to operate the sponsor licence in a way that means the organisation’s ordinary records, systems, people and employment practices can demonstrate compliance whenever scrutiny occurs.

The continuing assurance model is:

Business Event → Compliance Trigger → Assessment → Action → Evidence → Monitoring → Audit Testing → Remediation → Verification

Where this cycle is embedded within normal business operations, sponsor licence compliance becomes an ongoing governance process rather than a periodic exercise undertaken only when a Home Office compliance visit appears likely.

 

 

Back to top

 

Section T: Sponsor Licence Compliance Audit FAQs

 

The following frequently asked questions address practical issues employers commonly encounter when planning, conducting and responding to a sponsor licence compliance audit.

 

What is a sponsor licence compliance audit?

A sponsor licence compliance audit is a structured review of an organisation’s systems, records and working practices against its sponsor duties.

The audit should go beyond checking whether documents exist. It should test whether the organisation’s records accurately reflect how sponsored workers are actually employed and whether the systems used to identify and manage relevant changes operate effectively.

A comprehensive audit can include:

 

• sponsor licence information;
• key personnel;
• SMS access and administration;
• Certificates of Sponsorship;
• sponsored worker files;
• Appendix D records;
• right to work;
• immigration expiry monitoring;
• absence monitoring;
• sponsor reporting;
• roles and duties;
• salary and payroll;
• working hours;
• work locations;
• recruitment records;
• HR processes;
• manager knowledge; and
• compliance governance.

 

Is a sponsor licence compliance audit mandatory?

There is not a general requirement for every sponsor to conduct an internal audit according to a prescribed timetable or format.

However, sponsors are required to comply with their sponsor duties throughout the life of the licence.

Internal auditing provides a structured way of testing whether those duties are being met and whether the organisation could evidence compliance if scrutinised by the Home Office.

For many sponsors, periodic and event-driven auditing forms an important part of effective compliance governance.

 

How often should a sponsor licence compliance audit be carried out?

There is no single audit frequency suitable for every sponsor.

The appropriate approach should reflect the organisation’s risk profile, including:

 

• the number of sponsored workers;
• the rate of international recruitment;
• frequency of role and salary changes;
• number of work locations;
• use of client sites;
• corporate-change activity;
• turnover among key personnel;
• complexity of HR and payroll systems;
• previous compliance findings;
• changes to sponsor requirements; and
• the strength of ongoing monitoring controls.

 

Significant events can also justify an audit outside the organisation’s normal review programme.

 

What should a sponsor licence audit cover?

The scope should be sufficiently broad to test both individual sponsored workers and the systems used to manage sponsorship.

Core areas typically include:

 

• licence and organisation information;
• key personnel and governance;
• SMS users and security;
• CoS records;
• worker files;
• Appendix D;
• right to work;
• immigration status;
• worker contact histories;
• date-of-entry evidence where required;
• absence;
• reporting;
• roles and duties;
• salary;
• hours;
• payroll;
• work locations;
• recruitment;
• HR controls;
• corporate-change controls; and
• previous remediation.

 

The scope should expand where initial testing indicates that a problem may be systemic.

 

What documents are needed for a sponsor licence compliance audit?

The documents required will depend on the organisation and the sponsored workers being tested.

Evidence may include:

 

• Certificates of Sponsorship;
• immigration status evidence;
• right to work evidence;
• date-of-entry evidence where applicable;
• employment contracts;
• job descriptions;
• salary records;
• payroll records;
• payslips;
• working-hours records;
• absence records;
• worker contact histories;
• recruitment records;
• work-location information;
• SMS reporting evidence;
• organisation records;
• HR procedures;
• training records; and
• previous audit and remediation records.

 

The audit should test evidence against the applicable sponsor requirements rather than assume that every worker requires an identical set of documents.

 

Does every sponsored worker file need to be audited?

Not necessarily.

For larger sponsored populations, risk-based sampling can be appropriate. The sample should be sufficiently broad to test different roles, departments, locations, managers, immigration circumstances and employment histories.

However, sampling should not become an artificial limit on the audit.

If a sampled file identifies a potential systemic weakness, testing should expand to determine the affected population.

For smaller sponsored workforces, reviewing every current sponsored worker may be practical.

 

What is a mock sponsor licence audit?

A mock sponsor licence audit is an internal or independently conducted exercise designed to test how effectively the organisation can demonstrate sponsor compliance.

It can include:

 

• worker-file sampling;
• SMS review;
• HR and payroll reconciliation;
• right to work testing;
• reporting review;
• interviews with key personnel;
• manager interviews;
• sponsored worker interviews;
• evidence-retrieval testing; and
• scenario-based testing.

 

The purpose should be to identify genuine weaknesses rather than rehearse a performance for a Home Office visit.

 

Is an internal sponsor compliance audit the same as a Home Office compliance visit?

No.

An internal compliance audit is conducted by or on behalf of the sponsor to test its own compliance arrangements.

A Home Office compliance visit is an official compliance activity undertaken by the Home Office.

The distinction can be summarised as:

Internal Audit = Sponsor Tests Itself

Compliance Visit = Home Office Tests Sponsor

An internal audit can help prepare for scrutiny, but it does not replace or control the Home Office’s own compliance assessment.

 

Who should conduct a sponsor licence compliance audit?

The appropriate auditor will depend on the organisation’s resources, complexity and risk profile.

An audit may be conducted by:

 

• an internal compliance function;
• an experienced HR or immigration team;
• internal legal personnel;
• an independent specialist adviser; or
• a combination of internal and external personnel.

 

Independence can be particularly useful where the organisation wants to test whether established internal assumptions and procedures remain reliable.

Whoever conducts the audit should understand the sponsor requirements being tested and should be able to distinguish documentary discrepancies from substantive compliance issues.

 

Should sponsored workers be interviewed during an audit?

Sponsored worker interviews can be useful where they help verify the factual reality of employment.

Questions may cover:

 

• actual job title;
• duties;
• line manager;
• department;
• working hours;
• salary;
• normal work location;
• remote or hybrid working;
• recent role changes; and
• absence arrangements.

 

The purpose is not to test whether the worker understands sponsor licence law.

The worker’s factual account can instead be compared with the CoS, contract, HR information, payroll, manager evidence and SMS records.

 

Should managers be interviewed during a sponsor audit?

Managers can be important because many sponsorship-sensitive events originate at line-management level.

A manager may be the first person to know that a sponsored worker:

 

• has been promoted;
• has changed duties;
• has moved work location;
• has changed working hours;
• is absent;
• has stopped attending;
• is moving department; or
• is leaving employment.

 

The audit should test whether managers understand what they need to escalate and how they should do so.

Managers do not generally need to make the immigration assessment themselves.

 

What happens if a sponsor licence audit finds a breach?

The organisation should establish the facts before deciding how to respond.

A structured approach is:

Establish Facts → Confirm Requirement → Determine Scope → Assess Exposure → Take Required Action → Remediate Control → Document → Verify

The organisation should determine whether the issue is isolated or systemic, historical or continuing, and whether Home Office reporting or another immigration action is required.

Significant or uncertain findings may require specialist legal assessment before action is taken.

 

Should a missed sponsor report simply be submitted late?

Not automatically.

Where a potentially missed report is identified, establish:

 

• what event occurred;
• when it occurred;
• whether it was reportable;
• which requirement applied;
• whether the underlying position remains current;
• whether another immigration process was required instead;
• what subsequent action has occurred; and
• what action is appropriate now.

 

A retrospective SMS report should not be treated as a universal solution to every historic sponsorship discrepancy.

 

How quickly do sponsors have to report worker changes?

Many specified changes affecting sponsored workers are generally required to be reported within 10 working days, unless the relevant sponsor guidance specifies otherwise.

The organisation should identify the event, establish the applicable reporting requirement and retain evidence of the action taken.

Internal processes should escalate relevant employment changes early enough for the sponsorship team to assess them before the applicable deadline expires.

 

How quickly do sponsors have to report organisational changes?

Specified organisational changes are generally subject to a 20-working-day reporting or action framework, although the precise requirement depends on the event.

Corporate changes can be particularly important because some events have consequences extending beyond an SMS report and may require a new sponsor licence application.

Sponsor licences are not transferable.

Corporate transactions should therefore be assessed for sponsor implications before completion wherever possible.

 

Does every salary change have to be reported?

No.

An ordinary salary increase does not generally require an SMS report merely because the worker is being paid more, subject to specific provisions and exceptions in the sponsor guidance.

However, salary changes should still be reviewed where they accompany:

 

• a promotion;
• a role change;
• different duties;
• changed working hours;
• an internal transfer; or
• another change affecting the basis of sponsorship.

 

Salary reductions require particularly careful assessment against the applicable sponsorship requirements.

 

Does every change in a sponsored worker’s role need to be reported?

Not necessarily.

The organisation should establish the nature and significance of the change.

Depending on the circumstances, a role change may:

 

• require no report;
• require sponsor reporting;
• require wider immigration assessment; or
• be significant enough to engage the change of employment requirements.

 

The organisation should not assume that every role change can be dealt with through an SMS report.

 

Does hybrid working have to be reported to the Home Office?

A move to hybrid working does not, by itself, necessarily require an SMS report.

The sponsor should nevertheless maintain appropriate records of the worker’s normal working arrangements and assess substantive changes in work location.

Examples requiring closer consideration can include:

 

• a permanent move to another branch;
• a new client site;
• a substantive change in normal workplace; or
• permanent full-time remote working with little or no workplace attendance.

 

Ordinary day-to-day variations in location should be distinguished from substantive changes to the worker’s normal working arrangements.

 

What absence issues should be checked during a sponsor audit?

The audit should test both absence records and the processes used to identify relevant sponsorship events.

This includes considering:

 

• authorised absence;
• unauthorised absence;
• unpaid leave;
• reduced-pay absence;
• extended absence;
• attendance monitoring;
• manager escalation;
• payroll consequences; and
• required sponsor action.

 

The sponsor guidance includes reporting requirements relating to unauthorised absence for more than 10 consecutive working days.

It also contains provisions relating to absence without pay or on reduced pay for more than four weeks in total in a calendar year, subject to applicable exceptions and route-specific provisions.

 

Should a sponsor audit include right to work checks?

Yes. Right to work compliance should normally form part of the wider review, while recognising that sponsor duties and the statutory right to work regime are related but distinct.

The audit should establish whether the appropriate prescribed checking process was used, whether checks were completed at the correct time, whether evidence was retained and whether follow-up checks were completed where required.

For sponsored workers, relevant Appendix D evidence should also be reviewed. The sponsor’s duty extends to workers it sponsors whether or not the sponsor is their direct employer.

 

What right to work methods apply from 1 October 2026?

Depending on the worker and the evidence available, the employer right to work framework can involve:

 

• a Home Office online right to work check;
• an appropriate Right to Work Digital Verification Service Provider check; or
• a manual document check.

 

The correct method depends on the individual’s circumstances.

From 1 October 2026, the statutory right to work regime also extends to specified working arrangements beyond conventional employment, including certain worker’s contracts, individual subcontractors and specified online matching service arrangements.

Where a sponsored worker’s status is checked online, the employer should use the appropriate GOV.UK right to work checking service and retain the required evidence of the check.

 

What contact information should be checked during the audit?

The audit should test whether the sponsor maintains the required history of sponsored workers’ relevant contact information, including:

 

• UK residential addresses;
• personal email addresses; and
• telephone numbers.

 

Testing should not be limited to whether the current details are accurate.

The audit should establish whether historic changes have been preserved rather than overwritten by the HR system.

 

What date-of-entry evidence should be checked?

Where current permission resulted from entry clearance sponsored by the organisation, Appendix D requirements relating to establishing entry during the relevant validity period should be considered.

The audit should establish whether appropriate evidence was obtained and retained.

This should be assessed separately from the right to work check.

With the move towards eVisas and the 2026 phasing out of physical entry-clearance vignettes in relevant cases, sponsors should ensure that current onboarding procedures capture appropriate evidence under the prevailing Appendix D requirements.

 

Does a sponsor need recruitment evidence if there is no resident labour market test?

The absence of a general resident labour market test does not mean that recruitment evidence is irrelevant.

Sponsors should be able to explain and, where appropriate, evidence how a sponsored worker was recruited.

The audit can therefore examine:

 

• how the vacancy arose;
• how the candidate was identified;
• advertising where relevant;
• recruitment agency involvement;
• selection evidence;
• the business need for the role; and
• historic or route-specific formal recruitment evidence where applicable.

 

What should an audit check about SMS users?

The audit should establish whether SMS access is restricted to appropriate individuals and managed securely.

Testing should include:

 

• current Level 1 Users;
• remaining transitional Level 2 Users where relevant;
• former employees;
• user contact details;
• access permissions;
• multi-factor authentication;
• credential security;
• one-time passcode security; and
• business continuity.

 

SMS credentials and one-time passcodes should not be shared.

 

What happened to Level 2 SMS Users in 2026?

No new Level 2 Users have been appointable since 9 September 2026.

Existing Level 2 Users are subject to transitional arrangements and should be reviewed so that they can be upgraded to Level 1 where eligible and appropriate or deactivated within the applicable transition timetable.

An audit should therefore identify any remaining Level 2 Users and ensure that responsibility for their transition has been assigned.

 

What happens if the audit finds a corporate change was not reported?

The organisation should investigate the transaction carefully before deciding on corrective action.

Relevant events can include:

 

• mergers;
• takeovers;
• changes in direct ownership;
• demergers;
• TUPE transfers;
• restructuring; and
• other significant organisational changes.

 

Some corporate events can require more than an SMS update and may require a new sponsor licence application.

Because sponsor licences are not transferable, potentially unaddressed corporate changes should be escalated promptly for appropriate assessment.

 

What are the most common sponsor audit problems?

Common findings include:

 

• HR and SMS discrepancies;
• incomplete worker files;
• missing historical records;
• incomplete contact histories;
• missing date-of-entry evidence;
• right to work weaknesses;
• poor immigration expiry monitoring;
• salary and payroll discrepancies;
• role drift;
• unassessed promotions or transfers;
• work-location discrepancies;
• incomplete absence records;
• late or missed sponsor reports;
• weak HR-to-SMS escalation;
• outdated SMS access;
• single-person dependency;
• policies not followed in practice; and
• previous remediation that has not been verified.

 

The significance of any finding depends on its facts, scale, duration and whether it represents an isolated error or wider control weakness.

 

Can an audit reduce sponsor licence enforcement risk?

A proactive audit can help an organisation identify and address compliance weaknesses before they become more extensive or are identified during Home Office scrutiny.

However, conducting an audit does not guarantee that the Home Office will take no action where sponsor breaches have occurred.

The value of auditing lies in establishing the actual compliance position, identifying weaknesses, taking appropriate corrective action and strengthening the systems used to prevent recurrence.

 

What can happen if the Home Office identifies sponsor non-compliance?

The Home Office response depends on the applicable sponsor guidance and the circumstances of the case.

Depending on the nature of the findings, possible action can include measures such as:

 

• reducing or setting a Certificate of Sponsorship allocation to zero;
• downgrading a sponsor licence;
• suspending a sponsor licence;
• revoking a sponsor licence; or
• referring relevant matters to other authorities.

 

Where a sponsor licence is suspended, the sponsor cannot assign any Certificates of Sponsorship while the suspension remains in force. Where a sponsor is downgraded to a B-rating and required to follow an action plan, the action-plan fee must normally be paid within 10 working days, the action plan runs for 3 months, and the sponsor cannot normally assign Certificates of Sponsorship to new workers while B-rated. A sponsor can ordinarily be B-rated and subject to an action plan only twice within a rolling four-year period.

An internal audit finding does not automatically determine that any particular Home Office consequence will follow.

 

How should an employer prepare for a Home Office compliance visit?

Preparation should focus on establishing genuine compliance rather than creating the appearance of readiness.

The organisation should:

 

• review its sponsor licence information;
• confirm the sponsored worker population;
• audit worker files;
• review Appendix D evidence;
• test right to work compliance;
• reconcile SMS and HR information;
• reconcile salary and payroll;
• verify actual roles and duties;
• review work locations;
• review absence monitoring;
• test sponsor reporting;
• review key personnel and SMS access;
• test staff understanding;
• review outstanding remediation; and
• test evidence retrieval.

 

The organisation’s records, people and systems should reflect its actual sponsored workforce.

 

How long does a sponsor licence compliance audit take?

The time required depends on the size and complexity of the organisation and the scope of testing.

Relevant factors include:

 

• number of sponsored workers;
• number of sites;
• number of immigration routes;
• complexity of payroll;
• volume of worker changes;
• availability of records;
• number of personnel interviewed;
• quality of existing compliance systems; and
• whether initial findings require expanded testing.

 

A smaller sponsor with a limited and stable sponsored population may require substantially less testing than a large multi-site employer with numerous sponsored workers and complex employment arrangements.

 

What should happen after the sponsor compliance audit?

Material findings should be recorded, risk-graded, remediated and verified.

The organisation should then move into an ongoing assurance cycle:

Test → Find → Remediate → Verify → Monitor → Re-Test

Future monitoring can include HR-to-SMS reconciliation, payroll review, right to work testing, expiry monitoring, sponsored-role review, reporting checks and event-driven audits.

The objective is to maintain compliance readiness rather than wait for the next formal audit.

 

What is the central test of sponsor licence audit readiness?

The central question is whether the organisation can demonstrate that its records, systems, people and actual employment practices consistently support its sponsorship position.

A useful reconciliation is:

CoS → Immigration Status → Contract → Actual Duties → Salary → Payroll → Hours → Location → Attendance → SMS

Where those sources tell the same substantive story, the sponsor is better placed to demonstrate effective control of its sponsored workforce.

Where they do not, the discrepancy should be investigated, assessed and remediated as appropriate.

 

Back to top

 

Section U: How DavidsonMorris Can Help

 

Sponsor licence compliance is an ongoing management responsibility. Employers need systems capable of identifying relevant workforce and organisational changes, maintaining the required records, managing the Sponsor Management System and ensuring that the reality of sponsored employment remains consistent with the basis on which workers were sponsored.

DavidsonMorris advises UK employers on sponsor licence compliance, including proactive compliance audits, mock audits, remediation programmes and preparation for Home Office scrutiny.

Our approach is designed to test both documentary compliance and how sponsorship operates within the organisation in practice.

 

1. Sponsor Licence Compliance Audits

 

We can conduct a structured review of the organisation’s sponsor licence compliance arrangements.

Depending on the scope and risk profile, the audit can examine:

 

• sponsor licence information;
• key personnel;
• Authorising Officer oversight;
• SMS users and access;
• multi-factor authentication and SMS security;
• Certificates of Sponsorship;
• sponsored worker files;
• Appendix D records;
• right to work compliance;
• immigration expiry monitoring;
• worker contact histories;
• date-of-entry evidence;
• absence records;
• sponsor reporting;
• roles and duties;
• occupation classifications;
• salary and payroll;
• working hours;
• work locations;
• recruitment records;
• HR processes;
• corporate-change processes;
• manager knowledge; and
• compliance governance.

 

The scope can be adapted to the organisation’s sponsored population, operating model, previous compliance history and areas of identified risk.

 

2. Sponsored Worker File Audits

 

Sponsored worker files should demonstrate more than the existence of immigration and employment documents.

We can review worker files by reconciling the key evidence chain:

CoS → Immigration Status → Contract → Actual Duties → Salary → Payroll → Hours → Work Location → Attendance → SMS

This can help identify discrepancies between the position described for sponsorship purposes and the worker’s actual employment.

File audits can also examine whether relevant Appendix D records have been obtained, retained and kept up to date.

 

3. Appendix D Record-Keeping Reviews

 

We can review the organisation’s approach to sponsor record keeping against the applicable Appendix D requirements.

This can include testing:

 

• right to work evidence;
• immigration status records;
• date-of-entry evidence where required;
• UK residential address histories;
• personal email address histories;
• telephone number histories;
• absence records;
• recruitment evidence;
• employment records;
• salary information;
• document retention; and
• the organisation’s ability to retrieve historical evidence.

 

Where gaps are identified, we can help distinguish between isolated missing records and weaknesses within the organisation’s wider record-keeping systems.

 

4. Sponsor Management System Audits

 

SMS compliance can be reviewed against the organisation’s actual HR and employment records.

The review can include:

 

• key personnel;
• Level 1 Users;
• remaining transitional Level 2 Users where relevant;
• SMS access;
• multi-factor authentication;
• user contact details;
• credential security;
• organisation information;
• CoS administration;
• worker information;
• reporting history;
• outstanding actions;
• business continuity; and
• HR-to-SMS escalation.

 

The review can also test whether employment events that occurred within the organisation were correctly identified and assessed for sponsor reporting purposes.

 

5. Sponsor Reporting Audits

 

Rather than reviewing only reports that appear on the SMS, we can test underlying employment and organisational events to determine whether relevant changes reached the sponsorship function.

The review can follow the sequence:

Event → Identification → Escalation → Assessment → Action → Evidence

This can include changes relating to:

 

• employment start and non-start;
• leavers;
• roles and duties;
• salary;
• working hours;
• work locations;
• absence;
• immigration status;
• key personnel; and
• corporate changes.

 

Where potential late or missed reporting is identified, we can advise on the applicable requirement and appropriate next steps.

 

6. Right to Work Audits

 

We can review right to work processes as part of the wider sponsor compliance audit or as a separate compliance exercise.

The review can consider:

 

• the checking method used;
• timing of checks;
• identity verification;
• permission to undertake the work;
• work restrictions;
• evidence retention;
• follow-up checks;
• immigration expiry monitoring;
• Employer Checking Service cases;
• information flow between recruitment, HR and immigration personnel; and
• the relationship between right to work evidence and sponsor record-keeping requirements.

 

Where weaknesses are identified, we can help determine the affected population and the remediation required.

 

7. Salary & Payroll Compliance Reviews

 

Sponsored worker salary compliance should be tested against actual payroll information rather than relying solely on the salary stated on the Certificate of Sponsorship or employment contract.

We can reconcile:

CoS → Contract → Salary → Hours → Payroll → Payslips

The review can examine:

 

• salary reductions;
• salary increases associated with wider employment changes;
• changes in working hours;
• unpaid leave;
• reduced-pay absence;
• allowances;
• deductions;
• payroll anomalies; and
• the process used to escalate payroll changes for sponsorship assessment.

 

8. Sponsored Role Reviews

 

We can review whether the roles being performed by sponsored workers remain consistent with the basis of sponsorship.

This can involve comparing:

 

• the Certificate of Sponsorship;
• employment contract;
• job description;
• actual duties;
• occupation classification;
• salary;
• working hours;
• manager evidence;
• worker evidence; and
• relevant employment changes.

 

Where roles have changed, we can assess whether the change required sponsor reporting, another immigration action or consideration of the change of employment requirements.

 

9. HR Systems & Process Audits

 

Many sponsor compliance failures arise because information does not move effectively between operational teams.

We can test how the organisation manages:

Business Event → Identification → Escalation → Immigration Assessment → Action → Evidence → Verification

This can include reviewing processes for:

 

• recruitment;
• onboarding;
• right to work;
• immigration expiry;
• absence;
• role changes;
• promotions;
• salary changes;
• working-hours changes;
• work-location changes;
• leavers;
• corporate changes;
• SMS administration; and
• business continuity.

 

The purpose is to identify where a compliant policy may nevertheless fail in operational practice.

 

10. Interviews with Key Personnel & Operational Teams

 

Audit interviews can be used to test whether sponsor compliance responsibilities are understood throughout the organisation.

Depending on the scope, interviews can include:

 

• the Authorising Officer;
• Level 1 Users;
• HR personnel;
• recruitment personnel;
• payroll personnel;
• line managers;
• corporate personnel; and
• sponsored workers.

 

The objective is to compare:

Policy Says → Staff Say → Evidence Shows

This can identify differences between documented procedures and the way sponsorship is actually managed.

 

11. Mock Home Office Compliance Audits

 

We can conduct mock audit exercises designed to test how effectively the organisation could demonstrate sponsor compliance under scrutiny.

Testing can include:

 

• unannounced or selected worker-file sampling;
• evidence retrieval;
• SMS review;
• HR and payroll reconciliation;
• right to work testing;
• role and salary testing;
• reporting review;
• interviews with key personnel;
• manager interviews;
• sponsored worker interviews;
• scenario testing; and
• review of previous remediation.

 

The purpose of a mock audit is to identify weaknesses internally so that the organisation can understand and improve its compliance position.

 

12. Audit Finding Risk Assessment

 

Where findings are identified, we can help assess their significance by considering factors such as:

 

• the requirement affected;
• the underlying facts;
• the evidence available;
• the number of workers affected;
• the duration of the issue;
• whether it is continuing;
• whether it is isolated or systemic;
• whether substantive sponsorship requirements remain satisfied;
• whether reporting or another immigration action was required;
• previous similar findings; and
• the effectiveness of existing controls.

 

This allows remediation to be prioritised according to the organisation’s actual compliance exposure.

 

13. Sponsor Compliance Remediation

 

Where an audit identifies weaknesses or potential breaches, we can advise on an appropriate remediation programme.

The approach can follow:

Establish Facts → Confirm Requirement → Determine Scope → Assess Exposure → Take Required Action → Remediate Control → Document → Verify

Remediation can involve:

 

• case-level corrective action;
• review of potentially affected workers;
• assessment of reporting requirements;
• review of roles and salary;
• reconstruction of legitimate historical evidence where appropriate;
• process redesign;
• HR-system changes;
• payroll controls;
• revised escalation routes;
• policy updates;
• targeted training;
• management oversight; and
• re-testing.

 

14. Remediation Planning & Verification

 

We can help employers convert audit findings into a structured remediation plan.

For each material finding, the plan can establish:

What went wrong? → What needs to change? → Who owns it? → By when? → What evidence proves completion? → How will effectiveness be verified?

This helps distinguish between simply completing an action and demonstrating that the revised control actually works.

The remediation cycle should be:

Finding → Action → Implementation → Evidence → Re-Test → Closure

 

15. Preparing for a Home Office Compliance Visit

 

Where the organisation is expecting or concerned about Home Office compliance activity, we can help assess its current readiness.

This can include:

 

• reviewing sponsor licence information;
• confirming the sponsored worker population;
• testing worker files;
• reviewing Appendix D records;
• testing right to work compliance;
• reconciling HR, SMS and payroll information;
• reviewing sponsored roles;
• reviewing work locations;
• testing absence controls;
• reviewing sponsor reporting;
• reviewing key personnel and SMS access;
• testing evidence retrieval;
• interviewing relevant personnel;
• reviewing outstanding audit findings; and
• assessing previous remediation.

 

The focus should be on establishing and addressing the organisation’s genuine compliance position rather than attempting to create a superficial appearance of readiness.

 

16. Support Following Home Office Compliance Activity

 

Where the Home Office has already undertaken compliance activity or raised concerns, DavidsonMorris can advise on the organisation’s response.

Depending on the circumstances, this may involve:

 

• reviewing the issues identified;
• establishing the underlying facts;
• assessing affected workers;
• reviewing relevant records;
• identifying systemic weaknesses;
• supporting remediation;
• preparing supporting evidence; and
• advising on the sponsor’s position under the applicable sponsor guidance.

 

The appropriate response will depend on the nature and stage of the Home Office process.

 

17. Ongoing Sponsor Licence Compliance Support

 

Compliance support can continue after the audit and remediation programme have been completed.

Ongoing support can include:

 

• periodic compliance reviews;
• worker-file audits;
• SMS reviews;
• reporting advice;
• right to work support;
• role and salary assessments;
• corporate-change advice;
• key personnel support;
• training;
• policy reviews;
• remediation verification; and
• support when sponsor requirements change.

 

The objective is to help the organisation maintain sponsor compliance as its workforce and business change.

 

18. Building a Sponsor Compliance Assurance Programme

 

For employers with larger or more complex sponsored workforces, sponsor compliance can be managed through an ongoing assurance programme rather than relying solely on periodic full audits.

This can incorporate:

 

• HR-to-SMS reconciliation;
• HR-to-payroll reconciliation;
• right to work testing;
• immigration-expiry monitoring;
• role and salary testing;
• exception reporting;
• worker-file sampling;
• management information;
• event-driven audits;
• risk-based re-testing; and
• monitoring of remediation.

 

The continuing model is:

Test → Find → Remediate → Verify → Monitor → Re-Test

 

19. Speak to DavidsonMorris About Sponsor Licence Compliance

 

If you are concerned about sponsor licence compliance, preparing for Home Office scrutiny or want independent assurance that your sponsor systems are operating effectively, DavidsonMorris can review your current arrangements and identify areas requiring action.

The review can be scoped around a specific compliance concern or conducted as a wider sponsor licence compliance audit covering the organisation’s sponsored workforce, systems, records and governance.

The central objective is to establish whether the organisation can demonstrate a consistent compliance position across:

Sponsor Licence → SMS → CoS → Worker Files → HR → Payroll → Managers → Sponsored Workers → Operational Reality

Where inconsistencies are identified, the focus is on establishing the facts, understanding the compliance implications and implementing proportionate, verifiable remediation.

 

Back to top

 

Section V: Conclusion

 

A sponsor licence compliance audit should do considerably more than confirm that the organisation has policies, worker files and access to the Sponsor Management System.

The purpose of the audit is to establish whether the organisation can demonstrate, through reliable evidence, that its sponsor duties are understood and operated effectively across the business and that the reality of sponsored employment remains consistent with the basis on which workers are sponsored.

A comprehensive audit should therefore test the complete compliance chain:

Sponsor Licence → SMS → CoS → Worker Files → HR → Payroll → Managers → Sponsored Workers → Operational Reality

The strongest compliance position exists where the different sources of evidence tell the same substantive story.

 

1. Test More Than Documents

 

Documentary compliance is important, but documents should not be reviewed in isolation.

A Certificate of Sponsorship may contain the expected information. A contract may record an appropriate role and salary. The HR system may contain the worker’s details. Payroll may contain payment information. The SMS may contain the sponsor’s reporting history.

The audit should determine whether those sources remain consistent with each other and with the worker’s actual employment.

The sponsored worker audit chain provides a practical framework:

CoS → Immigration Status → Contract → Actual Duties → Salary → Payroll → Hours → Work Location → Attendance → SMS

Where one part of that chain differs materially from the others, the discrepancy should be investigated.

 

2. Test Records, Reality & Controls

 

A strong sponsor licence compliance audit should examine three dimensions:

Records → Reality → Controls

Records establish what the organisation has documented.

Reality establishes what is actually happening within the sponsored workforce.

Controls establish whether the organisation has reliable processes for identifying and managing future compliance events.

An organisation may have complete records but weak controls. It may have well-written procedures that are not followed. It may also have employees who understand their responsibilities but operate within systems that do not provide the information they need.

The audit should identify these differences.

 

3. Test the Entire Sponsorship Lifecycle

 

Sponsor compliance should be tested across the complete lifecycle of sponsorship.

This can include:

 

• recruitment;
• right to work;
• onboarding;
• Certificate of Sponsorship records;
• immigration status;
• date-of-entry evidence where required;
• Appendix D record keeping;
• worker contact histories;
• role and duty monitoring;
• salary and payroll;
• working hours;
• work locations;
• attendance and absence;
• immigration expiry monitoring;
• employment changes;
• sponsor reporting;
• leavers;
• SMS administration;
• key personnel;
• corporate changes; and
• ongoing compliance governance.

 

This allows the organisation to identify weaknesses that would be missed by reviewing worker files alone.

 

4. Follow Business Events Through to Compliance Action

 

Many sponsor compliance problems arise because a business event occurs but does not reach the person responsible for assessing its immigration implications.

The audit should therefore test:

Business Event → Identification → Escalation → Immigration Assessment → Action → Evidence → Verification

This approach is particularly important for:

 

• promotions;
• role changes;
• salary changes;
• working-hours changes;
• work-location changes;
• absence;
• leavers;
• changes affecting immigration status;
• key personnel changes; and
• corporate transactions.

 

The question is not simply whether the organisation knows the sponsor rules. It is whether its ordinary business processes reliably trigger the necessary sponsorship assessment.

 

5. Distinguish Individual Errors from Systemic Weaknesses

 

Not every discrepancy identified during an audit necessarily represents the same level of compliance concern.

The organisation should establish:

 

• what happened;
• which requirement applies;
• when the issue arose;
• whether it is continuing;
• which workers are affected;
• whether it is isolated;
• whether similar cases exist;
• what caused the problem;
• what action is required; and
• how recurrence can be prevented.

 

The distinction between an isolated administrative error and a systemic control weakness can be important.

A useful principle is:

One error may be a finding. Repeated errors indicate a pattern. A pattern can point to a control failure.

 

6. Turn Findings into Remediation

 

The value of an audit depends on what happens after weaknesses are identified.

Each material finding should be capable of moving through a structured process:

Requirement → Evidence → Finding → Exposure → Remediation → Verification

Remediation should address both the affected case and, where relevant, the underlying system.

Correcting one worker’s record may resolve the immediate discrepancy. It does not necessarily prevent the same problem affecting another sponsored worker.

Where the cause is systemic, the organisation should consider whether changes are required to:

 

• HR processes;
• payroll controls;
• SMS administration;
• manager escalation;
• recruitment processes;
• right to work procedures;
• absence monitoring;
• corporate-change procedures;
• training;
• policies;
• systems; or
• management oversight.

 

7. Verify That Remediation Works

 

Closing an action should not depend solely on confirmation that a new procedure has been written, a training session has been delivered or a system change has been made.

The organisation should test whether the remediation works in practice.

This means distinguishing:

Action Completed

from:

Control Effective

Verification can involve testing subsequent employment events, reviewing later worker files, checking new SMS reports, testing payroll changes or interviewing relevant personnel.

The compliance assurance cycle should therefore continue:

Test → Find → Remediate → Verify → Monitor → Re-Test

 

8. Maintain Audit Readiness

 

Sponsor compliance does not stop when the audit report is completed.

The sponsored workforce and the organisation itself continue to change.

Ongoing assurance can include:

 

• HR-to-SMS reconciliation;
• HR-to-payroll reconciliation;
• right to work testing;
• immigration-expiry monitoring;
• worker-file sampling;
• role and salary review;
• absence monitoring;
• exception reporting;
• key personnel reviews;
• SMS access reviews;
• remediation monitoring;
• management information;
• event-driven audits; and
• monitoring changes to sponsor requirements.

 

This moves the organisation from periodic compliance checking towards continuing sponsor compliance assurance.

 

9. Prepare for Home Office Scrutiny Through Ordinary Compliance

 

The objective should not be to create a separate version of the organisation for a Home Office compliance visit.

Records, systems and working practices should already be capable of demonstrating how the sponsored workforce is managed.

Where Home Office scrutiny occurs, the organisation should be able to draw on its ordinary compliance evidence rather than attempting to reconstruct its position at short notice.

That includes being able to demonstrate:

 

• who is sponsored;
• what roles they perform;
• what they are paid;
• what hours they work;
• where they work;
• their immigration position;
• their right to work evidence;
• how absence is monitored;
• how employment changes are escalated;
• how reporting decisions are made;
• how required records are retained; and
• how sponsor compliance is governed.

 

10. The Final Sponsor Licence Compliance Audit Test

 

At the end of the audit, the organisation should be able to answer a central question:

Can the organisation demonstrate reliable systems for identifying, managing and evidencing sponsor compliance as relevant events happen?

That requires more than a compliant worker file.

It requires the organisation to demonstrate that:

the licence information is accurate;

the sponsored worker population is understood;

required records can be retrieved;

HR, payroll and SMS information can be reconciled;

sponsored workers are performing the roles on which their sponsorship is based;

salary and working arrangements are understood;

right to work and immigration expiry controls operate effectively;

relevant absences are monitored;

employment and organisational changes are identified and assessed;

required sponsor action is taken within the applicable framework;

key personnel understand their responsibilities;

operational teams know what information to escalate;

compliance does not depend on one individual;

audit findings are remediated;

remediation is verified; and

compliance continues to be monitored after the audit.

A sponsor licence compliance audit is therefore not simply a review of whether the organisation appears compliant at a particular moment.

It is a test of whether sponsor compliance is embedded within the organisation’s people, systems and ordinary business operations, and whether the employer can produce reliable evidence of that compliance when required.

 

Back to top

 

 

Section W: Sponsor Licence Compliance Glossary

 

Term	Meaning
Appendix D	Appendix D is the Home Office sponsor guidance setting out specified documents and records sponsors must keep in relation to their sponsor licence and sponsored workers. Depending on the circumstances, this can include evidence relating to right to work, immigration status, date of entry, worker contact details, absence, recruitment, employment and salary. An audit should test not only whether required evidence exists but whether it can be retrieved and has been retained for the applicable period.
Authorising Officer	The Authorising Officer is the person with overall responsibility for the sponsor licence and for the activities of the organisation’s SMS users. The role is important to sponsor governance and should involve appropriate oversight of how the organisation manages its sponsorship responsibilities.
Certificate of Sponsorship (CoS)	A Certificate of Sponsorship is an electronic sponsorship record assigned through the Sponsor Management System to a worker whom the organisation intends to sponsor under an applicable immigration route. For audit purposes, information on the CoS should be compared with the worker’s actual employment. A useful reconciliation is: CoS → Contract → Actual Role → Duties → Salary → Hours → Payroll
Compliance Audit	A compliance audit is a structured internal or independently conducted review of the sponsor’s records, systems, processes and operational practices against applicable sponsor requirements. The audit is intended to identify discrepancies, breaches and control weaknesses and to provide a basis for remediation and ongoing compliance assurance.
Compliance Visit	A compliance visit is Home Office compliance activity used to assess whether a sponsor or prospective sponsor is meeting, or is capable of meeting, the relevant sponsorship requirements. A Home Office compliance visit is distinct from an employer’s internal sponsor compliance audit. Internal Audit = Sponsor Tests Itself Compliance Visit = Home Office Tests Sponsor
Control Weakness	A control weakness is a deficiency in a process or system that increases the risk of sponsor non-compliance. A control weakness does not necessarily mean that a substantive breach has already occurred. Examples can include unclear escalation routes, inadequate business continuity, poor system integration or reliance on manual processes that are not independently checked.
Employer Checking Service (ECS)	The Employer Checking Service is a Home Office service employers can use in specified circumstances to request confirmation of an individual’s right to work where the prescribed online or documentary evidence is not otherwise available in the usual way. Where the Home Office confirms the relevant right to work through the ECS, the employer may receive a Positive Verification Notice.
Eligible Role	An eligible role is a role that satisfies the applicable sponsorship requirements under the relevant route and sponsor guidance. When auditing a sponsored role, employers should consider the actual role and duties rather than relying solely on the job title stated on the CoS or HR system.
Home Office	The Home Office is the UK government department responsible for immigration and the operation of the sponsor licensing system. UK Visas and Immigration forms part of the Home Office and administers immigration functions including sponsorship.
Key Contact	The Key Contact is the sponsor’s principal point of contact with the Home Office for matters relating to the sponsor licence. The organisation should ensure the nominated Key Contact remains appropriate and that relevant sponsor records are kept current.
Key Personnel	Key personnel are individuals appointed by the sponsor to specified roles associated with management of the sponsor licence. These include the Authorising Officer, Key Contact and Level 1 User roles and, during the transitional period, any remaining Level 2 Users. Key personnel arrangements should be reviewed as part of the organisation’s sponsor governance and business-continuity controls.
Level 1 User	A Level 1 User is an individual authorised to undertake relevant sponsor management functions through the Sponsor Management System. Level 1 Users can perform significant operational functions relating to the licence, including specified reporting and sponsorship activities. Audit testing should consider whether users remain appropriate, understand their responsibilities, use individual secure accounts and comply with current SMS security and multi-factor authentication requirements.
Level 2 User	A Level 2 User is a legacy SMS user role with more restricted permissions than a Level 1 User. No new Level 2 Users have been appointable since 9 September 2026. Existing Level 2 Users are subject to transitional arrangements and should be reviewed so they can be upgraded to Level 1 where eligible and appropriate or deactivated by 8 March 2027.
Mock Sponsor Compliance Audit	A mock sponsor compliance audit is an internal or independently conducted exercise intended to test how effectively an organisation can demonstrate sponsor compliance. It can include worker-file sampling, SMS testing, HR and payroll reconciliation, right to work checks, reporting reviews, interviews and evidence-retrieval testing. The purpose is to identify genuine compliance weaknesses rather than to create rehearsed answers for a Home Office visit.
Multi-Factor Authentication (MFA)	Multi-factor authentication is an additional security control for access to the Sponsor Management System. The Home Office began the phased introduction of mandatory SMS MFA in September 2026. As part of an audit, sponsors should test: SMS User → Correct Individual Account → Current Contact Details → MFA → Appropriate Access → No Credential Sharing User IDs, passwords and one-time passcodes should not be shared.
Positive Verification Notice (PVN)	A Positive Verification Notice is confirmation issued through the Employer Checking Service where the Home Office verifies that the individual has the relevant right to work. The employer should retain the PVN for the period required under the applicable right to work framework.
Remediation	Remediation is the process of addressing a compliance finding after it has been identified. Effective remediation can require both correction of the individual case and correction of the underlying process or control. A useful framework is: Finding → Root Cause → Action → Owner → Evidence → Verification → Closure
Right to Work Check	A right to work check is the prescribed process used by an employer to establish an individual’s right to work and, where the applicable requirements are satisfied, obtain the relevant statutory excuse against liability for a civil penalty for illegal working. Under the framework applying from 1 October 2026, the applicable checking methods can include:   a Home Office online right to work check; an appropriate Right to Work Digital Verification Service Provider check; or a manual document check.   The appropriate method depends on the individual’s circumstances. For sponsor audit purposes, the employer should also distinguish the statutory right to work regime from the sponsor’s separate record-keeping and compliance duties. A sponsor must ensure that an appropriate right to work check is carried out for any worker it sponsors, including where it is not the direct employer. From 1 October 2026, the statutory regime also extends to specified additional working arrangements beyond conventional employment.
Right to Work Digital Verification Service Provider (RtW DVSP)	A Right to Work Digital Verification Service Provider is a provider used within the applicable digital right to work checking framework for eligible individuals and documents. Use of a digital verification provider does not remove the employer’s responsibility to follow the applicable right to work requirements.
Risk Grading	Risk grading is an internal process used to assess the significance and remediation priority of audit findings. An organisation may, for example, use internal classifications such as:   Critical; Material; Control Weakness; and Improvement.   These are internal management categories. They are not Home Office classifications and do not predict what action the Home Office would take in relation to a particular finding.
Sponsor Duties	Sponsor duties are the continuing obligations imposed on organisations holding a sponsor licence. They include requirements relating to areas such as:   record keeping; reporting; worker monitoring; maintaining appropriate sponsor systems; co-operating with the Home Office; and not engaging in behaviour prohibited under the sponsorship system.   The precise duties applicable to a sponsor should be established from the current sponsor guidance and the relevant immigration route.
Sponsor Licence	A sponsor licence is the Home Office authorisation that allows an eligible organisation to sponsor qualifying workers under relevant sponsored immigration routes. Holding a licence brings continuing sponsor duties and compliance responsibilities. A sponsor licence is not transferable between organisations.
Sponsor Licence Compliance Audit	A sponsor licence compliance audit is a structured assessment of whether a sponsor’s records, systems, personnel and operational practices meet the requirements associated with holding and using a sponsor licence. The audit should test both documentary evidence and operational reality. A useful model is: Records → Reality → Controls
Sponsor Management System (SMS)	The Sponsor Management System is the Home Office online system used by licensed sponsors to undertake sponsor management functions. Depending on the user’s permissions and the applicable process, functions can include:   managing sponsor information; managing key personnel; assigning Certificates of Sponsorship; reporting relevant worker changes; reporting relevant organisational changes; and managing other aspects of the sponsor licence.   SMS records should be tested against HR, payroll and operational evidence during an audit.
Sponsored Worker	A sponsored worker is an individual sponsored by an organisation under an applicable work immigration route. For audit purposes, the sponsor should be able to reconcile the worker’s sponsorship and employment position through: CoS → Immigration Status → Contract → Actual Duties → Salary → Payroll → Hours → Location → Attendance → SMS
Sponsor Reporting	Sponsor reporting refers to the sponsor’s obligation to notify the Home Office of specified worker and organisational events within the applicable reporting framework. Many specified worker changes are generally subject to a 10-working-day reporting period, while specified organisational changes are generally subject to a 20-working-day reporting or action framework, subject to the particular requirement. A reporting audit should test: Event → Identification → Escalation → Assessment → Action → Evidence
Systemic Finding	A systemic finding is an audit issue indicating that a weakness may affect a wider population or process rather than representing an isolated error. Examples can include:   the same error appearing across multiple worker files; multiple managers misunderstanding the same escalation requirement; a defective HR-system configuration; a reporting process that consistently misses certain events; or a previous compliance problem recurring after remediation.   A systemic finding will usually justify expanding audit testing to establish the full affected population.
Verification	Verification is the process of testing whether remediation has actually corrected the identified compliance weakness. It is distinct from confirming that a remediation action has merely been completed. The assurance process is: Finding → Remediation → Implementation Evidence → Re-Test → Verification → Closure
Audit Readiness	Audit readiness describes the organisation’s ability to demonstrate sponsor compliance through its ordinary records, systems, personnel and working practices. It should not depend on last-minute preparation for a Home Office compliance visit. A sponsor maintaining audit readiness should be able to identify its sponsored workforce, retrieve required evidence, reconcile relevant systems, explain its compliance controls and demonstrate how relevant business events are assessed and managed.
Sponsor Compliance Assurance	Sponsor compliance assurance is the continuing process of testing, improving and monitoring the systems used to manage sponsor duties. A mature assurance cycle can be expressed as: Test → Find → Remediate → Verify → Monitor → Re-Test This recognises that sponsor compliance is not a static position. Workers, systems, personnel, businesses and Home Office requirements can change after an audit has been completed.

 

Back to top

 

Section X: Useful Links

 

The following official Home Office and GOV.UK resources provide primary guidance relevant to sponsor licence compliance audits, sponsor duties, record keeping, Sponsor Management System administration, right to work and Home Office compliance activity.

 

 

Resource	URL
Workers and Temporary Workers: Guidance for Sponsors – Part 1: Apply for a Licence Home Office guidance covering the general requirements for organisations applying for and holding a Worker or Temporary Worker sponsor licence, including key personnel and the wider sponsorship framework.	https://www.gov.uk/government/publications/workers-and-temporary-workers-guidance-for-sponsors-part-1-apply-for-a-licence
Workers and Temporary Workers: Guidance for Sponsors – Part 2: Sponsor a Worker Home Office guidance on sponsoring workers, including requirements relevant to Certificates of Sponsorship, sponsored roles, salary, employment changes and the conditions applying to individual sponsored workers.	https://www.gov.uk/government/publications/workers-and-temporary-workers-guidance-for-sponsors-part-2-sponsor-a-worker
Workers and Temporary Workers: Guidance for Sponsors – Part 3: Sponsor Duties and Compliance Core Home Office guidance for sponsor licence holders covering sponsor duties, reporting responsibilities, compliance requirements and Home Office action where sponsors fail to meet their obligations. This is one of the principal sources employers should use when reviewing sponsor compliance arrangements.	https://www.gov.uk/government/publications/workers-and-temporary-workers-guidance-for-sponsors-part-3-sponsor-duties-and-compliance
Appendix D: Keeping Documents – Guidance for Sponsors Appendix D sets out the documents and records sponsors are required to keep in connection with their sponsor licence and sponsored workers. It is a primary reference point when auditing worker files, contact histories, absence records, recruitment evidence, right to work evidence, date-of-entry evidence and document retention.	https://www.gov.uk/government/publications/keep-records-for-sponsorship-appendix-d
Sponsor Management System: SMS Manual 1 Official Home Office guidance on using the Sponsor Management System, including core SMS functions and sponsor administration.	https://www.gov.uk/government/publications/sponsor-management-system-sms-manual
Sponsor Management System: SMS Manual 9 The Home Office SMS manual series provides operational guidance for sponsors and SMS users carrying out sponsor management functions. This guidance should be considered when auditing whether SMS administration, user activity and reporting processes are operating correctly.	https://www.gov.uk/government/collections/sponsorship-management-system-sms-user-manuals
Sponsor Management System: SMS Manual 13 – Multi-Factor Authentication Home Office SMS guidance covers the introduction and operation of multi-factor authentication for Sponsor Management System users. Sponsors should use the current SMS guidance when reviewing individual user accounts, contact information, MFA arrangements and access security.	https://www.gov.uk/government/collections/sponsorship-management-system-sms-user-manuals
Right to Work Checks: An Employer’s Guide Official Home Office guidance explaining how employers should conduct right to work checks and establish a statutory excuse against liability for a civil penalty for illegal working where the applicable requirements are met. The current framework includes the applicable use of Home Office online right to work checks, Right to Work Digital Verification Service Providers and manual document checks.	https://www.gov.uk/government/publications/right-to-work-checks-employers-guide
Check a Job Applicant’s Right to Work The GOV.UK online service employers can use to check an individual’s right to work where the worker is eligible for an online Home Office check. Employers should use the prescribed employer checking service rather than relying on an individual’s separate view of their immigration status.	https://www.gov.uk/view-right-to-work
Employer Checking Service The Employer Checking Service can be used in specified circumstances where an employer needs the Home Office to verify an individual’s right to work and the required evidence cannot otherwise be established through the usual prescribed checking process.	https://www.gov.uk/employee-immigration-employment-status
Sponsor Compliance Visits – Home Office Caseworker Guidance Home Office caseworker guidance on sponsor compliance visits provides primary-source information on how compliance activity is approached by the Home Office. Employers preparing for possible Home Office scrutiny should distinguish the official compliance-visit framework from their own internal sponsor compliance audit process.	https://www.gov.uk/government/publications/sponsor-a-worker-guidance-for-employers-and-educators/sponsor-compliance-visits-accessible

 

Back to top