Immigration Audit: Avoid Home Office Action

Section A: What is an Immigration Audit?

An immigration audit examines how an organisation manages its right to work obligations and, where it holds a sponsor licence, its compliance with sponsor duties.

The audit is a proactive form of risk management. It tests the organisation’s systems, records and working practices to identify weaknesses before they result in Home Office scrutiny or enforcement action.

All UK employers need effective controls to prevent illegal working. Licensed sponsors are subject to additional duties relating to sponsored workers, record keeping, reporting, key personnel and the management of the licence.

A full immigration audit should therefore examine right to work compliance across the workforce alongside sponsor compliance for sponsored workers. The two areas are connected, but they involve separate legal duties and can lead to different enforcement consequences.

The focus should be on how compliance operates in practice; written policies and checklists may support the organisation’s position, but will carry limited weight where recruitment, HR, payroll or management processes do not follow them consistently.

1. Independent immigration audit or Home Office compliance visit?

An independent immigration audit is commissioned by the employer to establish its current compliance position, identify exposure and determine what remedial action may be required, while a Home Office compliance visit is a regulatory assessment. UKVI may examine HR systems, personnel files, recruitment practices, payroll records, sponsored roles and reporting arrangements to determine whether the organisation is meeting its sponsor duties.

An independent audit allows the employer to investigate discrepancies, obtain advice and address weaknesses before UKVI becomes involved. Once the Home Office opens an enquiry, the same issues may be treated as evidence of wider or systemic non-compliance.

2. When should an employer conduct an immigration audit?

Immigration audits can form part of routine compliance monitoring, but certain events can make an independent audit an essential measure, such as an announced Home Office visit, a sponsor licence application, a merger or acquisition, rapid workforce growth, changes in key personnel, incomplete right to work records or inconsistencies between Certificates of Sponsorship, HR files and payroll data.

An audit should also be considered where the organisation has itself identified a possible breach or issue with its immigration compliance, for example, a late right to work check, an unreported change in a sponsored worker’s role or salary, missing sponsor records or uncertainty over whether a worker continues to meet the conditions of their permission.

The need for an audit will be stronger where the organisation recruits across several sites, relies on different teams to manage immigration compliance or has experienced significant operational change. These factors increase the risk of inconsistent records, missed reporting duties and weak escalation between HR, payroll and management.

3. Why do audit findings require careful assessment?

Immigration audit findings are rarely binary. A missing document may be an isolated record-keeping failure, evidence that the prescribed process was not followed or an indication of wider non-compliance.

The correct response will depend on what happened, when it happened, which rules applied at the time and whether the issue remains ongoing. Correcting an HR record will not necessarily restore a statutory excuse or remedy a sponsor breach.

The same caution applies to Home Office reporting. Some changes must be reported, while others can be resolved internally. A late or unnecessary report creates a formal record of the issue and may prompt further enquiry.

Where a finding may affect the statutory excuse, sponsor licence or immigration position of an employee or sponsored worker, the organisation should establish the legal position before amending records, making a report or taking action against the worker.

Section B: What Does an Immigration Audit Cover?

There is no universal, prescriptive format for an immigration audit. To be effective, the scope should reflect the organisation’s workforce, recruitment model and sponsor activity. Likewise, limiting the audit to right to work will not provide assurance over sponsor licence compliance, while an audit confined to sponsored workers may miss wider failures affecting the rest of the workforce.

The review should also test how immigration compliance operates across recruitment, HR, payroll and workforce management. Policies and checklists form part of the evidence, but the main question is whether the organisation follows the correct procedures in practice and can demonstrate this through reliable records.

1. Right to work compliance

The audit should examine how the organisation checks an employee’s right to work before employment begins and how evidence of the check is retained. The prescribed process is important because holding a passport copy, share code or immigration document will not necessarily establish a statutory excuse against a civil penalty.

The review should consider whether the correct checking method was used, whether the check was completed at the required time and whether any restrictions on the work permitted were identified. For employees with time-limited permission, it should also test how expiry dates and follow-up checks are monitored.

Sampling should extend beyond sponsored workers. British and Irish employees, workers with indefinite permission and employees recruited at different sites or by different teams should also be included. This can expose inconsistent practices and help establish whether checks are applied fairly across the workforce.

Current Home Office guidance sets out the steps employers can take to establish or retain a statutory excuse against liability for employing an illegal worker.

2. Sponsor licence systems and records

For licensed sponsors, the audit should assess whether the organisation continues to meet its reporting, monitoring and record-keeping duties.

The review should check that sponsor licence details remain accurate, key personnel are still suitable and Sponsorship Management System access is restricted to trained and authorised users. It should also examine how reportable changes are identified and escalated within the organisation.

Sponsored worker files should contain the records required under Appendix D, including evidence relevant to recruitment, right to work, salary, attendance and the sponsored role. Records may be held electronically, but they should be complete, legible and capable of being produced promptly if requested by the Home Office.

The audit should not assume that the presence of a document proves compliance. Missing dates, incomplete copies or records created retrospectively may weaken the sponsor’s ability to show what happened at the relevant time.

3. Sponsored worker roles and salary

The information recorded on a Certificate of Sponsorship should correspond with the worker’s actual employment. The audit should compare the CoS with the employment contract, job description, payroll records, working hours, work location and day-to-day duties.

Changes that may have occurred after sponsorship should be considered in detail, such as promotions, restructures, reduced hours, salary changes, unpaid leave, remote working or deployment to another site, as these are common areas of non-compliance.

Salary issues are currently a key area of focus for the Home Office. The rules in this area are complex, and especially fact-sensitive. The assessment may depend on the applicable salary option, occupation code, going rate, guaranteed working hours and the treatment of deductions or unpaid absence.

4. Consistency between HR, payroll and sponsor records

Home Office scrutiny is not confined to documents held by the sponsor licence team. Compliance officers may compare Certificates of Sponsorship with HR files, payroll data, attendance records and information provided by managers or sponsored workers.

An immigration audit should therefore reconcile the principal records held across the organisation. Common discrepancies include different job titles, salaries, start dates, working hours or work locations recorded in separate systems.

These inconsistencies often arise because information does not move effectively between departments. Payroll may implement a salary change without notifying the Level 1 user, or a manager may change a worker’s duties without recognising that the sponsorship position needs to be reviewed.

The audit should establish which record is accurate, when the inconsistency arose and whether any reporting or remedial action is required. Records should not be amended merely to make them match before the factual position has been confirmed.

5. Governance, training and operational controls

Immigration compliance depends on more than the work of the Level 1 user. Recruitment, HR, payroll, line managers and senior leadership may all hold information relevant to right to work or sponsor duties.

The audit should identify who is responsible for each part of the process and whether the organisation has effective escalation routes for changes in salary, role, location, attendance or immigration status.

It should also assess whether personnel have received training appropriate to their responsibilities and whether the Authorising Officer exercises meaningful oversight of the sponsor licence. Reliance on an external adviser does not transfer responsibility away from the licensed sponsor.

Written procedures should be tested against actual practice. A policy may require right to work checks before employment begins or prompt reporting of sponsored worker changes, but file sampling and staff interviews may show that these controls are not operating consistently.

The Home Office sponsor guidance sets out the duties applying to licensed sponsors and the action that may follow where those duties are breached or suspected of being breached.

A properly scoped audit should leave the organisation with a clear view of where its systems are working, where the evidence is incomplete and which findings require further legal assessment.

Section C: What Compliance Risks Can an Immigration Audit Identify?

An immigration audit may identify isolated administrative errors or evidence of a wider failure in the organisation’s compliance systems. The significance of each finding will depend on the legal duty affected, the number of workers involved, how long the issue has continued and whether the organisation remains exposed.

A discrepancy should not automatically be treated as a breach, but nor should it be corrected without establishing the factual and legal position. The principal areas of risk are set out below.

1. Defective right to work checks

An employer may be unable to establish a statutory excuse where a prescribed right to work check was not completed correctly before employment began. Common problems include missing evidence, late checks, incomplete online records, incorrect use of a checking method or failure to carry out a required follow-up check.

The presence of a passport copy, share code or immigration document does not establish that the prescribed process was followed. The employer must be able to show how and when the check was completed and that any restrictions on the work permitted were considered.

A defective check does not necessarily mean that the individual was working illegally. The worker may have held valid permission throughout the period of employment, while the employer failed to secure the statutory protection available under the right to work scheme. The two issues should be assessed separately.

A new check may confirm the worker’s current status, but it will not usually repair the absence of a statutory excuse for an earlier period. Employers should therefore obtain advice where historic exposure may exist rather than treating a replacement document as a complete remedy. Home Office guidance confirms that the statutory excuse depends on the prescribed check being completed in the required manner.

2. Missing or late sponsor reports

Sponsors must report specified changes affecting their organisation and sponsored workers through the Sponsorship Management System. Audit findings commonly include unreported changes to role, salary, working hours, work location, absence, employment dates or key personnel.

Reporting failures often arise because information remains within HR, payroll or operational management and does not reach the Level 1 user. The organisation may therefore have implemented a change lawfully under the employment contract while failing to consider its immigration consequences.

The correct response will depend on the nature and timing of the event. Some changes can be reported under the existing sponsorship, while others may require a new Certificate of Sponsorship and a further immigration application.

A missed reporting deadline does not remove the need to assess the underlying issue. A late report may be necessary, but it also creates a formal Home Office record of the failure and may prompt further enquiries. The facts and potential consequences should be reviewed before the report is submitted.

3. Sponsored role and salary discrepancies

The role and salary recorded on the Certificate of Sponsorship should correspond with the worker’s actual employment. Differences may arise following promotion, restructuring, redeployment, reduced hours, unpaid absence, salary changes or a move to another work location.

The audit may also identify that the occupation code does not reflect the worker’s actual duties or level of responsibility. Job titles alone are not determinative. The assessment should consider the substance of the role and how it operates within the organisation.

Salary compliance can require detailed analysis of the applicable route, salary option, occupation code, going rate, working hours and the treatment of deductions or absence. Payroll records should be considered over a representative period rather than against a single payslip.

Not every difference invalidates the sponsorship. The issue may be an administrative inconsistency, an outstanding reporting obligation or a substantive breach affecting the worker’s permission. The organisation should establish which position applies before amending records or changing the worker’s terms.

4. Incomplete sponsor records

Licensed sponsors must retain the documents specified under Appendix D and be able to produce them when requested. The current Appendix D guidance, valid from 20 May 2026, sets out the record-keeping duties applying to Worker and Temporary Worker sponsors.

Audit findings may include missing recruitment evidence, incomplete contracts or job descriptions, outdated contact details, gaps in payroll or attendance records and insufficient evidence supporting the occupation code or sponsored role.

Risk also arises where records exist but are fragmented across email accounts, payroll systems, recruitment platforms or local site files. A sponsor may struggle to demonstrate compliance if the information cannot be retrieved promptly or reconciled into a reliable account.

Missing evidence should not be recreated or backdated in a way that suggests it existed at the relevant time. A retrospective note can explain what has since been established, but it may not cure the original failure to create or retain the required record.

5. Weak governance and SMS control

Sponsor compliance cannot rest entirely with one Level 1 user or an external adviser. The Authorising Officer retains overall responsibility for the licence, while recruitment, HR, payroll and operational managers may all hold information relevant to sponsor duties.

Weak governance may be indicated by former employees retaining SMS access, shared login credentials, insufficient cover during absence, Certificates of Sponsorship assigned without adequate review or no senior oversight of material reports and compliance concerns.

Risk also increases where SMS users understand how to operate the system but do not recognise the legal significance of the information being submitted. Incorrect occupation codes, salary figures, working hours or work locations can have consequences for both the sponsor and the worker.

The Home Office guidance explains the duties placed on licensed sponsors and the action that may be taken where those duties are breached or suspected of being breached.

An audit should therefore test ownership, access controls, staff knowledge and senior oversight rather than focusing only on whether SMS actions have been completed.

6. Inconsistent HR, payroll and operational data

Differences between Certificates of Sponsorship, employment contracts, payroll data and actual working arrangements are a recurring source of sponsor risk.

Examples include different salaries, job titles, start dates, hours or work locations appearing in separate systems. Payroll may process a reduction in hours without informing the sponsor team, while a line manager may change duties or approve a move to another site without considering whether the change must be reported.

These discrepancies do not always establish non-compliance, but they can undermine the sponsor’s ability to explain its position during a Home Office visit. They may also indicate that the organisation lacks an effective process for escalating immigration-relevant information.

The employer should establish which record is accurate, when the inconsistency arose and whether it affects the worker’s sponsorship or the organisation’s reporting duties. Simply changing the systems so that they match may conceal the history of the issue without resolving the underlying risk.

Where the audit identifies repeated discrepancies, the problem is unlikely to be confined to individual files. It may indicate a systemic failure requiring wider investigation, revised controls and independent legal assessment.

Section D: What Happens When an Immigration Audit Finds a Problem?

An immigration audit should produce a clear assessment of the organisation’s exposure and a prioritised plan for addressing the findings. The response should reflect the seriousness of the issue, the evidence available and whether the risk is historic, ongoing or capable of affecting a worker’s immigration status.

Not every finding will amount to a breach. Equally, an issue should not be dismissed as administrative merely because it can be corrected easily. The legal significance depends on what happened, when it happened and which rules applied at the time.

1. Prioritising the findings

The audit findings should be separated into distinct categories, including administrative weaknesses, missing evidence, potential breaches, ongoing exposure and matters requiring urgent legal advice.

A missing internal document may be capable of correction without wider consequence. A late right to work check, unreported salary change or mismatch between a sponsored role and the worker’s actual duties may carry materially greater risk.

Each finding should identify the duty affected, the workers involved, the period of exposure and the action required. This allows the organisation to address the most serious issues first rather than treating every defect in the same way.

2. Establishing the facts before correcting records

Remedial action should begin with a factual investigation. Records should not be amended merely to make them consistent, particularly where the change could obscure when the issue arose or what information was held at the relevant time.

The organisation may need to compare Certificates of Sponsorship, contracts, payroll data, attendance records, manager evidence and the worker’s actual duties before deciding whether a breach has occurred.

Retrospective notes can be used to explain what has since been established, but they should be labelled accurately. Backdating or reconstructing records in a way that suggests they existed earlier can create a more serious compliance problem.

The same caution applies to right to work findings. A missing or defective check does not necessarily establish that the person worked illegally, but a new check will not usually restore the statutory excuse for an earlier period.

3. Deciding whether reporting or disclosure is required

Some audit findings can be resolved internally. Others trigger a sponsor reporting duty or affect information already provided to the Home Office.

The correct response will depend on the nature of the event, when it occurred, whether the reporting deadline has passed and whether the existing sponsorship remains valid.

A late report may be necessary, but it also creates a formal Home Office record of the issue and may prompt further scrutiny. An unnecessary or poorly framed report can widen the enquiry, while failure to make a required report can create a separate breach.

The organisation should therefore establish the legal basis for reporting before making contact with the Home Office. Matters involving role changes, salary reductions, prolonged absence, corporate restructuring or potential illegal working should generally be reviewed carefully before action is taken.

4. Implementing remedial action

Remediation should address both the individual finding and the process that allowed it to arise.

Depending on the issue, the organisation may need to complete a current right to work check, correct records, make a sponsor report, amend internal procedures, retrain staff or introduce stronger approval and escalation controls.

Where salary, duties or working arrangements are involved, immigration compliance should not be considered in isolation. Proposed changes may also have employment law, contractual or workforce implications.

The organisation should retain a clear record of the evidence reviewed, the decision taken and the action completed. That record may become important if the Home Office later examines the same issue.

5. Testing whether the risk has been resolved

Remediation should be tested after implementation. A revised policy or training session does not establish that the underlying problem has been removed.

A follow-up review should confirm that high-risk findings have been closed, required reports have been made and new controls are operating in practice.

Repeated errors after remediation may indicate that responsibility remains unclear or that the organisation has not addressed the underlying cause. In those circumstances, a wider review may be required.

Where the findings may expose the organisation to a civil penalty, sponsor licence action or consequences for a worker’s immigration status, professional legal advice should be obtained before the final remediation plan is implemented.

Section E: Independent Immigration Audit Support

An immigration audit can expose issues that are not straightforward to resolve. A missing record may be an isolated administrative failure, evidence that the correct process was not followed or an indication of wider non-compliance across the organisation.

The legal and operational consequences will depend on the facts. The same finding may affect the employer’s statutory excuse, its sponsor licence and the immigration position of the worker concerned. Remedial action taken without first establishing the position can create further inconsistencies or draw unnecessary Home Office scrutiny.

Independent advice is advisable where an internal review has identified possible breaches, records are incomplete or the organisation cannot reconcile the information held across its HR, payroll and sponsorship systems.

External support should also be considered where the Home Office has announced a compliance visit, requested information or raised concerns about the organisation’s licence. The available time may be limited and any response will need to be accurate, properly evidenced and consistent with information already provided to UKVI.

Corporate changes can also create sponsor risk. Mergers, acquisitions, restructures and changes in ownership may affect the existing licence and the sponsorship of affected workers. The immigration position should be assessed as part of the transaction rather than addressed after the event.

Early advice is particularly important where the findings involve potential illegal working, salary or role discrepancies, missed sponsor reports or uncertainty over whether a worker continues to meet the conditions of their permission.

Internal teams may be able to identify that something is wrong without being able to determine its legal significance. They may also have designed the process, completed the check or made the report now under review.

An independent audit provides objective scrutiny of the evidence and the systems behind it. The review should distinguish between administrative weaknesses, potential breaches and matters requiring immediate action.

Not every discrepancy must be reported to the Home Office. Some issues can be corrected internally, while others trigger specific reporting duties or affect the validity of the sponsorship. A late report may be required, but it also creates a formal record of the failure and may lead to further questions.

The same caution applies to right to work findings. A current check may confirm that the employee has permission to work, but it will not usually restore a statutory excuse for an earlier period. The employer should understand the extent of any historic exposure before treating the matter as resolved.

What an external immigration audit should deliver

The audit should be tailored to the organisation’s workforce, sponsor activity and areas of concern. It may include right to work sampling, sponsor licence review, sponsored worker checks and comparison of Certificate of Sponsorship data with HR, payroll and operational records.

The value lies in the assessment, not the volume of documents reviewed. The employer should receive a clear account of the risks identified, the evidence supporting each finding and the action required.

The report should identify which matters can be corrected internally, which require further investigation and which should be reviewed before any communication is made to the Home Office. Recommendations should be prioritised according to legal and operational exposure rather than presented as an undifferentiated list of compliance improvements.

Where appropriate, the review can also include a mock Home Office audit. This tests whether records can be produced promptly, whether key personnel understand their responsibilities and whether the organisation can explain how its compliance systems operate in practice.

Summary

An immigration audit gives employers the opportunity to identify and correct compliance weaknesses before they become regulatory problems. It provides an independent assessment of whether right to work procedures, sponsor licence duties, record-keeping and day-to-day HR practices meet current Home Office requirements.

The value of an audit extends beyond immigration compliance alone. Weaknesses in recruitment records, payroll, reporting or workforce management can expose broader governance issues and increase the risk of enforcement action if UKVI investigates the organisation. Once an enquiry has started, employers have far less control over the evidence available, the remedial action that can be taken and the overall direction of the investigation.

Immigration compliance should therefore be treated as an ongoing governance responsibility rather than a one-off exercise linked to a sponsor licence application or Home Office visit. Regular audits, supported by prompt remedial action where issues are identified, place employers in a stronger position to manage legal risk, maintain sponsor compliance and demonstrate that effective systems and controls are operating throughout the organisation.

Need Assistance?

DavidsonMorris advises employers on right to work compliance, sponsor licence management and Home Office enforcement action.

Our immigration audit services are tailored to the organisation’s workforce, sponsor activity and immediate risk. Support can include right to work reviews, sponsor licence audits, sponsored worker checks, CoS and payroll reconciliation and mock Home Office compliance visits.

Where the audit identifies historic or ongoing non-compliance, we can assess the legal position, advise on remedial action and determine whether reporting or other contact with the Home Office is required.

For advice on an immigration audit or support with an announced Home Office compliance visit, contact our immigration compliance solicitors.

Immigration Audit FAQs

What is an immigration audit?

An immigration audit is a structured review of an employer’s right to work procedures and, where applicable, its compliance with sponsor licence duties. It tests whether the organisation’s records, systems and working practices meet the relevant Home Office requirements.

Is an immigration audit the same as a Home Office compliance visit?

No. An independent immigration audit is commissioned by the employer to identify weaknesses and plan remedial action. A Home Office compliance visit is a regulatory assessment that may lead to further investigation or enforcement action where UKVI identifies non-compliance.

Does every employer need an immigration audit?

There is no general requirement for every employer to commission a formal audit. All employers remain responsible for preventing illegal working, while licensed sponsors are also subject to reporting, monitoring and record-keeping duties. Regular audit activity can help establish whether those obligations are being met in practice.

What does an immigration audit cover?

The scope will depend on the organisation. A review may cover right to work checks, sponsor licence records, key personnel, SMS controls, Certificates of Sponsorship, sponsored roles, salary, working hours, absence monitoring and consistency between HR, payroll and operational records.

How is an immigration audit different from a right to work audit?

A right to work audit focuses on the checks used to confirm employees’ permission to work and the evidence retained by the employer. A wider immigration audit may also examine sponsor licence duties and the organisation’s management of sponsored workers.

Can an immigration audit prevent a civil penalty?

An audit cannot guarantee that enforcement action will be avoided. It can identify missing or defective checks, confirm current exposure and support remedial action. A new right to work check will not usually restore a statutory excuse for an earlier period when no valid check was held.

What happens if the audit identifies a sponsor breach?

The organisation should establish the facts, assess whether the breach is historic or ongoing and determine whether reporting or other action is required. The correct response will depend on the nature of the failure and its effect on the licence and any sponsored worker.

Should every audit finding be reported to the Home Office?

No. Some findings can be corrected internally, while others trigger specific sponsor reporting duties. A late or unnecessary report can create further scrutiny, so the legal basis for reporting should be established before contact is made.

Can missing records be recreated after an audit?

Missing information can sometimes be reconstructed from reliable evidence, but retrospective records should be labelled accurately. Employers should not backdate documents or create records that suggest a process took place when it did not.

When should an employer seek professional advice?

Independent advice should be considered where the audit identifies potential illegal working, missing statutory protection, sponsor reporting failures, salary or role discrepancies, corporate change or any issue that may affect a worker’s immigration status or the organisation’s sponsor licence.

How often should an immigration audit be carried out?

The appropriate frequency will depend on workforce size, sponsor activity, recruitment volume, previous findings and the pace of organisational change. An additional review may be needed following a merger, restructuring, change in key personnel or material change to the sponsored workforce.

Can an immigration audit be carried out remotely?

Much of the document review can be completed remotely where records are held electronically. Interviews, operational testing or a mock Home Office visit may require virtual meetings or an on-site element, depending on the scope of the review.

Immigration Audit Glossary

Additional Resources