Before Day One: Auditing Digital Right-to-Work Checks as a UK Software Purchase

Right to work checks once belonged to the paper end of onboarding: a passport photocopy, a signed checklist and a file that might never be opened again. In 2026 they are more likely to involve an API call, a share code and a dashboard that a candidate never sees. That shift has created a distinct software market—and a procurement problem that many UK employers have not yet named.

The compliance obligation has not changed. What has changed is the chain of suppliers, data flows and automated decisions that now sit behind a simple confirmation that someone may work in the UK. A provider that looks like an onboarding convenience is, in practice, part of the employer's compliance record. It should be bought with the same discipline as any other system that holds personal data and supports a statutory process.

Start with the obligation, not the demonstration

A useful audit begins by separating the legal requirement from the vendor's product story. HR teams should be able to state which checks are performed manually, which are performed through the Home Office online service, and which rely on a certified identity service provider. They should also know who inside the organisation is authorised to make a final decision when a check returns an ambiguous result.

That map matters because providers often sell a single workflow for several different cases. A British or Irish citizen may be checked through an identity document validation technology provider; a foreign national may need to use a Home Office online account and share code. The software should make those routes clear rather than flattening them into one green tick. If the product cannot explain which route was used, the audit trail is already weak.

Accreditation is a floor, not a badge

The first procurement question is not whether the provider has a polished mobile app. It is whether the provider is certified for the checks it claims to perform. For digital identity verification, that means evidence of the relevant Home Office certification and a clear statement of the scope of that certification. A logo on a sales page is not enough; buyers should ask for the certificate, the date and the specific services covered.

Beyond the immigration-specific accreditation, look for the ordinary signals of a supplier that can be trusted with identity data: ISO/IEC 27001 certification, Cyber Essentials Plus, independent penetration testing, a current data processing agreement and a named subprocessor list. Ask where data is stored and whether any element of the service is delivered from outside the UK. Ask how the provider handles a security incident and what contractual notification period applies.

This is not box-ticking for its own sake. Identity verification touches special category data when biometric templates are involved, and it always touches personal data. A provider that cannot answer basic questions about encryption, access control and deletion is not a safe default simply because it is cheap per check.

The data you hand over: retention, biometrics and deletion

Right-to-work checks create a record that may need to be retained for the duration of employment and for a period afterwards. The supplier's retention policy therefore needs to be read alongside the employer's own obligations, not instead of them. Buyers should ask whether the provider stores document images, selfie images, liveness recordings or biometric templates. If biometric templates are created, the employer needs a clear lawful basis, a data protection impact assessment and a retention period that is no longer than necessary.

Deletion is the test that separates mature providers from convenient ones. Can the employer request deletion of candidate data after a decision has been recorded? Is deletion evidenced in writing? Are backups purged on the same schedule? What happens to data if the contract ends? A provider that retains everything indefinitely because it may be useful for model training is not offering a neutral service.

What a credible audit trail should contain

An audit trail is not a screenshot of a result. It should allow someone who was not involved in the check to reconstruct what happened, when and by which method. At a minimum, the record should show the candidate, the date and time, the check method, the document type or share code used, the result returned, the identity of the person or system that made the decision, and the retention period applied.

It should also be exportable in a format that remains readable if the provider is replaced. Tamper-evident logs are preferable, but the employer should still be able to produce a clear report for an auditor or a regulator. The trail should distinguish between a verification result and an employment decision; those are not the same thing, and conflating them can obscure accountability.

Pricing at volume: per check is not the cost

A per-check price is a headline, not a budget. Buyers should model the total cost at realistic volumes, including failed attempts, rechecks, additional document uploads, liveness retries, integration work, training and support. Ask whether there is a minimum commitment, a platform fee or a charge for retaining records beyond a set period. Ask what happens when a candidate cannot complete a digital check and the employer has to fall back to a manual process.

Run the numbers at several volumes—perhaps 50, 250 and 1,000 checks a year—and include the internal time spent on exceptions. The cheapest provider per check can become the most expensive one if it creates manual rework or if its integration requires significant IT effort. Cost per completed, defensible check is the more honest metric.

The manual fallback you still need

Every digital process needs a contingency. Networks fail, providers have outages, candidates may lack a suitable smartphone or need an accessibility adjustment, and some documents may not fit the automated route. The employer should retain a documented manual checking process, trained staff, current guidance on acceptable documents and a clear route for escalating ambiguous cases.

The fallback should be tested, not merely written down. A short annual exercise—one candidate file, one system outage scenario, one exception—will reveal whether the organisation can still meet its obligations without the software. That is not a reason to avoid digital verification; it is a reason to buy it as part of a resilient process rather than as a replacement for one.

A practical audit sequence

For UK employers planning a purchase or renewal, a short sequence is enough to expose most weaknesses. Map the checks the organisation actually performs. List every provider and subprocessor involved. Request accreditation, security and retention evidence. Ask for a sample audit trail. Model total cost at volume. Test the manual fallback. Set a review date and assign ownership to a named role.

The right-to-work stack is now part of the procurement estate. It deserves a contract, a data protection review and a contingency plan—not just a place in the onboarding checklist.