Enforcement activity has made one point clear. Right to work is no longer a question asked only by candidates. It is a direct risk issue for employers, and the cost of getting it wrong sits with the organisation.
For HR directors, the real test is not whether a worker appears eligible on day one. It is whether the business can show that the correct check was completed before employment started, that the method used met Home Office requirements, and that the evidence was stored in a way that supports a statutory excuse if an auditor or enforcement officer asks for it later.
That is the trade-off many teams still underestimate. A person may have valid permission to work, but a weak checking process can still leave the employer exposed to civil penalties, disruption and difficult questions about wider hiring controls.
Manual administration makes that exposure worse. Spreadsheets, email reminders and identity files saved across shared folders rarely give HR or compliance leaders a reliable audit trail. They create gaps in follow-up, inconsistent record-keeping and unnecessary dependence on individual managers remembering what to do. An integrated HR system changes that. It puts document capture, check timing, status tracking and retained evidence into one controlled process, which is how employers reduce guesswork and defend their decisions under scrutiny.
Understanding the Urgency of UK Right to Work Checks
Thousands of enforcement visits have already pushed right to work checks out of the admin category and into board-level risk. For employers with high turnover, multiple hiring managers, or large frontline workforces, this is now an exposure issue that can lead to penalties, operational disruption, and awkward scrutiny of wider recruitment controls.
The pressure point is simple. A worker may be entitled to work in the UK, but the employer still needs to prove that the check was done correctly, at the right time, and with the required evidence retained. That is the difference between having confidence in your process and having a problem file on your desk when enforcement officers ask questions.
What right to work means in practice
For the individual, right to work means they hold citizenship or immigration permission that allows employment in the UK. For the employer, it means following a prescribed process that creates a statutory excuse against civil penalty. The Home Office does not assess your intentions. It assesses whether your organisation completed the correct check before employment began and kept records that stand up to inspection.
That is why weak process design creates legal risk even where no one intended to hire unlawfully.
I have seen HR teams lose control of this when checks sit across email chains, shared drives, and local trackers. The usual failure points are predictable. A manager accepts the wrong document, a follow-up check date is missed, or evidence is saved in a format that makes later retrieval slow and incomplete. An integrated workflow reduces those gaps by putting document capture, review steps, expiry monitoring, and audit records in one place. For teams reviewing options, digital right to work check workflows in an integrated HR system show what a controlled process looks like in practice.
Why employers need a wider compliance lens
There is a useful parallel in landlord compliance. The Right to Rent penalty breakdown shows how quickly a checking duty turns into financial exposure when process discipline slips. The legal regimes differ, but the pattern is familiar. Enforcement tightens, record-keeping standards rise, and organisations with inconsistent local practices are usually the first to come unstuck.
The primary question is not whether HR understands the phrase "right to work." The primary question is whether the business has a checking process that works at scale, across locations, under deadline pressure, and with enough control to defend every hiring decision later.
Who Has the Right to Work in the UK
The simplest answer is that some people have an automatic and ongoing right to work, while others have permission that is time-limited, conditional or dependent on a particular immigration route. HR teams need that distinction clear from day one because the checking method and follow-up requirement can differ.
People with an automatic right
The straightforward category includes British citizens and Irish citizens. Their right to work is not tied to a visa expiry date. In operational terms, that usually means simpler checking, although the employer still has to complete the prescribed process properly.
A second category includes people with status that gives them permission to work without the same kind of sponsor-linked restriction you see on some visas. This category often introduces complexity for many organisations, because the person may be fully entitled to work, but the proof is digital rather than paper-based.
People with status that can be time-limited or conditional
This group includes many visa holders, some dependants, and people whose permission to work depends on the conditions attached to their immigration status. The problem for HR is that these conditions shift. If your internal guidance is out of date, you can make the wrong call while believing you're being careful.
A recent example shows how quickly that happens. The Skilled Worker visa salary threshold rose to £38,700 in April 2024, and from January 2024 international postgraduate students could only bring dependants if enrolled in a research programme, which changed the right-to-work position for many families and prospective employers, as set out in the BBC's coverage of the 2024 immigration rule changes.
The categories HR teams usually need to track
-
Automatic and unrestricted
British and Irish citizens generally sit here. -
Status-based and digitally evidenced
This often includes people proving eligibility through immigration status held online. -
Time-limited permission
These cases need active monitoring, not just an initial check. -
Dependant-based work rights
These can be lawful, but the underlying route matters and can change. -
Other authorised categories
Some people may have permission to work under a less familiar route. These need careful review against current guidance.
The biggest mistake isn't failing to recognise a common category. It's assuming that last year's answer still applies this year.
What works and what doesn't
What works is a category-based process with decision rules, prompts for follow-up checks and clear ownership inside HR. What doesn't work is relying on hiring managers to “spot anything unusual” or asking recruiters to interpret visa nuance from uploaded files.
The phrase “Do I have the right to work in the UK?” sounds simple. In hiring operations, it rarely is. The person may have the right to work, but only under conditions your team must understand and monitor.
How Individuals Prove Their Right to Work
Applicants usually think this is about handing over a passport. For many non-UK and non-Irish citizens, it now starts online.
The share code process
For most non-UK and non-Irish citizens, proof of status is a 9-character alphanumeric share code generated from their UKVI account. That code is valid for 90 days and must be given to the employer together with the individual's date of birth for online verification, as explained in this guide to obtaining and using a UK right to work share code.
That sounds simple, but applicants often miss one of the practical points. They may generate the wrong code, send a screenshot instead of the code itself, or assume the employer can verify status without the date of birth. HR teams that give clear pre-boarding instructions avoid a lot of unnecessary delay.
What applicants should prepare
If someone is proving their status digitally, they should have:
-
Their UKVI access details
They need to log in to the right account and generate the correct code. -
The share code itself
It should be sent accurately. A mistyped character wastes time. -
Their date of birth
The employer needs this alongside the code to complete the check. -
Enough time before the start date
Last-minute checking creates pressure and poor decisions.
A practical walkthrough of digital process design is covered in our article on digital right to work checks, especially where employers want a repeatable onboarding workflow rather than one-off admin.
When documents are still part of the process
British and Irish citizens may still prove their position through appropriate documents, subject to the employer using a compliant checking route. Applicants should provide original, valid evidence where required, and they should expect the employer to inspect it properly rather than just file a copy.
That sometimes frustrates candidates who think the process is excessive. It isn't. A careful employer is protecting both sides. If the evidence is unclear, damaged or inconsistent, the right answer is to pause and verify, not to wave it through.
A short explainer video can help internal teams standardise how they brief candidates:
The applicant experience matters
When applicants ask, “Do I have the right to work in the UK?”, what they usually mean is, “What exactly do you need from me?” The best HR teams answer that in plain language, with a checklist specific to the person's likely category. That cuts avoidable back-and-forth and gives the employer a cleaner audit trail.
An Employer's Guide to Conducting Compliant Checks
A compliant right to work check is a legal control, not an onboarding formality. The employer needs to choose the correct checking route, complete it before employment starts, and keep a clear record of what was checked, by whom, and when.
The pressure point is operational. Hiring managers want people in post quickly. HR needs a process that stands up if the Home Office ever asks to see the file. If those two priorities are not aligned, shortcuts creep in.
Required rules
Checks must be completed by an actual employee of the company before the individual starts work. The main exception is the use of a certified Identity Service Provider for British and Irish citizens who hold valid passports, where that route is permitted.
Outsourcing recruitment does not transfer legal responsibility for the check itself.
If an agency gathers documents but your organisation cannot show that an authorised internal employee completed the prescribed process, the liability still sits with the employer.
Online checks
For individuals with digital immigration status, the employer uses the official online service after the worker provides a valid share code. The task is wider than confirming that some form of status exists. The employer must confirm the identity matches the online record and that the permission shown covers the work on offer.
In practice, a sound online process includes three controls:
-
Identity matching
Confirm the person attending onboarding is the same person shown in the online profile. -
Permission review
Check for any obvious restriction that affects the role, hours, or type of work. -
Evidence capture
Save the profile result with the date of the check in a format that can be retrieved later.
For teams tightening policy and audit readiness, our guide to right to work checks in the UK explains where these controls tend to break down in real hiring workflows.
Manual checks
Manual checks need a disciplined process. The basic sequence is obtain, check and copy.
That means obtaining the original documents where the manual route is allowed, checking them in the presence of the individual, and keeping a clear copy that can be produced later. A quick glance at a passport is not enough. The person completing the check should look for consistency across names, dates, photographs, expiry dates, and any sign that the document is damaged or has been altered.
A simple reference table helps keep internal teams consistent.
| Document Type | Notes |
|---|---|
| British passport | Can be used where manual checking is appropriate and the prescribed process is followed |
| Irish passport | Can be used where manual checking is appropriate and the prescribed process is followed |
| Birth certificate with supporting evidence | Employers need to ensure the prescribed combination of evidence is reviewed properly |
| Immigration status evidence | Often requires the digital route rather than a purely manual one |
What disciplined employers build into the process
The strongest employers do not rely on memory or goodwill. They assign named ownership for checks, restrict approval rights to trained staff, use a standard evidence format, and place a hard pre-start control in the onboarding workflow.
That last point matters most. If the check is incomplete, the start date does not go live in payroll, IT provisioning, or rota planning. Modern HR systems are useful here because they remove discretion from a high-risk step. The system can require the right evidence, log the date of review, and keep the record in one place instead of leaving HR to chase documents across inboxes and shared drives.
That is how the process becomes defensible.
Penalties for Non-Compliance and Common Pitfalls
Civil penalties for illegal working can be severe, but the bigger problem for many employers is how ordinary the failure looks on day one. The file is incomplete. The follow-up date sits in someone's calendar instead of an owned process. A manager brings the start date forward to cover a shift, and HR is left trying to repair the audit trail after the person is already at work.
Where employers go wrong
Right to work compliance is process law, not a box-ticking exercise. The check must be done before employment starts, by the employer through the prescribed route, or by a certified IDSP where that route is permitted for British and Irish passport holders. Records then need to be kept for the duration of employment and for two years after it ends if the business wants to preserve a statutory excuse.
That sounds straightforward until it meets operational pressure.
The failures I see most often are not fraud cases. They are control failures:
-
Work starts before the check is complete
A department needs cover, the offer is accepted, and someone decides the missing evidence can be sorted later. -
Records exist, but not in a defensible form
HR may have seen the document or online status, but the copy, date, or audit note is missing or stored in the wrong place. -
The wrong checking route is used
Teams apply a manual process where an online check is required, or assume a recruiter's file is enough to protect the employer. -
Follow-up checks are not owned
Time-limited permission is logged once, then missed because there is no named owner and no dependable reminder structure.
Why manual methods fail under pressure
A spreadsheet can hold expiry dates. A shared drive can hold copies. Email can chase managers. None of those tools controls the decision that matters, which is whether someone is allowed to start work and whether the employer can prove the check was done correctly.
That is the trade-off HR leaders need to face plainly. Manual systems are cheap to set up and expensive to defend. They depend on people remembering the rule, using the correct route, storing evidence consistently, and returning to the file at the right time. Under hiring pressure, one break in that chain is enough to expose the business.
Weak right to work compliance usually comes from fragmented ownership, not lack of policy.
The wider cost of getting it wrong
The fine gets attention. The operational damage usually lands first.
Recruitment slows because teams no longer trust onboarding controls. Audit requests turn into urgent evidence hunts across inboxes and folders. If the organisation holds a sponsor licence, poor right to work discipline can trigger deeper scrutiny because it raises a broader question about whether immigration compliance is being managed properly.
This is why mature employers treat right to work checks as a liability control, not an admin task. The objective is not just to complete the check. It is to create a record the business can produce quickly, defend with confidence, and repeat consistently across every hire.
Streamlining Compliance with an Integrated HR System
A reliable right to work process should sit inside the wider employee lifecycle, not beside it. If your compliance evidence lives in one folder, your onboarding tasks in another system, and your reminders in individual calendars, you don't have one process. You have several disconnected ones.
What integrated systems fix
An integrated HR platform can remove the points where errors usually occur:
-
Pre-start gating
The new hire cannot progress to certain onboarding stages until required checks are complete. -
Structured evidence capture
Records are stored in a consistent format, against the employee file, with dates and ownership. -
Expiry monitoring
Time-limited permissions can trigger alerts before follow-up checks are due. -
Retention control
Evidence can be held in line with employment and post-employment requirements.
Why Microsoft-centric organisations benefit
For organisations already using Microsoft 365, the strongest approach is usually to keep sensitive HR and compliance data inside the same secure ecosystem rather than exporting it into disconnected apps. That supports cleaner permissions, easier auditability and less duplication of employee data.
Hubdrive product articles describe this well in practice. The model is an HR system built natively on Dataverse, with links into the tools teams already use for collaboration, documents and reporting. That matters because right to work checks aren't isolated events. They intersect with recruitment, onboarding, document management and offboarding.
A broader view of this architecture is set out in our article on HRIS software solutions.
One example of a system-led approach
DynamicsHub implements and supports Hubdrive's HR Management for Microsoft Dynamics 365 for UK organisations, including a Right to Work module that helps HR teams manage verification, evidence retention and ongoing monitoring inside the wider hire-to-retire process. In practical terms, that means the check isn't treated as a stray admin task. It becomes part of the employee record, the onboarding workflow and the compliance trail.
That's the shift employers need. Not more reminders. Better control.
Securing Your Organisation's Compliance Future
The question “Do I have the right to work in the UK?” deserves a precise answer. For employers, though, precision is only half the job. The other half is proving that the organisation checked correctly, at the right time, using the right method, and retained the evidence properly.
Manual processes still exist in many HR teams because they are familiar. Familiar doesn't mean safe. Once right to work checks are spread across email, spreadsheets and local folders, consistency drops and audit exposure rises.
The stronger model is clear. Define who can work. Match each person to the correct checking route. Complete checks before employment starts. Retain evidence in a controlled way. Then place the whole process inside an integrated HR system that supports reminders, retention and traceability without relying on memory.
DynamicsHub.co.uk. Experience HR transformation built around your business. Hubdrive's HR Management for Microsoft Dynamics 365 is the premier hire-to-retire solution, more powerful, more flexible, and more future-ready than Microsoft Dynamics 365 HR.
If your organisation wants a more controlled way to manage Right to Work compliance inside Microsoft 365, speak to DynamicsHub. Phone 01522 508096 today, or send us a message.
