BS 10119 Audit Guide: De-Risking Security Labour Supply Chains
A labour supply chain audit rarely fails because one file is untidy. It fails because the evidence trail cannot prove control.
For manned guarding agencies and labour providers bidding for primary security contracts, navigating a BS 10119 audit (superseding the legacy COP 119 code of practice) is more than another compliance hurdle. It represents a definitive assessment of whether supplementary personnel are sourced, vetted, paid, and deployed under verifiable governance. It tests whether labour is sourced, checked, paid, deployed, and monitored in a way a client, auditor, or main contractor can trust.
The pressure usually arrives at the worst time. A tender deadline is close. A mobilisation is live. A client asks for proof that every operative supplied through the chain has the right to work, has been vetted correctly, is being paid through compliant channels and has not been introduced through an unapproved subcontractor.
That is when weak records become a commercial risk.
This guide explains the operational areas that most often cause pain in provision-of-labour audits, and how security providers can prepare before an auditor asks difficult questions.
Why BS 10119 Audit Compliance Matters in Security Labour Supply
Security contracts often involve more than one employer or supplier. A guarding company may hold the main contract, then use a labour provider to cover vacancies, seasonal peaks, specialist sites or short-notice absences. That model can work well, but it raises a simple question.
Who controls the risk?
A client may see one security brand at the front gate, but the labour behind that service may come from several sources. If those sources are not controlled, the primary contractor can inherit problems around right-to-work checks, tax status, screening, training, licensing, pay, holiday entitlement and worker welfare.
Achieving compliance through a formal BS 10119 audit brings essential operational discipline to temporary staffing. When aligned with an overarching ISO 9001 security compliance framework (specifically Clause 8.4 vendor controls), it turns third-party governance into a decisive commercial tender differentiator. For incumbent suppliers, it can become a condition of keeping work. For labour providers, it can decide whether they are trusted suppliers or removed from the chain.
The audit is not just a box-ticking exercise. It looks for evidence that controls exist in practice.
That means auditors tend to ask questions such as:
Can the supplier show who supplied each operative?
Has each worker's right to work been verified properly?
Are PAYE, tax and statutory deductions being handled correctly?
Does the contract allow subcontracting, and has any subcontracting been approved?
Are vetting files complete, current and consistent?
Can the company explain how it samples, reviews and escalates issues?
If the answer is "we think so", the file is not ready.
Building an Unbroken Evidence Trail: Onboarding to Deployment
A common audit weakness is a gap between HR records, operations records and payroll records. Each team may hold part of the picture, but no one can connect the evidence from start to finish.
For a provision-of-labour audit, the trail should show each operative's journey.
A strong file usually proves:
Who recruited or supplied the worker
When the worker was onboarded
Which checks were completed before deployment
Who reviewed and approved those checks
Which site or contract the worker attended
Which shifts were worked
How the worker was paid
Whether any issues were raised later
The strongest systems do not rely on memory. They use consistent naming, dated forms, controlled folders and clear approval points. If an auditor picks a worker from a timesheet, the business should be able to trace that person back to the labour source and forward to payroll without hunting through inboxes.
This is where many firms expose themselves. They can show a right-to-work document, but not when it was checked. They can show a licence, but not who verified it. They can show timesheets, but not that the worker came through an approved supplier.
The audit question is rarely "does a document exist?" It is "does the document prove the control worked at the right time?"
Right-to-Work Verification: Eliminating Critical Audit Vulnerabilities
Right-to-work checks are among the first areas auditors review because the legal and reputational risks are high. A photocopy or image alone is not enough to prove a compliant process.
A reliable right-to-work trail should show the method used, the date of the check, the person who carried it out, and the outcome. Where an online check or share code process is used, the record should show that the result was reviewed before work began.
For labour supply chains, the main contractor also needs comfort that the labour provider is not simply asserting compliance. There should be a process for reviewing evidence, testing samples and rejecting incomplete files.
Typical audit issues include:
Checks completed after the first shift
Expired permission with no follow-up record
Missing evidence of who verified the document
Inconsistent file naming across suppliers
Documents stored without dates or audit notes
Reliance on an agency declaration with no sampling
When the labour provider supplies workers at pace, these errors can multiply quickly. A fast mobilisation does not excuse weak evidence. If anything, high-volume mobilisation needs tighter controls because more people touch the process.
A practical approach is to create a pre-deployment gate. No worker should be released to operations until the right-to-work record is complete, reviewed and logged. The operations team should not be able to override that gate without a controlled exception process.
PAYE, Tax, and Statutory Compliance in Labour Supply Chains
A labour supply chain audit will often look beyond vetting and identity checks. It may also test whether workers are being paid through lawful and transparent arrangements.
For security providers, this matters because labour costs are a major part of contract pricing. If one supplier offers rates that seem unusually low, the saving may come from poor employment practices, incorrect tax treatment or non-payment of statutory obligations.
Auditors and main contractors may ask for evidence that supports:
PAYE operation where applicable
National Insurance treatment
Holiday pay processes
Payslip records
Pension duties where relevant
Invoices that match agreed rates and hours
Clear worker status arrangements
No use of disguised or unauthorised payment routes
This content is for general information only and is not tax or legal advice. Specialist advice should be taken where worker status, tax treatment or payroll compliance is uncertain.
The operational risk is often visible in the numbers. If an invoice rate does not appear to support lawful wages, holiday pay, employer on-costs, insurance, supervision and margin, the client may ask how the supplier can deliver compliantly.
A good audit pack does not need to reveal unnecessary personal data, but it should allow a reviewer to see that payroll control exists. Redacted sample payslips, payroll summaries, reconciliation reports and supplier declarations can help, provided they are current and supported by internal checks.
The key is consistency. A one-off declaration signed at onboarding will not satisfy scrutiny without evidence of ongoing monitoring.
Mitigating Secondary Subcontracting Risks Under BS 10119
Secondary subcontracting can become a serious problem in the security labour supply chain. It occurs when an approved supplier passes work to another party without clear permission, control or disclosure.
From a client’s point of view, this destroys visibility. The main contractor believes it is buying labour from Supplier A, but the worker may have come through Supplier B or C. Each extra layer creates more risk around vetting, licensing, pay, tax and supervision.
Common warning signs include:
Operatives who name a different employer than the approved supplier
Invoices from entities not listed in the contract
Email domains or bank details that do not match the supplier record
Repeated last-minute substitutions with incomplete files
Workers who cannot explain who pays them
Supplier rates that only make sense if another party carries the cost
File templates that show another company's branding or references
The contract should clearly state whether subcontracting is allowed. If it is allowed, it should state how approval works, what evidence must be provided and who remains accountable.
The audit file should include a current approved supplier list. It should also show that operations teams know who they can use. This matters because many secondary subcontracting issues start under time pressure. A site has a gap, a controller needs cover, and an unofficial contact offers labour quickly.
That quick fix can create a major audit failure.
A stronger control is to require every supplied operative to be linked to an approved supplier before deployment. If the supplier name does not match the approved list, the worker should not start.
BS 7858 Vetting File Sampling: Establishing Defensible Ratios
Lead auditors rarely review every record in a large labour pool—they sample. During a security labour supply audit, this review evaluates adherence to the BS 7858 security screening standard, scrutinising 5-year career histories, conditional employment files, DBS disclosures, and right-to-work documentation.
That makes sampling ratios important, but not as a fixed magic number. The right sample size depends on risk, volume, contract terms and previous findings. A small, stable labour pool with strong controls may need a different approach from a high-turnover contract using several labour providers.
What matters is that the sampling method is defensible.
A security provider should be able to explain:
How often vetting files are sampled
Who carries out the sampling
Which workers are included
How high-risk files are selected
What pass or fail criteria apply
How errors are recorded and corrected
When issues are escalated to senior management
When a supplier is suspended or removed
A weak approach says, “we check a few files when we have time.”
A better approach says, “we sample a set proportion of active supplied workers each month, we include all new suppliers, we increase checks after any non-conformance, and we record corrective actions until closure.”
Avoid relying only on clean files chosen by the supplier. Sampling should include auditor-selected files from live rosters, invoices and timesheets. That prevents a supplier from presenting only the best evidence.
How to Prepare for a BS 10119 Audit: A 5-Step Lead Auditor Action Plan
Audit survival starts weeks or months before the audit date. A last-minute tidy-up may improve presentation, but it will not fix broken controls.
A practical preparation plan should cover five areas.
1. Map the End-to-End Labour Supply Chain
List every party involved in supplying labour. Include direct employees, labour providers, approved subcontractors and any specialist cover arrangements.
Then match each supplier to:
Contract terms
Approval status
Insurance evidence
Vetting obligations
Payroll responsibilities
Right-to-work responsibilities
Named account contacts
Any restrictions on further subcontracting
If the map reveals a supplier no one formally approved, treat it as a live risk.
2. Cross-Check Vetting Files Against Live Assignment Rosters
Do not start with the HR folder. Start with the roster.
Select names from recent shifts, then pull each worker's file. This mirrors how an auditor may test the system. It also exposes gaps between operations and compliance records.
Check that each file contains the right evidence, in the right order, with dates that make sense.
3. Reconcile Payroll Records, Invoices, and Shift Timesheets
For supplied labour, the audit trail should connect worked hours to invoices and pay records. If a worker appears on a timesheet but not in the labour provider's payroll evidence, investigate the mismatch.
This does not mean sharing excessive personal data. It means proving that shifts, invoices and payment controls align.
4. Audit Subcontractor Agreements and Vetting Declarations
Many businesses hold supplier declarations, but they are often old, vague or unsigned. Refresh them before tender submission or audit.
Declarations should confirm the supplier's responsibilities, but they should not replace evidence. A signed statement is useful. A signed statement plus file sampling is stronger.
5. Log and Remediate Internal Non-Conformances
Create a simple issue log. Record missing documents, expired checks, payroll mismatches, unapproved suppliers and corrective actions.
An auditor may view an identified and controlled issue more favourably than a hidden one discovered during sampling. The point is not to pretend everything is perfect. The point is to show active management.
Key Evidence to Prepare in Your BS 10119 Audit Pack
A well-prepared BS 10119 audit pack should be clear enough for someone outside the business to follow.
A typical pack may include:
Audit area | Evidence to prepare |
Labour supply chain | Approved supplier list, contracts, subcontracting permissions and supplier ownership details where relevant |
Right to work | Check records, dates, reviewer names, follow-up actions and expiry monitoring |
Vetting | Screening files, licence checks where applicable, training evidence and review records |
Payroll and tax | Redacted payroll evidence, PAYE confirmations where relevant, invoice reconciliations and pay process controls |
Operations | Rosters, timesheets, deployment approvals and site allocation records |
Monitoring | Sampling records, non-conformance logs, corrective actions and supplier review notes |
The pack should be current. An audit folder last updated a year ago will not prove live control.
The Commercial Case for BS 10119 Pre-Assessment & ISO 9001 Integration
Many firms only test their labour supply chain when a client demands it. That is risky. By that stage, the business may already be locked into a tender timetable or contract review.
Undergoing an independent BS 10119 pre-assessment allows security contractors to identify systemic documentation breakdowns before certification day. Furthermore, integrating labour supply oversight into an annual ISO 9001 internal audit establishes a seamless Integrated Management System (IMS), preventing duplicated audit effort and safeguarding public sector tenders. It can identify weak supplier files, right-to-work gaps, payroll evidence issues, unclear subcontracting routes and poor sampling records.
For labour providers, the benefit is just as clear. A clean, well-structured audit pack can help prove that the supplier is safe to use. It can also reduce repeated information requests from main contractors.
For primary security providers, independent labour supply chain audits can support:
Tender readiness
Approved supplier reviews
Client assurance responses
Contract mobilisation
Remediation after an audit finding
Ongoing supplier monitoring
The real value is not the certificate or the report alone. It is the reduction of commercial uncertainty.
Achieving Audit Readiness: Next Steps for Security Providers
BS 10119 compliance is easiest when evidence is built into daily operations. It becomes difficult when providers reconstruct records after the event.
Security providers and labour suppliers should treat audit readiness as part of contract delivery. That means checking workers before deployment, controlling who can supply labour, testing files from live rosters, reconciling pay evidence and acting quickly when gaps appear.
If a major tender or client review is approaching, arrange BS 10119 (formerly known as COP 119), pre-assessment checks and labour supply chain audits before the auditor controls the timetable. The earlier the weaknesses are found, the easier they are to fix.
Don't leave your labour supply compliance to chance before a crucial client tender. Javo Consultancy delivers 100% remote, fixed-price BS 10119 pre-assessments and vetting file audits conducted during flexible evening and weekend slots to eliminate daytime operational disruption. Combine your BS 10119 review with an annual ISO 9001 audit to save 5% with our Certification Confidence Bundle today.
Comments