The off-payroll working rules came into force for the private sector in April 2021. Most organisations scrambled to get their houses in order, issued Status Determination Statements, and moved on. Five years later, many of those same organisations have not looked at their IR35 governance since.
That is a problem. Because HMRC has been looking.
Since 2021, HMRC has built a detailed picture of how organisations approached the reforms: who engaged contractors, how they made their status determinations, and where the inconsistencies are. Enforcement has now become the priority, and the investigations that are resulting from that work are more structured, more document-focused, and more consequential than many organisations expect.
This post sets out what HMRC is looking for in 2026, where organisations are most at risk, and what good IR35 governance looks like now.
The shift from education to enforcement
HMRC’s approach to IR35 has changed. For the first few years after the private sector reforms, much of HMRC’s activity was focused on guidance and education. That phase is largely over.
HMRC now has five years of post-reform data to draw on. It understands the compliance landscape, and it is using that understanding to prioritise investigations where the risk of non-compliance is highest. Organisations that made their IR35 determinations in 2021 or 2022 and have not revisited them since are operating on assumptions that may no longer hold.
The message from HMRC is clear: making a determination at one point in time is not enough. The determination must be current, documented, and defensible.
What triggers an HMRC investigation
HMRC’s compliance approach to off-payroll working focuses on four broad areas.
The decision-making process. How did the organisation reach its status determinations? Was there a structured process, or were determinations made ad hoc? HMRC will want to understand who was responsible, what information they used, and whether the process was applied consistently.
Consistency across contractor populations. If an organisation has engaged a large number of contractors in similar roles and determined them all to be outside IR35, HMRC will scrutinise that pattern. Inconsistency in how comparable roles have been treated is also a red flag.
Whether working practices match the contract. A Status Determination Statement (SDS) is based on the terms of the contract. If the day-to-day reality of how a contractor works does not match what the contract says, the determination may not reflect the true employment status. HMRC will look at both.
The strength of the audit trail. Can the organisation produce the documentation that supports its determinations? Can it show that reasonable care was applied? Where the audit trail is thin or missing, HMRC will draw its own conclusions.
Where organisations become vulnerable
Most IR35 risk does not come from deliberate non-compliance. It comes from process gaps that have built up over time. The most common patterns are:
One-and-done assessments. A determination made in 2021 or at the start of a contractor’s engagement may not reflect a contractor’s current role, working arrangements, or contract terms. Roles evolve. Contracts are renewed. The determination should evolve too.
Over-reliance on online tools. HMRC’s Check Employment Status for Tax (CEST) tool can be a useful starting point, but it is not a substitute for human review. HMRC will stand by CEST results only where the information provided is accurate and complete and the tool is used in accordance with HMRC’s guidelines. The tool cannot account for the full picture of a contractor’s engagement, and using it without additional assessment or documentation leaves organisations exposed.
Weak documentation. An SDS that records an outcome without explaining the reasoning behind it offers limited protection. Good documentation records not just the conclusion but the factors considered and why they pointed in a particular direction.
Misalignment between contracts and working practices. Strong IR35-friendly contracts that contain substitution clauses, financial risk provisions, or control limitations but do not reflect the actual working relationship will not support an outside IR35 determination if investigated. The contract and the reality need to align.
Poor supply chain visibility. Organisations that engage contractors through agencies may not have full visibility of the contractual arrangements further down the chain. That creates risk, particularly where the organisation is the deemed employer.
What good IR35 governance looks like in 2026
HMRC’s Guidelines for Compliance document (GfC4) sets out what HMRC considers to be good practice. The organisations that are best placed to respond to HMRC scrutiny share a number of characteristics.
They have a defined and documented process for making status determinations, applied consistently and explainable clearly to HMRC. They review determinations regularly, not just at the start of an engagement. They can demonstrate that their contracts reflect the real working relationship. And they have clear governance ownership: someone inside the organisation is responsible for IR35 compliance and knows what to do when a question arises.
HMRC’s Employment Status Manual is also worth reviewing for technical detail on SDS obligations and how HMRC approaches its compliance activity. For organisations that want to understand the full scope of the rules, the off-payroll working detailed information collection provides a useful overview of where to look.
Practical steps to take now
Before HMRC contacts your organisation, there are several steps worth taking.
Review historic determinations. Identify any contractors who have been engaged for more than 12 months without a determination review. Assess whether the original determination still reflects the reality of the engagement.
Audit your documentation. For each outside IR35 determination, check that the reasoning is recorded and that the supporting documentation is complete and accessible.
Assess your contractor population. Look for patterns that may attract HMRC’s attention. Large numbers of contractors in similar roles all determined outside IR35, or significant inconsistency in how similar engagements have been treated, are both worth examining carefully.
Tighten your governance. Establish or confirm who owns IR35 compliance in your organisation, document the decision-making process, and set a schedule for regular reviews.
Prepare to respond quickly. If HMRC issues an information request, the speed and quality of the response matters. Organisations that can respond promptly and confidently, with well-organised documentation, are in a much stronger position than those that are not prepared.
How Brookson Legal can help
Brookson Legal is the UK’s only SRA-regulated law firm focused primarily on IR35. We have been advising on employment status since IR35 was introduced in 2000, and our team has direct experience of how HMRC approaches investigations.
Whether your organisation needs an IR35 review, a compliance audit, a mock investigation to test your readiness, or ongoing advisory support, we can help you demonstrate reasonable care and face HMRC scrutiny with confidence.
Reach out to find out how we can support your organisation.