A restaurant owner in Birmingham was fined £45,000 last year. Not for employing someone without the right to work deliberately — she genuinely believed her employee was entitled to work in the UK. He had told her so at interview. She had even seen a document, briefly, before filing it away somewhere she could no longer find.
When the Home Office compliance team arrived for an unannounced visit, she had no records, no copies, no timestamps, and no defence. The fine was issued within weeks.
She is not unusual. The UK's 5.5 million SMEs face the same right-to-work obligations — and the same penalties — as businesses with dedicated HR departments, compliance officers, and legal teams. The difference is that small businesses overwhelmingly lack the infrastructure to meet those obligations consistently. The result is a pattern of preventable mistakes that repeat across sectors, regions, and business sizes.
Here are the seven most common right-to-work errors small businesses make, why each one matters, and what to do instead.
1. Conducting verbal checks only
The most basic and most widespread mistake. A manager asks the candidate during an interview: "Do you have the right to work in the UK?" The candidate says yes. The manager moves on. No documents are requested, no verification takes place, and no record is created.
Why it matters: A verbal confirmation has zero legal standing. Under Home Office employer guidance, you must see original documents from the prescribed list, verify them in the presence of the holder, and retain copies. A "yes" in an interview satisfies none of these requirements. If an undocumented worker is found on your premises, a verbal check provides no statutory excuse — the legal defence that protects employers who conducted a proper check.
The fix: Every hire, no exceptions, must go through the document verification process before their first day of work. Not during onboarding. Not "when we get round to it." Before they start.
2. Checking documents after the offer — or after the start date
Many small businesses treat right-to-work verification as an administrative task that sits in the onboarding pile alongside bank details and emergency contacts. The employee starts on Monday, and the RTW check happens sometime during their first week. Sometimes their first month.
Why it matters: A right-to-work check conducted after the employment start date does not establish a statutory excuse for the period between the start date and the check. If an inspection occurs during that window — or if the employee is later found to have no right to work — the employer is liable from day one.
The government's three-step check process is explicit: checks must be completed before employment begins. "Before" means before the first shift, the first day, the first hour.
The fix: Build the RTW check into your offer process, not your onboarding process. The offer is conditional until the check is complete. No verified right to work, no start date.
3. Not keeping copies of documents
A surprisingly common gap. The employer sees the candidate's passport or Biometric Residence Permit, confirms it looks legitimate, and hands it back. No photocopy. No scan. No digital record.
Why it matters: The Home Office guidance is unambiguous — you must retain a clear copy of every document checked, in a format that cannot be altered (or where any alteration is detectable). The copy must be kept for the duration of employment and for two years after employment ends. Without the copy, you cannot demonstrate that a check took place, even if it did.
When the Fair Work Agency arrives for an unannounced audit, "I saw the passport but didn't keep a copy" is indistinguishable from "I never checked at all."
The fix: Copy or scan every document at the point of verification. Store copies in a centralised, accessible system — not in individual managers' desk drawers. Every record should include the document type, the date it was checked, and who conducted the check.
4. Not rechecking time-limited visas
An employee joins with a Graduate visa that expires in 18 months. The employer conducts a compliant RTW check at the point of hire. Eighteen months pass. The visa expires. The employee continues working. Nobody notices.
Why it matters: For employees with time-limited right to work — Graduate visas, Skilled Worker visas, dependent visas, seasonal worker permits — the employer's statutory excuse expires when the permission expires. You are legally required to conduct a follow-up check before the expiry date. Miss it, and your protection disappears. According to Home Office enforcement data, expired visa oversight is one of the most common triggers for civil penalty notices.
The fix: Maintain a diary system that tracks every time-limited permission in your workforce. Set alerts for 90 days, 30 days, and 7 days before expiry. The follow-up check must be completed before the current permission expires — not after.
5. Accepting expired documents
A candidate presents a Biometric Residence Permit. It expired three months ago. The employer sees "Biometric Residence Permit," recognises it as an acceptable document, and files the copy. The expiry date goes unnoticed.
Why it matters: An expired document does not establish right to work, even if the person does genuinely have ongoing permission. The document must be current at the time of the check. Accepting an expired BRP, passport, or visa vignette fails the verification test entirely.
This mistake is especially common with BRPs, which have a fixed expiry date printed on the card. After the Home Office's transition away from physical BRP cards (most expired on 31 December 2024), employers relying on the physical card alone are at particular risk of accepting expired documents.
The fix: Check the expiry date on every document. Make it a mandatory step in your verification process. If a document is expired, do not accept it. Ask the employee to provide current documentation or use the Home Office online checking service with a share code.
6. Not understanding share codes
The share code system — where an employee generates a code via the Home Office online service that the employer then enters to verify their status — is now the primary verification route for many visa holders. But many small business owners have never used it, don't know it exists, or have tried and found the process confusing.
Why it matters: For employees with a Biometric Residence Permit, an eVisa, or certain other immigration permissions, the online check via share code is often the prescribed method of verification. Accepting a physical document when the online check is available — or worse, accepting a printout of the share code result without actually conducting the online check yourself — can undermine your statutory excuse.
The Home Office has been migrating visa holders to eVisas, meaning the share code route will only become more prevalent.
The fix: Familiarise yourself with the online right-to-work check process. When an employee provides a share code, you must enter it into the Home Office system yourself, verify the result, and save a copy of the response page. A screenshot of the employee's own check is not sufficient — you must conduct the verification independently.
7. No audit trail
This is the mistake that ties all the others together. Even businesses that do conduct checks often fail to maintain the kind of records that demonstrate compliance. Documents are scattered across email inboxes, personal drives, paper folders, and individual managers' filing systems. There is no central record of who was checked, when, by whom, and what documents were reviewed.
Why it matters: Compliance is not just about doing the right thing. It is about being able to prove you did the right thing, months or years later, to an inspector who was not there at the time. An audit trail is the difference between a clean bill of health and a civil penalty notice.
The Fair Work Agency, launching in 2026 with consolidated enforcement powers, will bring even greater scrutiny to employer records. Without a coherent, accessible audit trail, every other compliance effort is undermined.
The fix: Centralise your records. Every check should generate a timestamped entry that includes the employee name, document type, date of check, expiry date (if applicable), who conducted the check, and a copy of the document. This record must be retrievable within minutes, not hours.
The pattern behind the mistakes
These seven errors share a common root cause: small businesses treat right-to-work compliance as an informal, one-off task rather than a structured, ongoing process. Without HR departments, compliance software, or legal advisers, the responsibility falls on busy owners and managers who are juggling hiring, operations, and everything else.
The result is predictable. Checks are skipped or incomplete. Records are patchy. Expiry dates are missed. And when enforcement arrives — as it increasingly will under the Fair Work Agency's expanded audit powers — the business has no defence.
The penalties are not scaled to business size. A sole trader with three employees faces the same £60,000 per-worker fine as a multinational corporation. For most SMEs, a single penalty notice can be existential.
Building a process that actually works
The good news is that fixing these mistakes does not require a large compliance team or enterprise software. It requires a clear, consistent process that covers three things: verify before the start date, keep copies of everything, and track expiry dates.
Certifyd's Right to Work Portal is designed specifically for businesses without dedicated HR or compliance teams. It handles document verification, creates timestamped audit trails automatically, tracks time-limited permissions with automated alerts, and produces a compliance dashboard that any inspector can review in minutes. The goal is to give SMEs the same level of compliance rigour that large enterprises take for granted — without the overhead.
If any of these seven mistakes sound familiar, the time to fix them is before the next inspection, not during it. Find out how Certifyd can help.