2024_25_InternalAudit_IR35 Off Payroll Working Compliance_Final
Argyll and Bute Council · 17 December 2024
Back to Audit and Scrutiny Committee — 17 December 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Classification: OFFICIAL Argyll and Bute Council Internal Audit Report October 2024 Final High Medium Low VFM Number of Findings 2 2 0 0 IR35-Off Payroll Working Compliance Audit Opinion: Limited
Page 2
2 Argyll and Bute Council – Internal Audit Report – IR35 Off-Payroll Working Compliance, August 2024 Classification: OFFICIAL Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 3 Key Dates ................................................................................................................................................ 3 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 4 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ..................................................................................................................... 10 Appendix 2 – Audit Opinion ................................................................................................................. 13 Contact Details Internal Auditor: David Sullivan Telephone: 01546 604125 e-mail: david.sullivan@argyll-bute.gov,uk www.argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit Report – IR35 Off-Payroll Working Compliance, August 2024 Classification: OFFICIAL 1. Executive Summary Introduction 1. As part of the 2024/25 internal audit plan, approved by the Audit & Scrutiny Committee in March 2024, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to IR35 off Payroll Working Compliance. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. IRR35, also known as the Off-Payroll Working Rules, is UK tax legislation designed to ensure that individuals working through an intermediary (such as a personal service company) pay the same income tax and National Insurance contributions as an employee if they are essentially performing the same role as an employee. 5. The purpose of the legislation is to prevent tax avoidance by contractors who work in a similar manner to employees but receive the tax benefits of operating through a limited company or other intermediaries. 6. The responsibility for determining the IR35 status (inside or outside IR35) shifted to the employer (public sector bodies since April 2017). For employees considered inside IR35 the Council is considered an employee for tax purposes. The Council must deduct income tax and National Insurance contributions. For those employees who fall outside IR35 the contractor is considered genuinely self-employed, and no deductions are made by the Council. Scope 7. The scope of the audit was to review and assess if the IR35 rules are being applied correctly and consistently, including appropriate and regular checks are in place as outlined in the Terms of Reference agreed with the Head of Financial Services on 11th July 2024. Key Dates 8. The Terms of Reference provided provisional timescales for the review to take place, the actual dates are noted below.
Page 4
4 Argyll and Bute Council – Internal Audit Report – IR35 Off-Payroll Working Compliance, August 2024 Classification: OFFICIAL 9. Exhibit 1 – Key Dates Stage Actual Date Terms of Reference agreed 11th July 2024 Fieldwork Commencement 16th July 2024 Draft Report issued 1st October 2024 Management Comments received 11th October 2024 Final Report issued 29th October 2024 Audit and Scrutiny Committee 17th December 2024 Risks 10. The risks considered throughout the audit were: Audit Risk 1: The council incurs heavy fines for non-compliance with legislation. Audit Risk 2: Reputational damage to the Council. Audit Risk 3: Misclassifying contractors can lead to disputes and potential operational disruption. Audit Opinion 11. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 12. Our overall audit opinion for this audit is that we can take a Limited level of assurance. This means that Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues. Recommendations 13. We have highlighted two high priority recommendations, two medium priority recommendations and one low priority recommendation where we believe there is scope to strengthen the control and governance environment. These are summarised below: The Council should ensure there is in place a documented process for assessing the IR35 status of contractors The Council should ensure that there is in place a designated individual or team responsible for conducting IR35 checks, leading to better clarity and accountability in overseeing the proper execution of IR35 status assessments for contractors The Council should ensure that all relevant staff have receive training on the use of the HMRC’s Check Employment Status for Tax (CEST) tool The Council should ensure that there is a formal process in place for informing relevant staff about legislative changes related to IR35 and/or updates to procedures.
Page 5
5 Argyll and Bute Council – Internal Audit Report – IR35 Off-Payroll Working Compliance, August 2024 Classification: OFFICIAL 14. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 15. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion CO1 There are procedures in place to ensure compliance with IR35 legislation Audit Risk 2 Audit Risk 3 Limited The Council does not have a formalised process for assessing the IR35 status of contractors. Discussions with Council officers revealed that there is no clear accountability within departments for conducting IR35 checks. No formal training on IR35 compliance, including the use of HMRC’s CEST tool, has been provided to relevant Council staff. CO2 All contractors engaged by the Council have their status assessed using an appropriate testing tool, payroll adjustments are made and appropriate records maintained. Audit Risk 2 Audit Risk 3 Substantial The Council uses recognised tools, specifically HMRC’s Check Employment Status for Tax (CEST) tool, to determine the IR35 status of contractors. Internal audit confirmed that Procurement has ensured compliance with IR35 legislation for three contractors, resulting in their reclassification as employees, with proper documentation and deductions handled by Payroll, and appropriate service contracts put in place for other contractors in education services. CO3 There are procedures in place for contractors to challenge IR35 status and disputes are handled as per these procedures Audit Risk 1 Audit Risk 2 Audit Risk 3 Limited The Council lacks established procedures for contractors to challenge their IR35 status assessments and that there is no formal feedback mechanism for contractors to provide input on the IR35 status challenge process. CO4 The Council monitors changes in IR35 legislation and updates its policies and procedures accordingly. Audit Risk 1 Audit Risk 2 Audit Risk 3 Limited The Council lacks a documented process for monitoring changes to IR35 legislation and there is no designated individuals or teams responsible for monitoring changes in IR35 legislation within the Council. Recent IR35 legislative changes effective from April 2024 emphasise the need for accurate status
Page 6
6 Argyll and Bute Council – Internal Audit Report – IR35 Off-Payroll Working Compliance, August 2024 Classification: OFFICIAL determinations. If the Council incorrectly classifies a contractor as outside IR35, it will be liable for the full tax liability. 16. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings There are procedures in place to ensure compliance with IR35 legislation 17. Upon review, it was determined that the Council currently lacks a documented process for assessing the IR35 status of contractors. This absence of a documented process may lead to inconsistencies in the application of the IR35 rules, potential non-compliance with legal requirements, and difficulties in providing clear guidance to staff responsible for these assessments. It is recommended that the Council develop and implement a comprehensive, documented procedure to ensure consistency, accountability, and compliance with IR35 legislation. Action Plan 1 18. Discussions with various departments revealed a lack of clarity and accountability regarding who is responsible for conducting IR35 checks. It was found that there is no designated individual or team within these departments tasked with overseeing the proper execution of IR35 status assessments for contractors. The minutes of the Ernst/Young Council tax meeting in 2022 stated “that where the Council employ agency workers then it is the responsibility of the agency to carry out IR35 checks. Where non agency workers are employed Services have been carrying out IR35 checks to date, however Internal audit confirmed that this has been on an ad-hoc basis and there is no procedure in place that assigns this responsibility”. This absence of assigned responsibility raises concerns about the Council's ability to consistently ensure compliance with IR35 regulations, potentially leading to non-compliance with tax obligations and associated risks. Action Plan 2 19. No formal training has been provided to relevant Council staff regarding IR35 compliance, including the use of HMRC’s Check Employment Status for Tax (CEST) tool or other IR35 assessment tools. This lack of training could lead to incorrect contractor status assessments, risking non-compliance with tax obligations and potential financial penalties. Furthermore, the absence of formal training may impair staff's ability to accurately determine the employment status of contractors. It is recommended that the Council establish a structured training program for all staff involved in the IR35 assessment process to ensure proper understanding and application of the tool and associated risks. Action Plan 3
Page 7
7 Argyll and Bute Council – Internal Audit Report – IR35 Off-Payroll Working Compliance, August 2024 Classification: OFFICIAL All contractors engaged by the Council have their status assessed using an appropriate testing tool payroll adjustments are made and appropriate records maintained. 20. Upon reviewing the Council's procedures for determining the IR35 status of contractors, it was confirmed that the Council utilises recognised and appropriate tools for this purpose. Specifically, the Council employs the HMRC’s Check Employment Status for Tax (CEST) tool as the primary means of assessing whether contractors fall inside or outside the IR35 regulations. This tool is widely recognised and recommended by HMRC for assessing employment status for tax purposes. The Council's use of the CEST tool demonstrates adherence to best practices and ensures compliance with the requirements set forth under the IR35 legislation. 21. Internal audit confirmed that Procurement are requesting service teams carry out IR35 checks when self-employed contractors are engaged by Procurement, to deliver a contract for the service team to ensure compliance with relevant IR35 legislation using the HMRC Assessment Tool. This has resulted in 3 self-employed contractors being deemed to fall under the remit of the legislation and as a result payroll colleagues are dealing with their deductions accordingly. In addition, the review resulted in adjudicators in education being put on the payroll system as casual workers instead of being paid as suppliers. Further, contractors providing piping and piano tuition for education now have appropriate service contracts in place. 22. There are currently only 3 contractors whose status has been checked for IR35 compliance and as a result of the check have had their status changed to that of being an employee of the Council. For the 3 contractors assessed, the audit confirmed that the Procurement section properly documents all the IR35 status assessments and that these records are properly maintained, and the relevant information is passed on to the Payroll department to ensure that PAYE and NI deductions are carried out. There are procedures in place for contractors to challenge IR35 status and disputes are handled as per these procedures 23. The audit found that there are no established procedures in place for contractors to challenge their IR35 status assessments. This absence of a formalised process may lead to potential disputes not being managed effectively, potentially increasing the risk of non-compliance and misunderstandings between the Council and contractors. It is recommended that the Council develop and implement clear procedures for addressing and resolving any challenges to IR35 status assessments, ensuring fair and transparent handling of such cases. Action Plan 1 24. The Council should ensure that all contractors are clearly informed about their rights and the process for challenging their IR35 status. This information should be communicated at the outset of any contractual engagement and detailed in the contract documentation. Providing contractors with clear guidance on how to raise concerns or disputes will help to foster transparency and trust, while also ensuring that the Council's processes are fair and compliant. 25. The audit included a test to review a sample of challenges filed by contractors concerning their IR35 status assessments. However, it was found that there were no challenges submitted for the three IR35 status assessments conducted by the Council. As a result, there were no challenge
Page 8
8 Argyll and Bute Council – Internal Audit Report – IR35 Off-Payroll Working Compliance, August 2024 Classification: OFFICIAL cases available for review. It is important to note that the absence of challenges does not necessarily indicate the absence of issues; it may also reflect a lack of awareness among contractors about their rights to challenge IR35 status. 26. The audit assessed whether there is a feedback mechanism in place for contractors to provide input on the IR35 status challenge process. It was found that no formal feedback mechanism currently exists. The absence of a structured process for contractors to offer feedback limits the Council's ability to identify and address any issues or concerns contractors may have regarding the challenge process. Implementing a feedback system would provide valuable insights and improve the overall effectiveness and transparency of the IR35 status assessment and challenge procedure. Action plan 1 The Council monitors changes in IR35 legislation and updates its policies and procedures accordingly. 27. The audit examined whether the Council has a documented process in place for monitoring changes to IR35 legislation. It was found that no such documented process currently exists. This lack of a formalised approach to tracking legislative changes poses a risk to compliance, as the Council may not stay adequately informed of important updates and requirements related to IR35. Establishing a documented process for monitoring changes in legislation would help ensure that the Council remains compliant and can promptly adjust its policies and practices as required. Action Plan 4 28. The audit examined whether there are designated personnel responsible for monitoring changes in IR35 legislation within the Council. The findings revealed that there are no identified individuals or teams tasked with this responsibility. This absence of assigned personnel increases the risk that the Council may not stay current with IR35 legislative updates, potentially leading to non-compliance. To mitigate this risk, it is recommended that the Council designate specific individuals or a team to monitor and communicate any changes in IR35. Action Plan 2 29. The Recent changes to IR35 legislation state “If the deemed employer gets the status determination statement wrong, and incorrectly concludes that the individual was outside of the IR35 rules, then under existing legislation HMRC has no duty to set off income tax and/or corporation tax already paid by such a worker, or their intermediary company, when assessing the tax liability of the deemed employer.” This leads to the deemed employer bearing the full cost of the liability and in some cases the over collection of tax. The new measure applies from April 2024. It is therefore crucial that the Council implements robust procedures and processes for determining IR35 status to mitigate the risk of financial liabilities and ensure compliance with the new legislative requirements. Ensuring accurate and well-documented assessments will help prevent unnecessary liabilities and safeguard the Council's financial interests.
Page 9
9 Argyll and Bute Council – Internal Audit Report – IR35 Off-Payroll Working Compliance, August 2024 Classification: OFFICIAL 30. The audit findings indicate that there is no evidence that recent changes to IR35 legislation, including the new measures effective from April 2024, have been communicated to the relevant departments within the Council. This lack of communication raises concerns about the Council's preparedness and ability to comply with the updated IR35 requirements, potentially exposing the Council to financial liabilities and compliance risks.
Page 10
Classification: OFFICIAL Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date High 1 Procedures Upon review, it was determined that the Council currently lacks a documented process for assessing the IR35 status of contractors. While the Council utilises the HMRC’s Check Employment Status for Tax (CEST) tool to determine the employment status for tax purposes, there is no formal documentation outlining the steps, procedures, and responsible parties involved in the IR35 assessment process. In addition, there is no process in place for individuals to challenge their IR35 status The absence of a documented process may lead to inconsistencies in the application of the IR35 rules, potential non-compliance with legal requirements, and difficulties in providing clear guidance to staff responsible for these assessments The Council acknowledges the need for a documented process in assessing IR35 status and for providing a clear pathway for contractors to challenge their IR35 status determination. To address this, the Council will undertake a comprehensive review of its procedures to ensure that steps, responsibilities, and protocols are clearly defined and formally documented. This review will also include the establishment of a challenge process, allowing contractors to seek clarification or raise concerns about their IR35 status Main Lead-Head Of Financial Services 30th April 2025 High 2 Roles and Responsibility Discussions with various departments revealed a lack of clarity and accountability regarding the responsibility for conducting IR35 checks. There is no designated individual or team tasked with overseeing the proper execution of IR35 status assessments for contractors The lack of clear accountability and designated responsibility for conducting IR35 checks increases the risk of non-compliance with tax obligations resulting in financial penalties and reputational damage to the Council. The Council recognises the importance of establishing clear accountability and responsibility in the IR35 assessment process. To address this, the Council will designate a specific team or individual tasked with overseeing and coordinating all IR35 status assessments for contractors. This designated party will ensure that IR35 checks are carried out consistently across departments and will serve as the main point of contact for IR35 compliance matters. Main-Lead Head Of Financial Services 30th April 2025
Page 11
11 Argyll and Bute Council – Internal Audit Report – IR35 Off-Payroll Working Compliance, August 2024 Classification: OFFICIAL No Finding Risk Agreed Action Responsibility / Due Date Medium 3 Training The audit revealed that no training has been provided to relevant staff on the use of the HMRC’s Check Employment Status for Tax (CEST) tool or any other IR35 assessment tools. This lack of training could result in incorrect assessments of contractors' IR35 status, potentially leading to non-compliance with tax obligations and the risk of financial penalties The Council acknowledges the importance of equipping relevant staff with the necessary knowledge and skills to effectively use the HMRC’s Check Employment Status for Tax (CEST) tool and other IR35 assessment resources. To address this, the Council will develop and implement a structured training programme for all personnel involved in IR35 assessments. This training will cover the use of assessment tools, interpreting results accurately, and understanding the implications of IR35 determinations. Main-Lead Head Of Financial Services 30th April 2025 Medium 4 Informing staff of relevant changes to legislation The audit found that there is no formal process in place for informing relevant staff about legislative changes related to IR35 or updates to procedures. Without proper notification and guidance, staff may apply outdated procedures, risking errors in contractor status assessments and associated tax obligations. The Council recognises the need for a formalised process to ensure that relevant staff are promptly informed of any legislative changes related to IR35 and updates to procedures. To address this, we will establish a structured communication plan to regularly update staff on significant legislative developments, as well as any procedural changes that impact IR35 compliance. This process will involve periodic reviews to ensure that communication methods are effective and comprehensive. Main-Lead Head Of Financial Services 30th April 2025
Page 12
12 Argyll and Bute Council – Internal Audit Report – IR35 Off-Payroll Working Compliance, August 2024 Classification: OFFICIAL In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 13
13 Argyll and Bute Council – Internal Audit Report – IR35 Off-Payroll Working Compliance, August 2024 Classification: OFFICIAL Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.