Back to Blog
In 2017, HMRC introduced changes to the IR35 rules, which determine how off-payroll workers are classified in the UK. While this initially only applied to public sector companies, it was expanded into the private sector in April 2021. This has had a huge impact on large and medium organisations that work with independent contractors and consultants.
The stakes are high: companies that get it wrong will be held responsible for 100% of the unpaid taxes and charges due on each engagement, plus additional penalties of up to 100%.
But determining a worker’s tax status is not always simple – particularly in large organisations with complex supply chains. In this article, we’ll share seven common IR35 pitfalls that FTSE 250 firms should be aware of, and our advice on how to avoid them.
April 2026 Update: This article was originally published in November 2024. Since then, two significant changes have come into effect that FTSE 250 CFOs should be aware of. First, employer National Insurance rose from 13.8% to 15% in April 2025, with the secondary threshold dropping from £9,100 to £5,000 – increasing the cost of inside IR35 engagements by roughly £1,500-£3,500 per year per contractor. Second, new umbrella company PAYE rules took effect from 6 April 2026, shifting deduction responsibility to agencies. Both changes are addressed in the relevant sections below.
What is IR35? What large businesses need to know
IR35 is another name for the ‘off-payroll working rules’ in the UK. These are a set of rules designed to ensure workers who provide services through intermediaries such as personal service companies (PSCs) pay approximately the same Income Tax and National Insurance contributions as they would as employees.
Broadly speaking, workers engaged through intermediaries can be either ‘inside IR35’ or ‘outside IR35’.
If a worker is classified as inside IR35, they should be paid through the PAYE system, with taxes deducted at source and National Insurance Contributions (NICs) and the Apprenticeship Levy paid on their income. They are employees for tax purposes, even if their contract or agreement says otherwise.
Those who are outside IR35, on the other hand, are deemed to be operating a genuine independent business. They wouldn’t be classed as employees if they were engaged directly by the end user, which means they don’t need to pay employer NICs.
As of 2021, it is now the responsibility of private sector end-user clients to correctly determine whether workers are inside or outside IR35. While there’s an exception for small businesses, FTSE 250 firms fall outside of this by definition. That means IR35 compliance is a key consideration for FTSE 250 firms.
The financial impact of inside IR35 status
Under the new rules, end-user clients are responsible for making IR35 determinations, and fee payers are responsible for deducting the relevant payroll taxes and paying employer NICs (and, where applicable, the Apprenticeship Levy).
The end user is the party that ultimately benefits from the worker’s services, and the fee payer is the party immediately above the intermediary in the contractual chain. In some cases, the fee payer and the end user are the same organisation. However, the fee payer may also be another party, such as an agency.
Even if the end-user client is not the fee payer, tax liability can pass up the contractual chain to the end user if the intermediary doesn’t meet its obligations. This can have a significant financial impact on a business since it can result in liability for taxes, NICs and the Apprenticeship Levy. HMRC can also demand back payment of these taxes going back several years, plus penalties and interest.
It is also worth noting that the cost of inside IR35 engagements increased materially from April 2025, when employer National Insurance rose from 13.8% to 15% and the secondary threshold dropped from £9,100 to £5,000. For a contractor on a typical day rate of £500, this adds approximately £1,500-£2,000 to the annual employer NIC bill per engagement. CFOs managing large contractor populations should factor this into workforce cost modelling, particularly where a significant proportion of engagements are classified as inside IR35.
What is ‘reasonable care’?
HMRC requires that employers take ‘reasonable care’ when determining whether a worker is inside of outside IR35. Although there are still penalties for accidental misclassifications, they are much harsher when a business is shown to have been negligent or deliberately misleading in its determinations.
According to HMRC, reasonable care means that clients must act in a way that would be expected of ‘a prudent and reasonable person in the client’s position’. That means that what counts as ‘reasonable’ depends on each individual business’ circumstances. For example, HMRC has stated that it expects a higher degree of care from large, multinational employers with internal finance teams than much smaller entities.
The risks of getting IR35 determinations wrong
Getting IR35 determinations wrong carries serious risks for an employer. First, they can be held responsible for all of the unpaid taxes that should have been paid to HMRC during the course of a worker’s engagement. They can also face fines of up to 100% of this amount plus interest depending on the degree to which HMRC deems they have deliberately withheld information.
However, there are also other non-financial consequences, which can be just as damaging to a business. These include:
- Reputational damage: HMRC may publish details of organisations that are found to have made inaccurate determinations, which can have a serious impact on a company’s reputation.
- Competitive disadvantage: Organisations that are known to take a poor approach to IR35 determinations are like to be at a competitive disadvantage to companies that are more diligent in their assessments. For example, these companies may be excluded from applying to government contracts and removed from preferred supplier lists.
- Contractual breaches: Organisations that fail to comply with the IR35 rules may be in breach of contract with their clients, suppliers, or partners. This could leave them liable for indemnities and warranties.
- Problems with talent attraction: As companies become known to take a law approach to IR35 determinations, they may face problems attracting contingent talent. Agencies and individual workers may be reluctant to work with organisations that are perceived to be involved in tax avoidance and opt to work with competitors instead.
Core challenges for FTSE 250 firms
Here are some of the key challenges FTSE 250 companies face as they navigate IR35 compliance:
- Correctly classifying workers: There’s no one key factor that determines a worker’s tax status. Instead, it’s based on a range of factors including working practices, the details of the contract and how the worker is paid (for example, whether they receive benefits such as health insurance, paid holidays, company discounts, gym memberships, etc). Making these determinations is not always simple, particularly for large organisations.
- Building adequate compliance processes: HMRC expects businesses engaging off-payroll workers to have comprehensive compliance processes in place to manage IR35 determinations. FTSE 250 firms must ensure they have the necessary resources and internal expertise to complete status determinations accurately and compliantly.
- Managing complex supply chains: Under the new rules, the end-user client is responsible for IR35 determinations. However,when supply chains are more complex, it is not always clear who the ‘client’ actually is. Large companies with complex supply chains must have robust processes in place to correctly identify the relevant parties and manage their exposure to IR35 risk.
- Navigating HMRC investigations: HMRC can issue information requests to companies to review their IR35 compliance. This may begin as a general information-seeking exercise with no indication that a deeper enquiry will follow. However, these initial communications are often the first step in a more formal investigation. Large organisations need to tread carefully when responding to any requests from HMRC.
8 Key IR35 pitfalls (and how to avoid them)
Getting IR35 compliance right isn’t easy — especially for large organisations. Here are some of the most common pitfalls that FTSE 250 firms encounter when navigating IR35 determinations, plus the steps you can take to avoid them.
1. Over-reliance on HMRC’s CEST tool
The ‘check employment status for tax’ (CEST) tool is an online resource provided by HMRC. It takes users through a series of questions and provides a decision on whether an engagement constitutes employment for tax purposes. HMRC has stated employers can rely on the results of the questionnaire as long as it was answered accurately, honestly and with ‘reasonable care’.
However, many of the questions the tool asks are open to misinterpretation and misunderstanding. That means there’s always a chance of error, even if you’re acting in good faith. In this case, HMRC would not stand by the CEST decision since they’ll argue that the information given was inaccurate.
In many cases, the CEST tool is unable to make a determination at all, with HMRC’s own data showing the result is ‘undetermined’ in around 22% cases. For this reason, organisations need to use a combination of the CEST tool and their own judgement to make IR35 determinations.
2. Making blanket determinations for all contractors
When an organisation engages a large number of contractors, it can be tempting to take a blanket approach to IR35 determinations, classifying all workers as either inside or outside IR35.
However, employment statuses will almost certainly differ from one contractor to another depending on the facts of each case. For this reason, this approach does not meet HMRC’s ‘reasonable care’ standard, and may be treated as deliberate behaviour when it comes to applying penalties. To avoid this, organisations must take the time to assess each case individually to ensure the correct status is assigned to each contractor.
It’s also important to remember that many contractors do not want to be classified as inside IR35, especially if this doesn’t match the reality of their situation. Businesses that try to take a one-size-fits-all approach will likely see problems with contractor engagement and retention.
3. Treating determinations as one-and-done
Many organisations make the mistake of thinking that they don’t need to worry about IR35 once they’ve made a determination and issued a Status Determination Status (SDS). However, it’s common for worker-client relationships to take on new dimensions as a contractor’s role expands.
If a worker’s working practices have changed or you’ve negotiated a new contract with a worker, it’s vital that you re-check your IR35 determination to see if the worker’s tax status has changed. It’s also good practice to reassess determinations periodically to keep everything up to date and avoid liability.
4. Not having a process for appeals
Workers and deemed employers (fee payers) have the right to disagree with a determination made by an end-user client. And, if you don’t have a set process in place for handling disagreements, this can cause problems for your business.
HMRC requires that businesses put in place formal procedures for dealing with appeals, which involve considering the reasons the worker or deemed employer disagrees and deciding whether to maintain the determination or change it. Employers must respond to appeals within 45 days. They should also keep detailed records of the determinations they make and the reasoning behind them, and document any disagreements too.
5. Failure to provide adequate training
In large organisations, the contingent workforce is almost never managed by one individual or department alone. Yet, many organisations leave IR35 compliance entirely to HR, finance, legal, procurement or another department. This is a mistake, as these people may not be wholly aware of the recruitment of independent workers that goes on in their organisation and the way those workers are managed.
Instead of relying solely on one department for IR35 compliance, it’s best practice to ensure anyone with the ability to hire contractors is aware of the rules and understands the need to complete a status determination for each worker. Providing such training ensures the relevant parties are equipped to identify potential issues and understand the tax and legal implications at stake.
6. Passing responsibility to intermediaries or contractors
End-user clients may have trouble using worker classification tools such as CEST, or otherwise making status determinations because they lack the necessary information about contractors and their work practices. For this reason, many organisations ask contractors or intermediaries to carry out determinations and simply approve the outcome without assessing how it has been reached.
As we’ve said, HMRC requires organisations to use ‘reasonable care’ when carrying out status determinations — and this approach is unlikely to meet this standard. This means it could lead to misclassifications and result in end-user clients being held responsible for payroll taxes.
To avoid this, organisations should put in place clear processes that require intermediates and/or contractors to provide the necessary information for accurate status determinations. They should also ensure this information is updated periodically throughout the contractual relationship. When supply chains are complex, it’s also important to require contracting parties to include the same provisions in their agreements down the contractual chain.
7. Using schemes to avoid IR35
Since the reforms to the IR35 rules in 2021, many schemes have been set up to help organisations manage compliance or to help workers increase their take-home pay. For example, umbrella companies employ contractors and take on the responsibility of paying their salaries, making the appropriate deductions and providing benefits like paid annual leave. At the moment, the IR35 rules are unlikely to apply in this situation.
However, while many of these schemes are legitimate and compliant with IR35, others are tax-avoidance schemes. For example, some schemes pass on earnings to workers through means other than salary, often making payments in the form of a ‘loan’. While this may help workers reduce their tax bill, any savings are usually negated by the fees these organisations charge for their services.
It goes without saying that these schemes are illegal and should be avoided. Before signing up for any scheme, both end-user clients and workers must carry out proper due diligence to ensure they understand the contractual chain involved.
Moreover, new rules governing umbrella companies came into effect from 6 April 2026. Under these rules, agencies that use umbrella companies are now responsible for ensuring that the correct tax and NICs are deducted and paid to HMRC. When there is no agency in the chain, this responsibility passes to the end client. End users are also now jointly and severally liable if an umbrella provider fails to account for PAYE and NICs correctly – meaning that even if you are not the direct fee payer, you could face liability if your umbrella arrangements are not compliant.
Employers that currently engage workers through umbrella companies should review their arrangements as a matter of priority, confirm that their umbrella providers are operating compliantly, and ensure their agencies have updated their processes for the new tax year.
8. Failing to reprice inside IR35 engagements after the NI increase
From April 2025, employer National Insurance increased from 13.8% to 15%, and the secondary threshold dropped from £9,100 to £5,000. For organisations with a large proportion of inside IR35 contractors, this represents a meaningful increase in total engagement costs – one that many businesses have not yet fully accounted for in their contractor rate cards or workforce budgets.
Unlike direct employees, where the NI increase is absorbed automatically through payroll, inside IR35 contractors require a conscious repricing exercise. Businesses that have not revisited their contractor cost models since April 2025 may be under-budgeting for their contingent workforce, or inadvertently absorbing costs that should have been factored into day rate negotiations.
CFOs should ensure their finance and procurement teams have modelled the impact of the NI increase across their contractor population and updated rate card assumptions accordingly. Where contracts are up for renewal, this is also an opportunity to renegotiate terms that reflect the current cost environment.
FAQs
What does it mean to mitigate IR35 risks, and where should a large business start?
To mitigate IR35 risks, a large business needs accurate status determinations, documented processes, and a complete contractor audit as part of its governance program.
The goal is not only to reach the right determination but to show HMRC that every decision was made through a consistent and well-documented process. It means keeping clear records, training the people responsible for making determinations, and maintaining an audit trail that demonstrates reasonable care if a decision is challenged.
The first step is to audit every contractor engagement across the business. Confirm how each contractor is engaged, whether a current Status Determination Statement (SDS) is on file, and whether the documented determination reflects the way the work is actually being carried out. Many large organisations find gaps in contractor records or outdated determinations during this review.
For FTSE 250 businesses, HMRC expects a higher standard of reasonable care from organisations with established finance, legal, and procurement functions. A structured contractor audit provides the evidence needed to support consistent IR35 determinations and demonstrate that reasonable care has been taken.
What are the three IR35 status determination tests and how should large businesses apply them?
The three main IR35 status tests are control, substitution, and mutuality of obligation. There’s no single test that determines the outcome.
Control looks at how much influence the client has over what work is done, how it is completed, when it is carried out, and where it takes place. Substitution considers whether the worker can genuinely send someone else to perform the work. Mutuality of obligation examines whether the client must provide ongoing work and whether the worker must accept it. HMRC and the courts assess these factors together, with greater weight placed on the reality of the working relationship than the contract itself.
A status determination should reflect how the contractor actually works, with the contract matching those working arrangements. CEST can support an IR35 risk assessment, but it does not assess mutuality of obligation directly and can return an undetermined outcome. Large businesses should treat CEST as one input rather than the final decision.
What should a FTSE 250 firm include in its IR35 Status Determination Statement process?
Every Status Determination Statement (SDS) should state whether the engagement is inside or outside IR35, explain how the decision was reached, and be issued in writing to both the worker and the next party in the contractual chain before the engagement begins.
An SDS that only states the outcome does not meet HMRC’s requirements. It should record the factors considered and why they led to the final determination.
Do not treat the SDS as a document that is completed once and never reviewed. Update it if the contractor’s role changes, the contract is renewed, working arrangements change, or the engagement continues beyond 12 months. If a worker or fee payer challenges the determination, respond within 45 days and keep a record of the review and the final decision.
For businesses managing hundreds of contractor engagements, the SDS process should be consistent so every determination, review, and dispute can be tracked and produced if HMRC requests it.
How can you mitigate IR35 risks when engaging contractors through agencies and complex supply chains?
To mitigate IR35 risks across a supply chain, businesses need clear contractual obligations that apply to every party involved in the engagement.
An SDS must be passed to the next party in the contractual chain, and the fee payer must operate PAYE correctly for inside IR35 engagements. If the correct tax is not deducted and paid, liability can move back to the end-user client. Agency agreements should also require written confirmation that the SDS has been received and that any changes to payroll providers or umbrella companies will be reported immediately.
Carry out an annual review of every contractor engagement to confirm who the fee payer is, how the worker is engaged, and that the SDS has been acknowledged in writing. This provides evidence that the business has taken reasonable care if HMRC reviews the arrangement.
For FTSE 250 businesses, supply chain governance should be treated as part of IR35 compliance rather than a responsibility passed to agencies.
What IR35 risks does an Employer of Record arrangement eliminate, and when is it the right solution?
An Employer of Record (EOR) removes IR35 risk because the worker is employed directly by the EOR rather than through a personal service company.
The EOR becomes the legal employer, runs PAYE, pays employer National Insurance contributions, and manages statutory employment obligations. As there is no personal service company in the arrangement, the IR35 rules do not apply. An EOR is often the right option for engagements that consistently fall inside IR35 or remain undetermined after a detailed review.
Moving a contractor to an EOR does not require the role or day-to-day work to change. The worker continues supporting the client, while the EOR takes responsibility for employment, payroll, and compliance. Businesses should weigh the EOR service fee against employer National Insurance contributions, the Apprenticeship Levy, and the ongoing cost of managing high-risk IR35 engagements.
For long-term engagements with limited scope to change working arrangements, an EOR can provide a simpler and lower-risk employment structure.
How Can You Mitigate IR35 Risks With CXC?
At CXC, we understand the stakes of IR35 compliance. We also understand that getting it right isn’t always easy – especially for large organisations with complex supply chains.
We support our UK clients by building comprehensive and robust processes for IR35 determinations, helping to develop communication plans and escalation procedures and even providing regular training sessions for internal stakeholders.
Want to find out more about how we could help your company to meet its IR35 obligations? Contact our team today.
About CXC
At CXC, we want to help you grow your business with flexible, contingent talent. But we also understand that managing a contingent workforce can be complicated, costly and time-consuming. Through our MSP solution, we can help you to fulfil all of your contingent hiring needs, including temp employees, independent contractors and SOW workers. And if your needs change? No problem. Our flexible solution is designed to scale up and down to match our clients’ requirements.
