ACS Approved. Still Exposed.

A Tier 2 security contractor held SIA Approved Contractor Scheme status. Evidence-led audit uncovered serious payroll, employment and corporate warning signs that regulatory approval alone had not exposed.

The supplier looked credible

It operated in a regulated UK industry.

It held Security Industry Authority Approved Contractor Scheme status.

It was a Tier 2 supplier operating within an established commercial supply chain.

• Workers attended sites.
• Services were delivered.
• Invoices were submitted.

From the perspective of an enterprise relying upon conventional supplier controls, there was little obvious reason to assume that the workforce beneath the contract required substantially deeper investigation.

Then the audit moved beyond accreditation and supplier declarations.

What emerged was not one isolated compliance issue.

It was a series of interconnected questions across employment, payroll, corporate structure, payment evidence, subcontracting and audit cooperation.

Individually, each anomaly required investigation.

Together, they demonstrated why regulatory approval and workforce assurance are fundamentally different things.

The supplier was ACS Approved

This point matters.

The case did not involve an obviously questionable business operating outside a regulated market.

The supplier operated within the UK private security industry and held SIA Approved Contractor Scheme status.

ACS approval is an important component of security-industry procurement and provides customers with independent assurance against the requirements of the scheme.

HMRC itself recognises SIA and ACS status as relevant controls when considering labour supply-chain assurance within the security industry.

But HMRC recommends something else as well:

Audit the underlying workforce.

Current HMRC labour supply-chain guidance identifies security workforces as potentially exposed to risks including employment-status non-compliance, organised labour payroll fraud, cash-in-hand arrangements, complex tax-avoidance arrangements and disguised or offshore payment structures.

Its recommended controls therefore extend beyond accreditation to checking subcontractors, employment arrangements and payslips and conducting regular audits against contractual requirements.

This case illustrates why.

ACS approval provided an important control. It did not answer every question sitting underneath the workforce.

The contract said one thing. The workforce evidence raised questions about another.

The contractual model required the contracted supplier to provide appropriately employed and compliant labour.

As the audit progressed, evidence emerged indicating that some workers associated with delivery of the contracted services may have been connected with another company rather than the contracted Tier 2 supplier itself.

That immediately changed the nature of the audit.

The question was no longer simply:

“Is our ACS Approved supplier compliant?”

It became:

“Who actually employs these people?”

That question is fundamental.

Because once another legal entity appears between the contracted supplier and the worker, a series of further questions follows.

• Who operates PAYE?
• Who pays the worker?
• Who holds the employment contract?
• Who carries Employers' Liability insurance?
• Who accounts to HMRC?
• Was the use of that entity permitted under the principal contract?
• Was the entity disclosed?
• Was it itself subject to appropriate due diligence?

And ultimately:

Did the enterprise actually know who was supplying its workforce?

The pattern matters more than any individual anomaly

None of these indicators should automatically be treated as proof of fraud.

• A changed director is not proof of fraud.
• A failed company is not proof of fraud.
• A payroll discrepancy is not proof of fraud.
• A missing document is not proof of fraud.
• Use of another company is not necessarily improper.
• A cash payment is not automatically unlawful.

But effective assurance does not examine each event in isolation.

It asks whether the events form a pattern.

In this case, the audit raised interconnected questions involving:

At that point, the issue is no longer ordinary supplier administration.

It is an enterprise assurance problem.

What if nobody had looked?

This is perhaps the most important part of the case.

• The security officers would still have attended work.
• The customer would still have received its security service.
• The Tier 1 contractor would still have received invoices.
• The Tier 2 contractor would still have appeared within the approved supply chain.
• And its SIA Approved Contractor Scheme status could have provided additional comfort.

Without an evidence-led audit, there may have been no obvious operational event requiring the enterprise to look underneath the arrangement.

That is precisely the vulnerability.

A labour supply chain does not have to fail operationally to be failing underneath.

What could the enterprise have been exposed to?

The precise legal and tax consequences always depend upon the facts and applicable law.

But inadequately controlled labour arrangements can create potential exposure across several areas.

ACS approval was a control. Audit provided the assurance.

This is the central lesson from the case.

The supplier's SIA Approved Contractor Scheme status mattered. It formed part of the control environment.

But it could not answer every question the enterprise needed answered.

It could not replace:

• workforce sampling;
• payroll reconciliation;
• corporate due diligence;
• payment verification;
• subcontractor disclosure;
• contractual audit rights;
• evidence gathering;
• exception management; or
• enforcement.

That distinction is fundamental.

Both matter. They perform different functions.

The Tutandos approach

The methodology developed from cases such as this is deliberately evidence-led.

The question this case left behind

The most important question was not:

“How did an ACS Approved supplier generate these audit concerns?”

It was:

“What would we have known if nobody had audited beneath the ACS approval?”

For boards relying upon outsourced workforces, that question extends far beyond the security industry.

• A supplier can be established.
• It can operate in a regulated industry.
• It can hold recognised accreditation.
• It can deliver the service successfully every day.

And the enterprise can still have a material assurance gap underneath it.

The Board Test

For every material outsourced workforce, ask:

Visibility. Evidence. Control.

Regulation provides a control. Evidence provides assurance.

Tutandos provides enterprises with the audit capability, contractual framework and continuing monitoring required to understand what is actually happening within outsourced workforces.

Because sometimes the most important question is not whether your supplier has been approved.

It is whether anybody has looked underneath it.