£38.5 million.
That is the IR35 liability the Cabinet Office has now recognised in its Annual Report and Accounts 2025-26. It covers unpaid tax and National Insurance on off-payroll workers going back to April 2017.
For years, the department's accounts said it had applied the off-payroll rules "with care". In October 2025, HMRC concluded otherwise. It found the department's historic processes were inadequate and that reasonable care was not taken.
That gap, between believing you have taken care and being able to prove it, is the real lesson. Weeks after the Foreign Office disclosed its own IR35 bill, it is a lesson the public sector keeps learning.
The facts
The Cabinet Office's 2025-26 accounts set out the position:
- HMRC began compliance checks in 2019, covering workers engaged since April 2017, when public bodies became responsible for IR35 decisions.
- In October 2025, HMRC concluded the department's historic processes were inadequate and reasonable care was not taken.
- The gross liability, including interest, is £38.467m. The department paid £15m to HMRC in February 2026, leaving a provision of £23.467m.
- HMRC reviewed four sampled groups of workers: review team leaders, commercial assessors, content designers and digital developers. A 39% average liability from those samples was applied across around £89m of off-payroll spend.
- A careless finding can also attract a penalty of 15% to 30% of the net tax, up to £8.9m. The department expects any penalty to be suspended, so has not provided for it.
The year before, the 2024-25 accounts still stated that "the department applied the off-payroll rules with care". They also noted HMRC's view that many workers classed as outside IR35 should have been inside. As Business Matters reported, drawing on a review of every set of accounts by IR35 Shield, the "with care" line appeared each year from 2020-21 to 2024-25.
Our take: IR35 is not a one-off decision
Getting IR35 right is not a tick-box exercise you complete once. Contracts change. People stay longer than planned. The way they work shifts.
A status decision made on day one may not hold two years later. Here, HMRC's checks reached all the way back to 2017. That is nine years of decisions, each one needing evidence that still stands up today.
The Cabinet Office believed it was taking care. Believing it is not enough. When HMRC asks, you need to show the assessment, the reasoning and the review that kept it current. We explored how quickly "temporary" becomes long-term in 24 Months and Counting.
The bigger challenge is visibility
For large organisations, the hardest part is often not the decision itself. It is seeing the whole picture.
External workers sit across HR, procurement, agency systems and service contracts. Often nobody has one view of who is working for the business, how each person was classified or the evidence behind it.
Without that view, you cannot see risk building. It only becomes visible when it lands as a liability. That is the hidden headcount problem, and it is not unique to the government.
Why blanket decisions don't fix it
Cases like this push organisations towards blanket decisions. Move every contractor on payroll. Cut contingent labour altogether. The Cabinet Office's own core department cut its contingent labour spend from £39m to £32m last year.
Moving everyone onto payroll can feel safer. But it brings higher costs and lost specialist skills. It also carries risk of its own, particularly now that joint and several liability is live in the umbrella sector.
And it does nothing about historic exposure. A liability built up since 2017 or 2021 stays a liability, whatever you decide tomorrow.
The better answer is to assess each engagement properly, review it as it changes and keep the evidence.
A board-level issue
When the exposure runs into tens of millions of pounds, this stops being an HR or procurement issue. External workforce compliance is a financial and governance issue. CFOs and boards need to own it.
The Cabinet Office joins a growing list. The Post Office, DEFRA, the Department for Work and Pensions and, most recently, the Foreign Office have all faced IR35 liabilities. We covered the scale of these cases in The £104m IR35 Lesson.
Public bodies are ultimately backed by the taxpayer. A private sector business facing the same finding is not. The difference is simply who pays.
Three questions every board can ask:
- Can we see it? Do we have one view of every external worker, however they were engaged?
- Can we prove it? For each engagement, could we show HMRC the assessment, the reasoning and the evidence?
- Is it current? When was each decision last reviewed against how the role works today?
If any answer is "not sure", that is where exposure is most likely to sit. Our misclassification risk calculator is a quick way to size what is at stake.
Care you can evidence
The Cabinet Office case is not really about the Cabinet Office. It is about the distance between saying you took care and being able to prove it.
If you engage contractors, you have IR35 exposure. The question is whether you can see where it sits, and whether your evidence would hold up if HMRC asked tomorrow.
CoComply helps HR, procurement and finance teams classify work correctly, route every engagement through the right process, and control the risk that travels with it. See how the platform works or book a demo.
Be Certain.
This article is for general information only and does not constitute legal, tax or professional advice. It reflects publicly available information at the time of writing and may not reflect later developments. Every organisation's circumstances are different, so you should seek specialist advice on your own arrangements before acting on anything raised here.
.png)
