To find every contractor in your organisation, start with the money and the access, not the HR system. Supplier spend, purchase orders, system logins and site passes show who is really working for you. Match them against your contractor records, and the gaps are your hidden workforce.
Ask most large organisations how many contractors they have and you will get a number. Ask where it came from and the answer is usually a spreadsheet, a managed service provider report or someone's best guess. It rarely includes people supplied through consultancies, outsourced services or statements of work. Those are often the engagements that carry the most IR35 risk.
Why can't most organisations answer "what's our contractor population?"
Because no single team owns the full picture. Contractors come in through several routes, and each route keeps its own records:
- HR sees people engaged directly or through the preferred supplier list
- Procurement sees suppliers and contracts, but not always the individuals behind them
- Finance sees invoices and spend
- IT sees logins and devices
- Facilities sees site passes
None of these lists match, and nobody is asked to reconcile them. One Group Tax Manager told us that if HMRC came on site and asked for their contractor population, they "wouldn't have a clue". The last time they tried, a one-off spreadsheet exercise took around two months.
The gap matters more now. HMRC is asking larger businesses direct questions about their off-payroll workers, including through campaigns such as Project Snowball. And you cannot make a status determination, issue an SDS or show reasonable care for someone you do not know is there.
It is not only a tax question. In one audit, a contractor cost around £190,000 a year for work a £60,000 employee could have done. Without a full list you cannot benchmark rates, negotiate with suppliers or plan headcount. And if you cannot see a worker, you cannot be sure their system and site access ends when the engagement does.
Who counts as a contractor?
Anyone who works for you and is not on your payroll. Agree that definition before you start counting. In many organisations HR, procurement and finance each use a different one, so their numbers never match.
| Worker type | How they usually arrive | Where they hide |
|---|---|---|
| Limited company (PSC) contractors | Directly or through an agency | Agency invoices, project budgets |
| Agency and umbrella workers | Recruitment agency or managed service provider (MSP) | MSP reports that cover only some suppliers |
| Consultancy and statement of work personnel | Consultancy, outsourced service or SoW | Procurement contracts bought as a "service", with no names attached |
| Freelancers and sole traders | Directly, often by a single manager | Expense claims, small purchase orders, credit cards |
| Overseas contractors | Directly or through an employer of record | International entities, separate payment systems |
| Long-tenure workers | Any route, extended year after year | Renewed purchase orders nobody reviews |
The third row is usually the largest blind spot. One procurement lead estimated that between 700 and 1,500 people a year came through service providers, on top of the contractors they already tracked. As they put it: "You don't even know they're contractors." We explain why these arrangements carry IR35 risk in Who is responsible for IR35 when your agency calls itself a consultancy?
Where do hidden contractors come from?
Hidden headcount builds up through four routes. Knowing them tells you where to look first.
- Purchased services. A consultancy provides "design services" or an IT firm provides "technical support". It sits in procurement as services spend, but the people often work in your teams under your managers.
- Headcount freeze workarounds. When hiring is restricted, budget holders find other routes: a freelancer engaged directly, a specialist from someone's network, a consultant extended "for another three months".
- Supply chain labour. Your own suppliers may use contractors to deliver your contracts, sometimes on your premises and under your direction.
- The extension trap. A three-month project becomes six, then twelve, then twenty-four. The worker is still recorded as temporary, and the IR35 position is never revisited. We look at this in 24 months and counting.
How do you find every contractor? Five steps
- Agree the definition and the owner. Write down who counts (use the table above) and name one person accountable for the final list. Without an owner, the exercise stalls between teams.
- Pull every data source. Collect the lists in the table below for the last 12 months. Ask each team for a raw export, not a summary.
- Match people, not suppliers. Combine the lists and match on name, email or worker ID. Where a supplier invoice has no names, ask the supplier for them. A service contract with day rates per person is a sign there are individuals to find.
- Investigate the gaps. Anyone with a login, a site pass or a recurring payment but no contractor record is a gap. So is anyone on a contractor record with no current contract. Check each one with their line manager, and ask budget holders directly who is working for them outside HR systems. The answers often surprise.
- Record what you find. For each person, capture the supplier, route, role, start date, rate, line manager and whether an IR35 determination exists. That becomes your baseline.
| Data source | Who holds it | What it shows |
|---|---|---|
| Accounts payable and supplier spend | Finance | Every supplier you pay, including small ones |
| Purchase orders and contracts | Procurement | Engagements, rates and renewal dates |
| MSP or agency reports | Procurement or HR | Workers on the preferred supplier list |
| User accounts and device logs | IT | Non-employees with system access |
| Building passes | Facilities or security | People on site |
| Expense claims and company cards | Finance | Freelancers paid outside purchase orders |
| IR35 determinations and SDS records | HR or tax | Who has already been assessed |
IT and facilities data is often the most revealing. Someone who logs in every day is working for you, whatever the contract says. One audit lead told us some contractors had worked on site "for a number of years" with no record on the contractor list.
How do you keep the list current?
A one-off count is out of date within weeks. Contracts are extended, new suppliers are added and managers bring people in under existing purchase orders. To keep the picture accurate:
- Categorise the engagement or service at the outset as a labour supply or contracted out service
- Perform your own worker status assessment on contractors identified
- Make the contractor record a condition of onboarding, so nobody gets a login or a pass without one, and link the end of every engagement to removing that access
- Review the list against spend and access data every quarter
- Re-check the IR35 position periodically and upon each extension or change in scope
- Report the total and its trend to the board alongside headcount
The aim is to answer HMRC's first question in minutes, not months. It also shows where you are paying different rates for the same role, or spending more on contractors than the permanent headcount you were refused. We look at why some sectors are most exposed in Hidden headcount: why automotive and aviation companies are most exposed, and at the risk of long-running engagements in 24 months and counting: the hidden risk of temporary contractors.
CoComply is an external workforce compliance platform. It brings your contractor, supplier and spend data into one record, so you can see your whole external workforce, classify each engagement and control the risk across your supply chain.
Next step: Our external workforce governance guide sets out how to build oversight of your whole external workforce, from discovery to ongoing control.
Frequently asked questions
Who counts as a contractor for IR35? Anyone who provides their services through their own limited company and is engaged by your organisation, directly or through an agency. For an accurate picture of risk, count everyone not on your payroll, including agency, umbrella and statement of work personnel.
Who should own the contractor list? One named person, usually in HR, procurement or tax, with input from finance, IT and facilities. Without a single owner, the lists never get reconciled.
How often should we review our contractor population? At least quarterly, and every time an engagement is extended or its scope changes.
Why do consultancy and outsourced services matter? People supplied through a consultancy or statement of work often never appear in contractor records. If the arrangement is really a supply of labour, your organisation is still the client for IR35.
