The right to work check checklist: before day one, on the day, and after
One correct check before employment starts gives you the statutory excuse; one missed step can cost up to £60,000 per worker. This checklist covers the three routes, what to record, and the follow-up dates that must not fall through the cracks.
Check before day one, with the person present or via the official online service; copy what you checked in a form that can't be altered; record the date; keep it for the employment plus 2 years; diary a follow-up if permission is time-limited. All figures and rules verified against gov.uk on 2 September 2026.
Download the right to work checklist PDF · 2 pages · free, no email asked
The checklist
- Right to work confirmed before employment starts - the check protects you only for employment that began after it.
- Check run on every new hire, British and Irish citizens included - checking only people you assume need one is direct discrimination waiting to be written down.
- The person doing the check knows which of the three routes applies (below) - and that a photocopy of a share code email is not a check.
- Candidate provides their share code and date of birth.
- You run the code through the Home Office online checking service yourself - do not accept a screenshot the candidate took.
- The photo on the online result matches the person in front of you (in person or on a video call).
- Save the profile page result (PDF or unalterable copy) and record the date of the check.
- You see original documents from the Home Office acceptable list - typically a passport (current or, for British/Irish citizens, in some cases expired) or birth certificate combinations.
- Checked with the person present - physically or via live video while you hold the originals.
- Photos, dates of birth and names consistent across documents; any name difference explained by a marriage certificate or deed poll, copied too.
- Copy made that cannot be changed, clear enough to read; date of the check recorded on it.
- Check run through a certified identity service provider using identity document validation technology.
- You still confirm the verified identity matches the person who turns up - the IDSP verifies the document, you verify the human.
- IDSP output saved with the date, same retention as everything else.
- Copy or online result stored somewhere access-controlled, in a form that cannot be edited.
- Date of the check recorded - the excuse depends on when, not just whether.
- Kept for the whole employment plus 2 years after the person leaves - then deleted; identity documents held forever become a GDPR liability instead of a defence.
- If permission is time-limited, the expiry date goes in a register with a reminder ahead of it - not in the manager's memory.
- Follow-up check completed before the current permission expires, and the new result stored with its date.
- Someone owns the register. "HR will notice" is not an owner.
Why the boring parts matter
A correct check before day one gives you the statutory excuse - protection from the civil penalty of up to £60,000 per illegal worker - and knowingly employing someone without permission is a criminal matter carrying up to 5 years' imprisonment and an unlimited fine (gov.uk: checking right to work, gov.uk: penalties). The failures that actually happen in small companies are rarely wilful: the check done in week two instead of before day one, the share-code screenshot accepted at face value, and above all the missed follow-up - a visa that expired eighteen months ago while the paperwork sat in a drawer. The checklist's whole job is to make those three impossible.
Running the register so it keeps itself
The follow-up dates are where a spreadsheet quietly fails: it reminds nobody. CoDash keeps a right-to-work register with the check date, the evidence and the expiry alongside the rest of the employee record, and chases the follow-up before it lapses - the same pattern as DBS renewals and training expiry. Guidance changes over time too: re-check the gov.uk pages above whenever you hire under a new scheme, and treat this checklist as the process skeleton rather than the last word.
Frequently asked questions
When must a right to work check be done?
Before employment starts - on or before day one, not during week one. A check done after the start date does not protect you for the period already worked, and the statutory excuse only covers employment that began after a correct check.
What are the three ways to check right to work?
The Home Office online service using a share code the candidate gives you (for most visa holders and eVisa status); a manual check of original documents with the person present (the route for British and Irish citizens with physical documents); or a certified identity service provider using digital identity verification for British and Irish citizens with valid passports.
How long must right to work records be kept?
For the whole of the person's employment and for 2 years after they leave - a copy that cannot be changed, clear enough to read, with the date of the check recorded. Delete after that window closes; keeping identity documents forever is a GDPR problem of its own.
What is the penalty for employing someone without a right to work check?
A civil penalty of up to £60,000 per illegal worker where no correct check was done - and knowingly employing someone without permission can mean up to 5 years' imprisonment and an unlimited fine. A correct check before day one gives the statutory excuse against the civil penalty.
Worth reading alongside
Keep reading: All 71 HR guides · 32 free templates · 26 calculators
A register that chases its own expiry dates
CoDash holds the check, the evidence and the expiry against each person's record - and reminds you before a follow-up falls due, the same way it chases DBS renewals and training.