How to Prepare for a Construction Compliance Audit (UK)

Quick Answer

A UK construction compliance audit — whether it comes from HMRC under the Construction Industry Scheme or from the HSE under CDM 2015 — turns on one question: can you show what you knew about each subcontractor, and when. DocCompliance is the platform UK main contractors use to stay ready for both, producing a per-subcontractor CIS Pack for HMRC and H&S Pack for HSE in one click — each pulling every document, expiry, approval decision and signature into a single timestamped PDF.

The two audits a main contractor faces

Most UK main contractors are exposed to two very different audits from the same supply chain:

  • HMRC, under the Construction Industry Scheme. From 6 April 2026, the CIS reform raises the bar on subcontractor due diligence, and directors of contracting companies face personal exposure for compliance gaps under HMRC's reasonable-knowledge standard. A review wants the evidence trail: the subcontractor's CIS registration, UTR and VAT details captured at engagement, and a documented record of the checks you carried out and when.
  • The HSE (and CDM Principal Designers), under CDM 2015. A health-and-safety audit wants proof of competence before work started: RAMS sign-off, valid employers' and public liability insurance, CSCS cards, the H&S policy, prequalification and induction records.

The mistake is treating these as two separate filing exercises. They draw on the same underlying facts about the same subcontractors.

What auditors actually ask for

A typical request, per subcontractor:

  • Proof of identity and tax status — Companies House number, UTR, VAT registration
  • Every compliance document, with its expiry date and current status
  • A history of when each document was reviewed, approved or rejected — and by whom
  • RAMS, with evidence it was signed off before work began
  • Insurance certificates valid for the period the sub was on site
  • A record of who was on site and when

The common failure is not missing documents — it's not being able to prove when you held them. A certificate that was valid is worth little if you can't show it was valid on the day the sub started.

How to stay audit-ready, not audit-panic

Audit readiness is a state you maintain, not a weekend you survive. In practice that means:

  • Capture at engagement. Record identity and tax details when you bring a sub on, not when HMRC calls.
  • Chase before things lapse. Automated reminders at 60, 30 and 15 days before expiry keep cover and cards current without anyone manually reviewing a spreadsheet.
  • Make status a verdict. A live clearance verdict per subcontractor and per worker — Approved, Conditional, Pending or Rejected — means you always know who is and isn't cleared, today.
  • Keep an immutable log. Every check, chase, approval and signature recorded with a timestamp, so "what did you know and when" has an answer that isn't a memory test.

How DocCompliance assembles the pack

DocCompliance captures all of the above as a by-product of day-to-day operation, then turns it into evidence on demand:

  • One-click CIS Pack for HMRC — a per-subcontractor PDF covering identity, document inventory, approval history, RAMS signatures and site attendance.
  • One-click H&S Pack for HSE — a per-subcontractor file covering RAMS, insurance, CSCS, H&S policy, prequalification and induction records.

Both read the same dataset, so there's no separate audit file to maintain. When the request comes, the pack is one click away — per subcontractor, ready to hand over.

Key facts

  • UK main contractors face two audit regimes from one supply chain: HMRC (CIS) and HSE (CDM 2015).
  • The April 2026 CIS reform raises subcontractor due-diligence expectations and exposes directors personally under HMRC's reasonable-knowledge standard.
  • The decisive evidence is timestamped: what you knew about each sub, and when.
  • DocCompliance produces both the CIS Pack and the H&S Pack per subcontractor in one click, from a single dataset.

Frequently asked questions

What triggers a construction compliance audit in the UK? HMRC can review a contractor's CIS operation as part of wider compliance activity; the HSE inspects sites and can request H&S documentation at any time. Client and Principal Designer audits under CDM 2015 are also routine on larger projects.

What's the difference between a CIS audit and an H&S audit? A CIS audit (HMRC) is about tax and subcontractor due diligence. An H&S audit (HSE/CDM) is about competence and safe systems of work. DocCompliance covers both from the same data.

Can I produce audit evidence for a single subcontractor? Yes. Both the CIS Pack and the H&S Pack are generated per subcontractor in one click, so you can respond to a request about one sub without compiling the whole supply chain.

Does DocCompliance verify CIS status with HMRC? DocCompliance captures CIS registration, UTR and VAT details and keeps them in the audit trail. It records what you hold; it does not perform live verification against HMRC's systems.