The extension of the off-payroll working rules — commonly known as IR35 — to the private sector in April 2021 marked a significant shift in how UK businesses must treat contractors and self-employed workers. For the security industry, where flexible staffing and self-employed arrangements have historically been commonplace, the reforms introduced complexity that many companies are still navigating.
Getting IR35 wrong creates substantial financial exposure. HMRC can pursue the engaging company — not just the worker — for unpaid tax and National Insurance Contributions (NICs) going back years. This guide explains how IR35 applies to the UK security sector, what your obligations are, and how to manage your workforce to remain compliant.
What Is IR35?
IR35 is shorthand for the off-payroll working rules in Chapter 10 of ITEPA 2003 (for private sector and non-small businesses) and Chapter 8 (for individuals making their own determination). The rules were originally introduced in 2000 to address “disguised employment” — situations where a worker effectively operates as an employee but claims self-employed tax treatment by working through their own personal service company (PSC).
In practical terms, IR35 asks: if you stripped away the intermediary (the worker’s limited company or PSC), would the working arrangement look like employment? If yes, the worker is “inside IR35” and should pay employment taxes. If the working arrangements genuinely reflect self-employment, the worker is “outside IR35” and can continue to be paid on a self-employed basis.
Since April 2021, the responsibility for making this determination — for medium and large private sector businesses — shifted from the worker to the end client or hiring company. This is known as making a Status Determination Statement (SDS).
Does IR35 Affect Security Companies?
Yes, and potentially significantly. The security industry has several characteristics that interact with IR35 in important ways:
- High use of casual and agency workers — many security companies use self-employed or agency staff to cover shifts, particularly for events, additional site cover, and seasonal demand peaks
- Sole trader guards — some guards operate as sole traders (not through a limited company), which typically means they are genuinely self-employed for tax purposes and IR35 does not apply in the same way
- Guards operating through personal service companies — where a guard works through their own limited company, IR35 applies and you must make a Status Determination Statement
- Staffing agencies in the supply chain — many security companies source staff through agencies, which creates a layered liability question
It is also worth noting that many security guards simply work as employees — employed directly by the security company, on the PAYE payroll. IR35 does not apply to direct employees; it only concerns workers operating through an intermediary.
Small Company Exemption
Small companies are exempt from the April 2021 reforms and do not have to make Status Determination Statements. A company is “small” under the Companies Act 2006 if it meets two of the following three conditions:
- Annual turnover does not exceed £10.2 million
- Balance sheet total does not exceed £5.1 million
- No more than 50 employees
If your security company qualifies as small, the responsibility for making the IR35 determination reverts to the worker themselves (under Chapter 8 of ITEPA 2003). This is the position that applied to all private sector businesses before April 2021. However, you should still exercise care — if HMRC believes your company structure is designed to exploit the small company exemption artificially, they may investigate.
Note that the small company test applies each year, and if your company grows beyond the threshold, you will become subject to the full off-payroll rules from the following tax year.
Status Determination Statements (SDS)
If your security company is medium or large, you must produce a written Status Determination Statement for every contractor you engage who works through an intermediary. The SDS must:
- State whether the engagement is inside or outside IR35
- Give the reasons for that determination
- Be provided to the contractor and (where there is one) the agency or intermediary in the supply chain
HMRC provides the Check Employment Status for Tax (CEST) tool to assist with making determinations, though its outputs should be treated as indicative rather than definitive. In practice, the status of any specific engagement depends on the actual working practices — not just what the contract says.
If a worker disagrees with your determination, they have the right to dispute it. You must respond to a dispute in writing within 45 days and either maintain your determination with updated reasoning, or change it.
Key Employment Status Indicators for Security Workers
When assessing whether a security guard working through a limited company is inside or outside IR35, employment law tribunals and HMRC consider a range of factors. For the security industry, the most relevant are:
Mutuality of Obligation
Is the security company obliged to offer work, and is the worker obliged to accept it? Where a company is required to offer a minimum number of shifts and a guard is required to work them, this points towards employment. Where work is genuinely offered on a shift-by-shift basis with no obligation on either side, this supports genuine self-employment.
Substitution
Can the guard send a substitute to perform their duties? Genuine self-employment typically involves the right to substitute — i.e. the contract is for the delivery of a service, not the personal attendance of a specific individual. In the security context, substitution is complicated by SIA licensing requirements — any substitute must hold a valid SIA licence for the work — but a genuine, unfettered right of substitution remains evidence against employment status.
Control
Does the security company control how, when, and where the guard works? High levels of control — specific shift times, site allocation, uniform requirements, supervision — point towards employment. Where a guard has genuine flexibility over how they deliver their services, this supports self-employment.
Integration
Is the guard integrated into the company’s operation as if they were an employee — attending briefings, appearing in company communications, using company equipment? Integration points towards employment.
Liability When Using Agencies
Many security companies source self-employed or limited company workers through staffing agencies. Where an agency is in the supply chain, the liability for operating PAYE and paying employer NICs sits with the “fee-payer” — the entity that pays the intermediary. In most cases, this is the agency.
However, if the agency does not comply — for example, because you have provided an incorrect SDS — liability can pass up the chain to you as the end client. You should ensure any agency you use for contractor workers understands and complies with IR35 obligations, and that your SDSs are accurate and well-documented.
Practical Steps for Security Companies
To manage your IR35 exposure, consider the following:
- Audit your workforce — identify every worker who is not a direct PAYE employee and determine how they are engaged. Are they sole traders? Are they operating through a PSC? Are they agency workers?
- Assess each engagement — for workers using a PSC, conduct a genuine status assessment using HMRC’s CEST tool or with professional advice. Do not simply apply blanket “inside” or “outside” determinations without individual review.
- Issue SDSs — document your assessments and issue Status Determination Statements to the workers and any agencies in the chain.
- Review your contracts — ensure that your contracts with self-employed workers or PSCs reflect the actual working practices. A contract that says “substitution is permitted” is of no value if substitution never actually happens.
- Keep records — maintain records of your assessments, SDSs, and the basis for each determination. If HMRC enquires, you will need to demonstrate a reasonable and consistent approach.
How Guard Management Software Helps
Maintaining clear, accurate workforce records is fundamental to IR35 compliance. You need to know, for every shift on every site, who worked, what their employment status is, and how they are being paid.
TacDesk’s guard management platform gives security companies a complete record of their workforce — including employment status, SIA licence information, and GPS-verified attendance for every shift. When HMRC asks how a specific worker was engaged and whether they attended specific sites, accurate, time-stamped records are your best defence.
The platform also supports SIA licence verification for all officers, regardless of how they are engaged — essential when deploying a mix of directly employed staff, self-employed guards, and agency workers on the same site.
Frequently Asked Questions
Does IR35 apply to security guards who are sole traders?
Not in the same way. IR35 technically applies to workers who use an intermediary — typically a personal service company or limited company. Sole traders are taxed on their earnings as individuals and HMRC assesses their employment status directly. However, if you engage sole traders on arrangements that look like employment, HMRC may argue they are “workers” or employees for tax purposes under separate rules, so it is still worth reviewing the working arrangements.
What if I get an IR35 determination wrong?
If HMRC determines that a worker was wrongly classified as outside IR35, the fee-payer (typically the security company or its agency) becomes liable for the unpaid income tax and NICs, plus interest and potentially penalties. The liability can be substantial — particularly if the error has persisted over multiple years. Taking reasonable care with your SDSs and keeping good records can reduce penalties even if the underlying determination is later found to be wrong.
Can I use HMRC’s CEST tool to make my IR35 determinations?
HMRC will stand behind a CEST determination if you have answered the questions accurately and in good faith. However, CEST has limitations — it does not give an answer in all cases, and it has been criticised by employment lawyers for not fully reflecting the nuances of case law. For complex or high-value engagements, taking professional advice alongside CEST is advisable.
My company uses a lot of agency workers — am I still responsible?
As the end client, you are responsible for issuing an accurate SDS and passing it down the supply chain. If you provide an incorrect SDS, liability can pass to you. The agency is typically the fee-payer and operates PAYE, but only on the basis of the SDS you have provided.
Summary
IR35 is a genuine compliance burden for UK security companies that rely on flexible staffing models. The risks — financial liability for unpaid taxes, interest, and penalties — are significant enough to warrant proper attention. The good news is that with a clear audit of your workforce, accurate Status Determination Statements, and well-kept records, the risk is manageable.
The security industry’s underlying staffing model — shift-based, site-specific, licence-dependent — has features that can support genuine self-employment. But those arguments only hold if your working practices genuinely reflect them. Document everything, and when in doubt, take professional advice.
Keeping compliant starts with knowing your workforce. See how TacDesk helps UK security companies manage guard records, SIA compliance, and attendance verification.