IR35 is one of the most misunderstood areas of employment law — and for UK security companies that use self-employed guards or subcontractors, getting it wrong can result in backdated tax bills, National Insurance penalties, and a HMRC investigation that runs years into the past. Here is what security company directors need to know about IR35, how it applies to your workforce, and how to protect your business.
For ACS compliance, this is important. This guide covers the off-payroll working rules (commonly called IR35), what “deemed employment” means in practice, how HMRC assesses security subcontractors, and the steps security companies should take now to reduce their exposure.
What Is IR35?
IR35 is shorthand for the off-payroll working rules introduced by HMRC to tackle what it calls “disguised employment” — situations where a worker operates through a limited company or as self-employed but works in a way that is effectively the same as being an employee.
The rules were originally introduced in 2000 and have been significantly tightened since. From April 2021, medium and large private sector businesses became responsible for determining whether the workers they engage are inside or outside IR35 — shifting the liability from the individual worker to the business engaging them.
If a guard or subcontractor working for your security company is assessed as inside IR35, you (or the fee-payer in the labour supply chain) must deduct income tax and National Insurance contributions before paying them — just as you would with a payrolled employee.
Why Security Companies Are Particularly Exposed
The security industry has historically relied heavily on self-employed and subcontracted labour. Guards working through their own limited companies, sole traders taking on shifts, and labour-only subcontractors are common across the sector. This flexibility suits both sides — until HMRC takes a closer look.
HMRC focuses on three key tests when assessing employment status:
1. Control
Does your company direct how, when, and where the guard works? If a self-employed guard turns up at a site you specify, works the hours you set, follows your procedures and uniform code, and cannot choose to send a substitute without your approval, that points strongly toward employment — not genuine self-employment.
2. Substitution
Can the guard send someone else to do the work in their place? If the answer in practice is no — because your client requires named individuals, because you vet and approve all guards, or because the guard always shows up personally — then the substitution right is not real, and HMRC will see through it.
3. Mutuality of Obligation
Is there an ongoing expectation that you will offer work and the guard will accept it? If guards appear on your rota week after week, receive regular shift allocations, and have been working with you continuously for months or years, HMRC may treat that as evidence of an ongoing employment relationship.
In security, it is very common for all three tests to point toward employment. Guards follow rigid site instructions. Clients demand consistency. Rotas repeat. These are features of employment, not genuine freelancing.
What Happens If HMRC Investigates
A HMRC IR35 investigation is not quick, cheap, or contained. An investigation can reach back six years (or longer in cases of deliberate non-compliance). HMRC will typically review:
- Contracts between your company and the workers or their limited companies
- The actual working arrangements in practice (what really happens, not what the contract says)
- Payroll records, invoices, and BACS records
- Communications with guards about shifts, uniforms, conduct, and dismissal
If HMRC concludes that workers should have been treated as employees, the liability includes:
- Unpaid income tax (at the worker’s marginal rate)
- Employer National Insurance contributions (13.8%) on all payments
- Employee National Insurance contributions (recovered from you as the deemed employer)
- Apprenticeship levy on top, where applicable
- Interest on late payments
- Penalties ranging from 15% to 100% of unpaid tax for careless or deliberate failures
For a security company with 30 self-employed guards working over several years, the total liability can reach six or seven figures.
Does IR35 Apply to Your Security Company?
The rules that apply to you depend on your company’s size. HMRC defines a medium or large company as one that meets at least two of:
- Annual turnover above £10.2 million
- Balance sheet total above £5.1 million
- More than 50 employees
If you are a small company (below the threshold), the original IR35 rules apply — meaning the individual worker or their limited company is responsible for making the employment status determination and paying the correct tax. However, small companies are not immune: if your self-employed guards are genuinely inside IR35 and they are not paying the right tax, HMRC may investigate the wider arrangement.
If your security company is medium or large, you are responsible for issuing a Status Determination Statement (SDS) to every off-payroll worker before they begin work. The SDS must state whether the engagement is inside or outside IR35, and explain your reasoning. You cannot simply issue a blanket “outside IR35” SDS without genuine assessment.
How to Reduce Your Exposure
Audit your current workforce
Start by identifying every person working for you who is not on PAYE. That includes sole traders, personal service companies (PSCs), and subcontractors operating through limited companies. For each engagement, ask honestly whether the three tests — control, substitution, and mutuality of obligation — suggest employment or genuine self-employment.
Review your contracts
Many security companies use historic or template contracts that were not written with IR35 in mind. Review your contracts with an employment solicitor or IR35 specialist. A well-drafted contract that reflects a genuine independent contractor relationship is not sufficient on its own — the actual working arrangement must match — but a poorly drafted one can actively harm your position.
Document working arrangements properly
If you take the position that a guard is genuinely outside IR35, document why. Keep records of substitution arrangements that actually happen, evidence of financial risk borne by the contractor, and evidence that they work for multiple clients. Contemporaneous records are far more credible than retrospective explanations written during an investigation.
Consider moving to employment
For many security companies, the honest conclusion of an IR35 audit is that most of their “self-employed” guards are actually employees for tax purposes. Moving them onto payroll is administratively heavier but eliminates the liability going forward and avoids the risk of a costly HMRC investigation. It also simplifies compliance with the Working Time Regulations, holiday pay obligations, and the National Minimum Wage — all of which are also more complex for genuinely self-employed workers.
Where TacDesk Fits In
TacDesk does not give tax advice — that requires a qualified accountant or IR35 specialist. But what TacDesk does is give you the operational data you need to understand your workforce arrangements accurately.
When every shift is logged in TacDesk with precise GPS clock-in records, rota assignments, site instructions, and shift history, you have a complete audit trail of how your guards actually work. That data is critical whether you are conducting an internal IR35 review, instructing a specialist, or responding to a HMRC enquiry. You can see exactly which guards work exclusively for you, how often they are deployed, which sites they work at, and how their working patterns compare to your employed staff.
Security companies that run on spreadsheets and WhatsApp groups simply cannot produce that kind of clear, structured evidence. TacDesk gives you the operational clarity to make compliant decisions — and to defend them.
Key Takeaways
- IR35 affects security companies that use self-employed or limited company workers
- Medium and large companies must assess employment status and issue an SDS before work begins
- The key tests are control, substitution, and mutuality of obligation — all of which commonly point toward employment in the security sector
- HMRC can investigate up to six years back, and penalties can be severe
- Start with a workforce audit, review your contracts, and take specialist advice
- Operational records from systems like TacDesk support both your internal assessment and any HMRC enquiry
This article is for general information only and does not constitute tax or legal advice. For guidance on your specific situation, consult a qualified accountant or IR35 specialist.