What do employers get wrong about right to work compliance?

They often treat it as a one-time onboarding form rather than a lifecycle control. The common mistakes are inconsistent application, missing evidence, failing to diarise expiry dates, and relying on processes that were not updated when the rules changed.

Why employers get right to work compliance wrong

The biggest error is treating right to work as a one-off onboarding check instead of a control that has to stay current for as long as employment continues. That mindset leads to uneven checks, missing records, overlooked expiry dates, and outdated procedures after rule changes. Compliance fails when the process is not repeatable, evidence-led, and owned beyond day one.

Where right to work controls usually break down

The practical failure is usually not a single dramatic mistake, but weak process discipline. Different managers or recruiters apply the rule differently, supporting evidence is not retained consistently, and follow-up checks are missed when a visa or permission expires. Employers also assume that a policy written before a rule change still works after the rules have changed.

That matters because the control is only as strong as the organisation’s ability to prove what was checked, when it was checked, and whether any time-limited permission was re-verified on schedule. If the evidence trail is incomplete, the employer can have a compliance problem even when the person was initially eligible to work.

What good compliance looks like in practice

Good practice is to treat right to work as a lifecycle process with clear triggers, ownership, and records. The check should be consistent for every relevant hire, the evidence should be stored in a retrievable form, and any time-limited permission should be diarised so the follow-up check happens before expiry. If the process changed, the old version should be retired rather than left in circulation.

For employers that rely on HR, recruitment, or shared service teams, the key question is whether the process still works when hiring volume rises or when responsibility moves between teams. A compliant policy that only works when one experienced person remembers the edge cases is fragile by design.

Risk and Threat Considerations

Right to work failures create both compliance exposure and operational exposure. The immediate risk is unlawful working or missing the point at which a worker’s permission expires, but the broader risk is that inconsistent processes make it hard to demonstrate diligence if challenged.

Failure mechanism: Controls fail when onboarding is treated as the end of the check, records are incomplete, expiry dates are not tracked, or policy updates are not propagated into daily practice.

Impact: Employers can end up with avoidable legal and regulatory exposure, unsupported employment decisions, and a weak audit trail that is difficult to defend after the fact.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Right to work evidence and expiry tracking depend on controlled lifecycle records.
Recommendation — Track expiry-driven eligibility evidence and revoke outdated records on schedule.
ISO/IEC 27001:2022	A.5.33 — Protection of records	The question hinges on keeping auditable proof of eligibility and follow-up checks.
	A.5.36 — Compliance with policies, rules and standards for information security	Employers must keep working practices aligned with updated legal and policy requirements.
Recommendation — Retain right to work evidence in a controlled, retrievable records process. Update HR compliance procedures promptly when right to work rules change.

Practitioner Guidance

What to verify: Confirm that the process distinguishes between initial eligibility checks and follow-up checks for time-limited permission. If your evidence cannot show both, the control is not operating as intended.

Decision rule: If the rule set changed, treat process documentation, templates, and diary triggers as compliance artefacts that must be updated, not as administrative detail. If those items are stale, the control is stale too.

Practitioner takeaway: The real test is not whether a right to work check was done once, but whether the organisation can keep proving eligibility over time with consistent evidence and current procedures.