What an Audit-Ready Employee File Must Actually Contain

When a compliance officer or tribunal asks for proof that someone was eligible to work, “it’s in the folder somewhere” is not an answer. An employee file is not routine admin; it is legal evidence. Every offer, check, signature, policy acknowledgement, and variation must stand up to scrutiny long after onboarding ends. If you need to check employee right to work, you need more than a saved scan or a shared drive shortcut. You need a record that shows what was verified, when, by whom, and what happened next.

This tutorial explains what an audit-ready employee file must actually contain. It walks through right-to-work evidence with expiry dates, share codes, IDVT, and the limits of expired BRPs. It then covers new employee onboarding, contracts and variations, probation records, signed handbook and policy acknowledgements with timestamps, mandatory documents and training records, follow-up checks for time-limited status, and the audit trail of who changed what. Finally, it shows why shared drives fail the audit test and what structured document management looks like, with a practical checklist to help you close gaps before they become findings.

Why Your Employee File Is Legal Evidence, Not Admin

A right-to-work check establishes your statutory excuse against a civil penalty, and that excuse rests on the evidence you retained, not the intention you had. The file is the compliance record.

A compliance officer, auditor or employment tribunal will not ask whether you meant to comply. It will ask for the document: what was seen, on what date, by whom, and what copy exists now.

Three tests decide whether a record survives scrutiny:

• Retrievability: can you produce it without a search?
• Integrity: is it the version that existed on the date claimed?
• Attribution: can you show who created or changed it?

The file is wider than immigration status. It holds the signed contract, handbook and policy acknowledgements, mandatory onboarding documents, probation records and training records. This is why checking employee records belongs to evidence management, not administration.

Treat HR document management that way and the structure changes: every document gains an owner, a date and a reason for being there. Design the file so a stranger could answer a tribunal request in minutes, not so the person who ran onboarding answers it from memory.

What a Right-to-Work Check Must Contain Before Day One

Right to work is the first evidence layer. GOV.UK guidance sets out the requirement to carry out checks before employment begins; confirm the exact wording against the current employer’s guide. A check completed after the start date leaves a period without a statutory excuse (GOV.UK employer guidance).

For a manual check, original documents must be seen with the holder present; confirm the permitted formats against the current GOV.UK employer’s guide before relying on any specific exclusions.

Make and keep copies of the documents you checked. The retained copy, not the act of checking, is what the audit file is built from.

You must not require a particular check method or treat applicants differently according to the method used; avoid demanding passports from some new starters and not others.

Record four things for every check: the document or share code used, the date, the person who carried it out, and where the retained copy now sits. Structured fields keep employee records current.

Share Codes, IDVT and Expired BRPs: Getting the Method Right

Manual checks cover one route only. Since GOV.UK’s 26 June 2025 update, biometric residence cards and permits are no longer acceptable proof of right to work; employers must request a share code instead. Expired physical BRPs are expressly not acceptable, so an old card in the file is a liability rather than evidence.

Share codes are unavailable to British and Irish citizens, who must be verified via original documents or an identity service provider using IDVT. Where IDVT is used, record the provider, the check date and the outcome, so the file still answers who, when and what. Treat that as good practice rather than a stated legal requirement.

Build a process that holds both methods, as the direction of travel is digital verification alongside manual checks.

GOV.UK right-to-work guidance has been rewritten repeatedly, with further versions indicated. Confirm the version in force before treating any description as settled, and date-stamp the version your team works from. Our frequently asked questions cover the practical queries this raises.

New Employee Onboarding: What the File Holds After Day One

With the check method settled, the file itself becomes the evidence. After day one it must answer three questions: what did this person agree to, what were they told, and what did they confirm they had read and understood.

Stay organised and compliant, and a defensible file lets someone with no knowledge of the hire reconstruct the terms of employment at any point, without interviewing the manager who hired them. Consistency is what makes it defensible: the same components for every new starter mean gaps are visible rather than discovered during an investigation.

This is where employee onboarding becomes a record-keeping discipline rather than a paper chase. Same fields, same sequence, same evidence, for every hire.

Contracts, Variations and Probation Records

With the terms of employment established, the file’s next job is to prove what was agreed, and when.

The signed contract or written statement of particulars must reflect the terms actually agreed: start date, job title, pay, hours and place of work.

Every variation needs its own record, whether a pay review, hours change, role move or relocation. Capture both the date agreed and the date effective; an unsigned variation is the most common silent gap in a file.

Probation records should hold the end date, review notes, any extension, and the decision to confirm or not, with the date it was communicated.

Never overwrite. Retain superseded terms as version history, so you can show what applied during the period being questioned.

Signed Handbook and Policy Acknowledgements with Timestamps

Contracts prove the terms agreed. Acknowledgements prove what people were told and accepted.

Keeping evidence that staff have read and understood policies matters most where a compliance obligation sits behind them: information security, data protection and acceptable use. The wider exposure is covered in What About Security and Compliance?.

A timestamped acknowledgement tied to a named employee and a specific policy version is stronger evidence than an undated signature on a printed sheet. Record which version of the handbook and each policy was acknowledged, because acceptance of an old version does not evidence acceptance of the current one. Prompt re-acknowledgement when a policy is updated, and retain the earlier record rather than replacing it, so you can show what applied at the time.

Store acknowledgements against the employee record, not in an inbox or shared folder, so they travel with the person throughout the employment relationship.

Mandatory Documents and Training Records

Beyond acknowledgements, the file holds the documents that keep employment lawful and safe. Standard items include emergency contact details, payroll and bank information, pension enrolment where applicable, and sector-specific checks such as DBS verification where the role requires it.

Health and safety briefing records should note the date of the briefing and who delivered it, because these are commonly requested after an incident.

Training records need completion dates: induction, information security awareness, equality and diversity, and any role-specific mandatory training with a renewal cycle. Where training expires, store the renewal date so the certificate stays current rather than becoming history. Training: What’s about to expire? illustrates why renewal dates work best as searchable fields rather than scanned paper.

Expiry Dates and Follow-Up Checks for Time-Limited Status

Training renewals follow the same pattern as time-limited right to work. A follow-up check must be carried out before the status document expires — confirm the required method against the GOV.UK employer’s guide in force.

Timing is the whole point. As a matter of logic, a check completed after expiry cannot establish a statutory excuse for the intervening period. Confirm the position against the Code of Practice.

That makes the expiry date a data field, not a diary note. If it is not searchable, the follow-up depends on someone remembering, a process risk in a person’s head, not the system.

Each time-limited record should hold four data points: check type, date of last check, expiry date of the status, and next review date with a named owner. Where an employee’s immigration status changes, such as a new visa or settled status, record a new check rather than editing the original, so the history of how the statutory excuse was maintained stays intact.

The Audit Trail: Who Changed What, and When

Expiry tracking only works if the record itself is trustworthy. An audit trail captures who created, viewed, edited or deleted each item, and when. Without it, every claim about the file rests on recollection.

Shared drives hold only the last saved version with no change history — the failure mode explored in the next section.

Deletion is the quiet failure. A document that vanishes when someone tidies a folder, leaving no trace that it existed, is not evidence.

Prioritise audit trails for the records most likely to be challenged: policy acknowledgements, contract changes and approvals, right-to-work checks, and access to records holding personal data.

HR Document Management: Why Shared Drives Fail the Audit Test

An audit trail exposes the failure; a shared drive is where it lives. A shared drive indexes nothing. Retrieval depends on knowing who saved a document and what they called it, so the file works for the person who built it and stops working when they leave, because the index leaves with them.

Naming conventions drift. The same contract can appear in three folders under three titles, and an auditor cannot tell which copy is the version of record.

No shared drive tracks expiry dates or triggers follow-up checks.

Access is uncontrolled. Records containing personal data sit where access is granted by link rather than by role, a data protection exposure as much as a record-keeping one.

Assembling a file for a subject access request, an audit or a tribunal claim becomes a manual exercise measured in days, and the answer arrives late.

The pattern is consistent: shared drives store documents; they do not maintain records. Records need structure, dates, ownership and history.

What Audit-Ready Looks Like on a Structured System

Structured records replace folder paths with a single employee record. Bring employee onboarding, employee records and documentation, and the company handbook into one system, so every document attaches to the person rather than to a location someone must remember.

Right-to-work data belongs in structured fields: check type, check date and expiry date. A time-limited status then generates a follow-up prompt instead of depending on a diary note.

Handbook and policy acknowledgements should be captured with timestamps at the moment of acceptance, and tied to the version acknowledged. Training records, timesheets and appraisal notes sit against the same record, so the file is complete when requested rather than assembled afterwards.

Configuration should match your size. The same structure supports a small SME with one onboarding route and a larger employer with multiple entities and policy sets. For larger organisations, a configurable HR system such as Activ People HR can act as the employee-facing front end for onboarding and records while underlying data stays in enterprise systems, keeping the audit-ready file intact without duplicating ownership. The checklist that follows turns this structure into daily practice.

Your Employee Onboarding Checklist for an Audit-Ready File

Structure is only half the answer; the file must also be maintained. Use this checklist to verify your process end to end:

• Check right to work before day one. Retain the copy you are required to keep, the check date and who carried it out.
• Hold expiry dates as data. A follow-up check must run before the status document expires, not once someone remembers.
• Timestamp handbook and policy acknowledgements against the version acknowledged, and re-acknowledge whenever a policy changes.
• Version contracts, variations and probation decisions rather than overwriting the original, so you can show what applied on any given date.
• Keep an audit trail of who changed what, and move right-to-work evidence and acknowledgements off shared drives, where retrieval, version control and expiry tracking all fail.

Pair this with written policies, including a defined approach to absence management, and the record holds up when tested.

Conclusion

An audit-ready employee file is legal evidence, not admin. The checklist above captures the core actions — right-to-work timing, expiry tracking, versioned contracts and timestamped acknowledgements. Your next step is to run the checklist end to end and choose a system that maintains it. Build the habit, and every audit becomes a demonstration of good management.