Part of the Construction Software Guide
Construction 30 July 2026 7 min read

Subcontractor Management and CIS Compliance: What Software Needs to Handle

A UK contractor carries four duties. It must check every subcontractor with HMRC under the Construction Industry Scheme before the first payment. It must follow insurance certificates that run out during a job. It must hold a CSCS card record for every worker on site. It must keep the RAMS documents for each task, with a record of each version. Most project management software handles some of this. None handles all of it without either gaps or add-on tools. This article covers the specific compliance requirements and what a complete subcontractor management system needs to do.

Connect with us about construction software · · Replies within 24 hours

CIS: what verification actually requires

Under the Construction Industry Scheme (HMRC publication CIS340), contractors must verify every subcontractor with HMRC before making the first payment under each contract. The information required for verification is:

  • Subcontractor's full name
  • Unique Taxpayer Reference (UTR)
  • National Insurance number

Verification is done online through the HMRC business tax account or by phone (0300 200 3210). HMRC returns a verification reference number which must be recorded and retained as proof. The verification outcome determines the deduction rate:

  • 0%: subcontractor holds Gross Payment Status (GPS)
  • 20%: subcontractor is registered for CIS but does not hold GPS
  • 30%: subcontractor is not registered for CIS or cannot be verified

Re-verification is required if a subcontractor has not been included on a CIS return in the current or previous two tax years. A contractor may use many subcontractors across several years. Knowing which one must be checked again before the next job is real work. Without software it takes a great deal of time.

Applying the wrong deduction rate is a liability. A contractor may pay at 0% or 20% when the correct rate is 30%. That often happens because it trusted an old check, and did not ask whether a new one was due. The contractor then owes the money that was not deducted. The deduction is the contractor's obligation to pay to HMRC, not the subcontractor's.

Software that handles CIS automatically

Several accounting and payroll platforms can connect to HMRC to verify CIS status and apply deductions automatically:

  • Xero: real-time CIS deduction calculation on invoices and bills; advanced CIS add-on for subcontractor verification and automatic validation of tax status with HMRC
  • QuickBooks UK: automatic deduction calculations and direct filing of CIS returns to HMRC
  • Clear Books: verifies subcontractor status with HMRC, auto-calculates deduction rate, auto-generates monthly CIS300 returns
  • Nomi: verification workflow, CIS payslips and certificates, full subcontractor management

These tools handle the tax mechanics. They do not typically handle the non-financial compliance elements (insurance certificates, CSCS cards, RAMS) which sit in a different category.

Insurance certificate management

Contractors operating under most main contractor or client agreements must make every subcontractor keep the least insurance you allow. The two statutory and contractual requirements are:

  • Employers' Liability Insurance (ELI): statutory requirement with a minimum £5 million cover. HSE can issue daily fines of £2,500 for periods where ELI cover lapses.
  • Public Liability Insurance (PLI): required by most contracts at levels between £1 million and £10 million depending on the client and project type.

The failure mode is predictable: a subcontractor's ELI renews in March. The certificate in the contractor's records shows the previous year's policy. No one notices the expiry until an HSE visit or a RAMS audit. A 30-day pre-expiry alert from a document management system catches this; a folder of scanned certificates reviewed manually once a year does not.

Your software must do three things here. Hold a scan or a PDF of the certificate for each subcontractor. Read the end date, or let somebody type it in. Warn you 30, 14 and 7 days before that date. Ideally, it should block that subcontractor from being assigned to new work if their insurance is expired or within 14 days of expiry.

Connect with us about construction software · · Replies within 24 hours

CSCS card management

CSCS (Construction Skills Certification Scheme) cards are not legally mandatory but are required for site access by virtually all main contractors and public-sector clients. The card colour indicates the holder's qualification level:

  • Green: labourer (CSCS Labourer card)
  • Blue: skilled worker
  • Gold: advanced craft or supervisory
  • Black: management
  • White: professionally qualified

A contractor may use many subcontractors, and the workers may change from week to week. It must still know that every worker on every site holds a valid CSCS card, at the right grade for the job they do. Cards expire and must be renewed. A worker who arrives at the gate with an expired card is sent home. The programme slips, and the client thinks less of you.

Your software needs four things here. A CSCS record for each worker, joined to their subcontractor. Automatic tracking of the end date. The grade each site requires. A warning for any worker whose card has run out, or is about to.

RAMS document control

Under CDM 2015 Regulation 8, principal contractors must verify subcontractor competence before work starts. In practice, this means obtaining Risk Assessments and Method Statements (RAMS) from each subcontractor for each task type before work begins.

The common failures in RAMS management are:

  • Generic RAMS submitted: the subcontractor gives you a document that describes the task type generally rather than the specific conditions on this project. On a CDM inspection, a generic RAMS without project-specific adaptation is often inadequate.
  • There is no record of the versions. The RAMS you sent at tender is not the one used on site. Nobody can say which version was current on any day.
  • No link to incidents: if a defect or an accident happens, you should be able to find the right RAMS at oncerievable. In systems where RAMS are stored as email attachments or in an unstructured folder, this retrieval is slow and sometimes impossible.

Your software needs three things here. A RAMS library for each subcontractor and each task type, with every version kept. A rule that the general template must be reviewed and made specific to the job before anybody approves it. An audit trail that joins each approved RAMS to the project, the date and the manager who approved it.

Why you hold copies of somebody else's records

Look at what the list above actually asks of you. A CIS status that HMRC owns. An insurance certificate that an insurer issued. A CSCS card that a scheme holds. A RAMS that a subcontractor wrote.

None of it is your data, and you keep a copy of all of it. The copy is a scan with a date somebody typed. It goes out of step the moment the real record changes, and you learn that at the gate.

A shared foundation removes the copy. A subcontractor, a worker, a certificate and a card are declared once, with permanent identifiers. The subcontractor grants you a narrow view of their own record, for the length of the job, and the system logs every use. When their insurance is renewed, you see the new certificate, because you were never holding a copy.

That is what an interoperable market makes possible. We explain it in what does an interoperable software market look like. We show how a sector builds on one foundation in bespoke software for a whole sector.

The case for a unified subcontractor compliance system

CIS verification sits in the accounting platform. Insurance and CSCS cards sit in a document management system or a spreadsheet. RAMS sit in email or a shared folder. A contractor may hold 20 to 30 live subcontractors across several jobs. With the records split up, compliance then depends on one person noticing, and not on a warning from the system. That is how a gap appears.

One system can hold all of it for each subcontractor, in a database you can search. The CIS status. The insurance certificates, with a warning before each one ends. The CSCS cards. The RAMS. Join that to your project and accounting tools, and the usual failures stop. No single off-the-shelf construction platform covers all of this out of the box. Three tools together will cover it. Xero for CIS. A document platform for the certificates and the RAMS. A project tool to assign the work. A system of your own can hold all three in one place.

Sources and further reading

You can see this in a working system. The ESRE live construction demo opens with no login, and it shows the subcontractor work in this guide. Sign in as subcontractor and see the assigned tasks and docs, or as PM and approve the variation. It is a working system, not a screenshot.