UK contractors must verify every subcontractor with HMRC under the Construction Industry Scheme before making a first payment, track insurance certificates that expire mid-project, maintain CSCS card records for every operative on site, and retain version-controlled RAMS documents per task. Most project management software handles some of this. None handles all of it without either gaps or add-on tools. This article covers the specific compliance requirements and what a complete subcontractor management system needs to do.
Under the Construction Industry Scheme (HMRC publication CIS340), contractors must verify every subcontractor with HMRC before making the first payment under each contract. The information required for verification is:
Verification is done online through the HMRC business tax account or by phone (0300 200 3210). HMRC returns a verification reference number which must be recorded and retained as proof. The verification outcome determines the deduction rate:
Re-verification is required if a subcontractor has not been included on a CIS return in the current or previous two tax years. For contractors using multiple subcontractors across projects over several years, managing which subcontractors need re-verification before each new engagement is a real administrative burden without software support.
Several accounting and payroll platforms can connect to HMRC to verify CIS status and apply deductions automatically:
These tools handle the tax mechanics. They do not typically handle the non-financial compliance elements — insurance certificates, CSCS cards, RAMS — which sit in a different category.
Contractors operating under most main contractor or client agreements must ensure every subcontractor maintains minimum insurance levels. The two statutory and contractual requirements are:
The failure mode is predictable: a subcontractor's ELI renews in March. The certificate in the contractor's records shows the previous year's policy. No one notices the expiry until an HSE visit or a RAMS audit. A 30-day pre-expiry alert from a document management system catches this; a folder of scanned certificates reviewed manually once a year does not.
Software that handles this must: store a scanned or PDF certificate per subcontractor, extract or allow manual entry of the expiry date, and send alerts at 30, 14, and 7 days before expiry. Ideally, it should block that subcontractor from being assigned to new work if their insurance is expired or within 14 days of expiry.
CSCS (Construction Skills Certification Scheme) cards are not legally mandatory but are required for site access by virtually all main contractors and public-sector clients. The card colour indicates the holder's qualification level:
For contractors managing multiple subcontractors with variable workforce compositions, the compliance task is ensuring every operative on each site has a valid CSCS card at the correct grade for their role. Cards expire and must be renewed. Workers who arrive at a gate with an expired card are turned away — which creates both a programme delay and a reputational problem with the client.
Software that manages this needs: a per-operative CSCS record linked to each subcontractor, automated expiry tracking, site-specific access requirements (role level required per site), and flagging of operatives whose cards are expired or about to expire.
Under CDM 2015 Regulation 8, principal contractors must verify subcontractor competence before work starts. In practice, this means obtaining Risk Assessments and Method Statements (RAMS) from each subcontractor for each task type before work begins.
The common failures in RAMS management are:
Software needs: a RAMS library per subcontractor and task type with version control, a mandatory project-specific adaptation requirement (the generic template must be reviewed and confirmed as project-specific before approval), and an audit trail linking each approved RAMS to the project, date, and approving manager.
CIS verification sits in the accounting platform. Insurance and CSCS cards sit in a document management system or a spreadsheet. RAMS sit in email or a shared folder. For a contractor managing 20–30 active subcontractors across multiple live projects, this fragmentation means compliance depends on individual vigilance rather than system alerts — which is how compliance gaps happen.
A unified system that holds CIS status, insurance certificates with expiry alerts, CSCS card records, and RAMS documents in a single searchable database per subcontractor, integrated with the project management and accounting tools, eliminates the most common failure modes. No single off-the-shelf construction platform covers all of this out of the box. The combination of Xero for CIS, a document management platform for certificates and RAMS, and a project management tool for assignment creates workable coverage — or a bespoke system can consolidate them.