How to conduct a contingent workforce audit: a 12-check list

Most contingent workforce audits stall on the first question: who is working for us today?

Finance can tell you who was paid last quarter. IT can tell you who has a login. Managers can tell you who joined their stand-up this morning. Those three lists rarely match, and the gaps between them are where the audit findings live.

This is the checklist I use to conduct a contingent workforce audit. It has twelve checks, each with a pass condition and the evidence to collect. It is our framework, not an industry standard, and it is built for the procurement, HR or finance lead who has just inherited a few dozen contractors and needs a clear picture before the next board question.

A contingent workforce audit starts with one list, not a policy

The first job is counting. Every other check runs against a list of people, so the audit is only as good as that list.

Build it from three exports and reconcile them line by line:

• Accounts payable (AP). Every supplier and individual paid for services in the last 12 months who is not on payroll.
• System access. Every active account, badge or license held by someone who is not an employee.
• Managers. A short request to each budget holder: who outside the payroll is working for your team right now, through which supplier, and until when?

A name on one list and missing from another is a finding in its own right. Someone paid but unknown to any manager is a spend question. Someone with access but no payment record may be working through a supplier you have not identified, or may have finished months ago with the account still open.

Your contingent workforce includes independent contractors, freelancers, temps supplied by a staffing agency, and consultants delivering against a statement of work (SOW). People employed for you by an employer of record (EOR) belong on the list too, even if you decide later to treat them differently. When in doubt, include the person and note why.

Who should run the audit, and what to collect first

One person should own the audit, and three functions should supply evidence. In my view the owner is whoever will run the program afterwards, because that person has to live with the findings. If no one owns the program yet, finance is usually best placed to start, since the AP export is the most complete list you have.

Before you start the checks, collect four things:

1. The reconciled list of people, with the supplier each works through.
2. Every supplier agreement and individual contractor agreement currently in force.
3. The last three months of supplier invoices.
4. Whatever approval records exist, wherever they live: an approval tool, email or chat.

Expect the fourth item to be the hardest. That is normal, and it is itself the result of check 11.

The 12-check contingent workforce audit

Run every check for every person on the list. Mark each one pass or fail, and file the evidence next to the result so a second reviewer can repeat your call without asking you.

#	Check	Passes when	Evidence to collect	Result
1	One reconciled list	The AP, system-access and manager lists agree on every name	The three exports and the reconciled list, with each mismatch resolved and noted	Pass / Fail
2	Named internal owner	Every person has one employee accountable for their work	Owner name per row, confirmed by that owner	Pass / Fail
3	Engagement type recorded	Every person is labelled as agency temp, independent contractor, SOW consultant or EOR	Engagement type per row, and the supplier for anyone not engaged directly	Pass / Fail
4	Contract in force	A signed agreement covers the person for today's date	The individual agreement or the supplier agreement that covers them, with start and end dates	Pass / Fail
5	Tax documentation on file	Each directly engaged US contractor has a completed Form W-9, and payments are reported where required	The W-9 per contractor, and the information returns filed for last year	Pass / Fail
6	Classification reasoning recorded	A dated, written determination exists for every directly engaged contractor	The determination memo, or for UK engagements the status determination statement (SDS) where the client must issue one	Pass / Fail
7	Onboarding complete	Every step your policy requires was done before work started	The completed checklist with dates: confidentiality agreement, intellectual property terms, security training or whatever your policy lists	Pass / Fail
8	Rate in writing and matched	The rate billed equals the rate agreed for that role and period	The rate from the contract or rate card, set against the rate on the last three invoices	Pass / Fail
9	Purchase order covers the period	A purchase order (PO) or budget approval covers the dates billed, with money left	PO number, the period it covers and the remaining balance	Pass / Fail
10	Invoiced time matches approved time	Every billed hour or day traces to an approved timesheet	A sample of invoice lines, each matched to an approved timesheet entry	Pass / Fail
11	Approval recorded	Each approval shows who approved, what and when, in a record that cannot be quietly changed	The approval log, not a screenshot of a chat thread	Pass / Fail
12	End date known and access ends	Every engagement has an end date, and access stopped on the last day for those that ended	End date per row, and for each engagement ended in the last six months, the date access was removed	Pass / Fail

A few notes on the checks that need context.

Check 5. The US Internal Revenue Service (IRS) says that once you have determined someone is an independent contractor, the first step is to have them complete Form W-9, Request for Taxpayer Identification Number and Certification, and to keep it for four years (IRS, Forms and associated taxes for independent contractors, read 19 October 2026). The same page covers Form 1099-NEC reporting and backup withholding when a contractor has not provided a taxpayer identification number. For agency workers, the supplier carries these obligations, so the evidence is the supplier agreement rather than a form per person. Outside the US, the forms differ; ask your adviser which ones apply.

Check 6. The IRS groups the evidence into three categories: behavioral control, financial control and the type of relationship. It says no single factor decides, and it tells businesses to "document each of the factors used in coming up with the determination" (IRS, Independent contractor (self-employed) or employee?, read 19 October 2026). The US Department of Labor (DOL) states that employers are responsible for determining whether a worker is an employee under the Fair Labor Standards Act (FLSA) (DOL, Misclassification of employees as independent contractors, as of October 2026).

In the UK, HM Revenue and Customs (HMRC), the UK tax authority, says that under IR35, the UK's off-payroll working rules, the client is in most cases responsible for determining status and should produce an SDS with its reasons (GOV.UK, Understanding off-payroll working (IR35), read 19 October 2026). This check asks only whether the reasoning exists and is dated. It does not decide anyone's status; that is a judgment for a qualified adviser.

Check 10. Sampling is fine here. I would take the last three invoices from each supplier and trace every line. If one line fails, test the whole period for that supplier.

Check 12. The audit tests the past six months because that is where offboarding gaps show up. An account that outlives the engagement is a security finding, and an engagement with no end date is a budget finding.

How to read the results and what to fix first

Count the fails by check, not by person. Ten fails on check 11 tell you approvals live in chat. One fail on check 4 tells you someone is working without a contract. Those need different fixes.

My order of repair, which is opinion rather than a standard:

1. Checks 1, 4 and 12 first. An unknown worker, a worker with no contract and an open account after the last day are the findings I would least like to explain to an auditor.
2. Checks 5 and 6 next, with your adviser. These carry tax and employment exposure, and the fix is a conversation with someone qualified, not a spreadsheet column.
3. Checks 8 to 11 together. They are one chain: the agreed rate, the PO, the approved time and the invoice. Fixing one link without the others moves the problem rather than solving it.
4. Checks 2, 3 and 7 last. They matter, and they are usually quick once the rest is in place.

If more than a handful of checks fail across the list, the issue is rarely effort. It is that the records live in five places and nobody owns the joins between them.

What changes after the audit

The audit gives you a picture on one day. The harder part is keeping the twelve checks true next quarter without running the whole exercise again.

That is the problem I built VendOrca, the AI-native vendor management system (VMS), to handle. Each worker goes through an onboarding checklist built from your program's template before they can start (overview). An assignment binds one onboarded worker to a rate card for a date range, time is recorded against that assignment, and invoices are built only from approved time (key concepts). The tie-out compares what was invoiced for a period with what was approved and lists every difference by kind (invoicing and tie-out). A change adds a record rather than overwriting one, so the history is there when you or your adviser look back.

You can also bring the reconciled list from check 1 straight in. Records come in from spreadsheet files, and VendOrca checks each file first and saves nothing until the record count matches what you expect (import).

Frequently asked questions

How often should you conduct a contingent workforce audit?

I would run the full twelve checks once a year and before any major change, such as consolidating suppliers or choosing a system. Checks 1 and 12 are worth repeating every quarter, because headcount and access drift fastest.

Who should own a contingent workforce audit: HR, procurement or finance?

One owner, with evidence from all three. I think the owner should be whoever runs the program afterwards. If nobody does yet, finance is a practical starting point because the AP export is usually the most complete list.

Does a contingent workforce audit decide worker classification?

No. Check 6 confirms that a dated, written determination exists and shows what evidence it rests on. Whether a worker is an employee or a contractor is a legal judgment for a qualified adviser, made against the guidance for the jurisdiction where the work is done.

Do agency workers need the same checks as direct contractors?

Most checks apply to everyone on the list. For agency workers, checks 5 and 6 usually point to the supplier agreement, since the agency engages the worker, but checks 1, 2, 8, 10 and 12 apply exactly as they do to direct contractors.

A contingent workforce audit is a counting exercise before it is anything else. Get one list, test every name against the same twelve checks, keep the evidence next to each result, and fix the chain from rate to invoice as one piece of work. If you want the checks to stay true after the audit, you can Start free.

Sources

• IRS, Independent contractor (self-employed) or employee?, read 19 October 2026.
• IRS, Forms and associated taxes for independent contractors, read 19 October 2026.
• US Department of Labor, Wage and Hour Division, Misclassification of employees as independent contractors under the FLSA, read 19 October 2026.
• HMRC on GOV.UK, Understanding off-payroll working (IR35), read 19 October 2026.