If you pay subcontractors under the Construction Industry Scheme, you hold a lot of sensitive information about them. To verify a subcontractor with HMRC, you need their Unique Taxpayer Reference and, for a sole trader, their National Insurance number. For a company, you need the company’s tax reference and registration number. Add the bank details you pay them into, and you have exactly the information a fraudster or identity thief wants.
So here is a question worth asking: who in your firm can see it?
What CIS requires you to keep
HMRC sets out what contractors must do. You must verify subcontractors before paying them, file monthly returns, give subcontractors payment and deduction statements, and keep full CIS records for at least three years after the end of the tax year they relate to. You can be fined if you do not.
So the information has to be collected, and it has to be kept. That is not the problem. The problem is where it ends up.
Where subcontractor details usually live
In most building firms we look at, subcontractor details are spread across several places:
- A spreadsheet on a shared drive that anyone in the office can open
- The accounts mailbox, full of emails with tax references and bank details from new subcontractors
- The accounts or payroll software, which is usually the best-protected copy
- The site manager’s phone, with photos of forms and messages from subcontractors
- Old copies, saved to laptops, printed and filed, or left in the mailbox of someone who has since left
The software copy is often fine. The spreadsheet and the mailbox are where the risk is.
Why it matters
The information is personal data under UK GDPR, so you are responsible for keeping it secure and only letting people see it who need to. If it leaks, you may have to report it to the ICO, and you will certainly have to explain it to your subcontractors.
It is also a fraud risk. Someone who can see a subcontractor’s details and your payment schedule has everything they need to send a convincing “change of bank details” email at the right moment. We cover that fraud in how payment fraud hits a building firm.
How to tighten it up
- Decide who actually needs access. Usually that is the people who set up subcontractors and make payments, and perhaps a director. Not the whole office, and not every site manager.
- Keep the details in one place. The accounts or payroll software is usually the right place. Retire the spreadsheet, or lock it down so only the people who need it can open it.
- Stop collecting details by email. Use a secure form or upload link instead, so tax references and bank details do not sit in an inbox for years.
- Clean up the mailbox. Move what you need into the right system and delete old emails holding sensitive details, once you are sure you no longer need them to meet the record-keeping rules.
- Protect the accounts that hold it. Multi-factor sign-in on every mailbox and on the accounts software. Check that leavers’ accounts are switched off promptly.
- Keep records for as long as HMRC requires, then delete them. Holding details for years longer than you need increases the risk without any benefit.
Where construction meets accounting
Many building firms use an outside accountant or bookkeeper for CIS returns and payroll. That means the same information also lives with them, and moves between you and them. It is worth knowing how it gets there. If the answer is “a spreadsheet attached to an email every month”, that is the first thing to fix.
We work with accountancy practices as well as builders, so we see this from both sides. See IT support for accountants and IT support for construction companies.
Related: How does payment fraud hit a building firm?
Find out where your IT stands
Book a free 15-minute call. If it’s a fit, the next step is our IT Risk and Ownership Review: £295 + VAT, using read-only access to your Microsoft 365, and credited against your first month.
