For many principal contractors, supply chain due diligence starts with the companies they appoint directly. But that is rarely where the supply chain ends.
A Tier 1 subcontractor may appoint a Tier 2. That business may subcontract part of the package again or bring in a labour provider. Workers arriving on site can ultimately be employed or engaged by an organisation several relationships removed from the principal contractor.
That creates an increasingly important question:
If someone asked you today for a complete supply chain audit of one of your projects, could you produce it with confidence?
Not simply a list of the contractors you appointed at the start of the project. Could you show every organisation now contributing to delivery, who appointed whom, who employs the workforce and what checks or interventions have taken place?
For many construction businesses, producing that picture still means searching spreadsheets, interrogating different systems and asking project teams or subcontractors to reconstruct the chain.
And there is a fundamental problem with that approach: by the time you have finished auditing the supply chain, the supply chain may already have changed.
That matters more in 2026.
Changes to the Construction Industry Scheme have increased the potential financial consequences of certain fraud elsewhere in a construction chain. Changes to Right to Work rules from October will also extend liability into certain non-direct contractual arrangements, with new Home Office draft guidance placing greater emphasis on evidence that assurance arrangements operated effectively in practice.
A supply chain audit therefore needs to do more than prove that documents exist.
It needs to help you understand the supply chain actually delivering the project, identify where material risks sit and retain evidence of the decisions your business made.
What is a construction supply chain audit?
A construction supply chain audit is a structured review of the organisations, relationships, controls and evidence involved in delivering a construction project.
Traditionally, that might have focused heavily on supplier pre-qualification: is the contractor financially sound, appropriately insured, competent and approved to work for the business?
Those checks remain important.
But a project-level audit needs to answer a different set of questions:
- Who is delivering work on this project?
- Have appropriate supplier checks been completed?
- Are contractor records accurate and up to date?
- Can key decisions be evidenced if they're challenged?
- Is there a clear record of how the supply chain has evolved throughout the project?
That distinction matters because an approved supplier list tells you about organisations your business knows. It does not necessarily tell you how work is being delivered on a particular project today.
Why are supply chain audits becoming more important?
Construction has always relied on specialist supply chains. What's changing is the level of scrutiny surrounding how those supply chains are managed.
Clients expect greater transparency, while regulators increasingly expect organisations to demonstrate appropriate oversight. Commercial teams need confidence that risks across the supply chain are understood, while compliance teams need evidence that decisions can be justified.
At the same time, contractor hierarchies are becoming increasingly complex. Multiple tiers of subcontractors, labour providers and specialist businesses can all contribute to a single project, making it more difficult to maintain an accurate picture of who's delivering the work.
Without a structured audit process, organisations can face challenges such as:
- Incomplete contractor records
- Manual, time-consuming audits
- Inconsistent onboarding processes
- Limited visibility across projects
- Difficulty producing evidence when requested
- Increased commercial and compliance risk
The more complex your supply chain becomes, the more important it is to maintain accurate, accessible information.
Two legislative developments have made lower-tier supply chain visibility particularly relevant.
CIS fraud: knowing only your Tier 1 may not be enough
From 6 April 2026, HMRC gained new powers to tackle fraud within the Construction Industry Scheme. Where the statutory conditions are met, HMRC can make a determination against a business where it made a construction payment and knew or should have known that the payment was connected to deliberate non-compliance by another party.
That determination can equal 20% of the affected construction payment, with a further penalty of 30% of the determination. HMRC can also immediately cancel Gross Payment Status. Where GPS is cancelled for fraud or serious non-compliance arising from behaviour on or after 6 April 2026, the business can be prevented from reapplying for five years.
This does not make a principal contractor automatically liable for every failure in its supply chain. But it does make visibility more commercially important.
If there are organisations several tiers below your direct contractual relationship, can you identify them? Can you show how labour is being supplied? Can you demonstrate what your business knew, what was reviewed and what happened when concerns were identified?
Those are very different questions from simply asking whether a Tier 1 supplier signed the right contract.
Right to Work: evidence of assurance is becoming more important
Further change is coming on 1 October 2026.
The Right to Work scheme is being extended to additional working arrangements, including certain individual subcontracting and contractual-chain arrangements.
The Home Office's draft employer guidance, published in July 2026, is particularly relevant for supply chain auditing.
Where extended liability applies, the draft guidance says organisations seeking to establish a statutory excuse should be able to demonstrate that appropriate arrangements were operating effectively in practice and that reasonable and proportionate steps had been taken.
It also identifies examples of evidence that may be relevant, including audit records, assurance information received from employers or service providers, records of compliance reviews and information showing how concerns were identified and acted upon.
The guidance remains draft at the time of writing, so businesses should take appropriate legal advice on their specific obligations.
But the practical lesson is already clear.
An audit trail is more valuable when it is built as the work happens, rather than reconstructed after a problem occurs.
What should a supply chain audit include?
A supply chain audit shouldn't simply prove that documents exist. It should demonstrate that contractor information is accurate, supplier relationships are understood and governance has been maintained throughout the project lifecycle.
A comprehensive audit will typically include:
- Contractor details and verified business information
- Supplier verification records
- Insurance documentation
- Competency and accreditation evidence
- Contractual information
- Workforce compliance records
- Governance approvals
- Supporting evidence for key decisions
- A documented record of changes made throughout the project
The strongest audits don't just confirm what information exists today; they demonstrate how that information has been managed over time.
Supply chain audit checklist
Use this supply chain audit checklist to test how quickly your business could establish the true position on a live construction project:
- We can identify every organisation currently contributing to project delivery
- We know who appointed each organisation and where it sits in the contractor hierarchy
- We can identify the organisation employing or directly engaging each worker
- Contractor information has been appropriately verified
- Relevant insurance, competency, accreditation and compliance records are current
- We can distinguish directly contracted workers from labour supplied through downstream organisations
- New contractors entering the supply chain can be identified
- Material exceptions and unusual relationships are visible to the appropriate teams
- Supplier or subcontractor dependencies that could affect delivery can be identified
- Governance approvals and overrides are recorded
- We retain evidence of the action taken when an exception is identified
- We can retrieve a point-in-time record of the supply chain without manually reconstructing it from several systems
If completing this checklist requires searching multiple systems, contacting several teams or manually piecing together information, your audit process may be taking longer than necessary. You may need better ongoing supply chain visibility.