Recruitment agency compliance: references and audit trails
Clients, regulators and auditors all ask the same thing: show me how you checked this person. Here is how to have the answer ready.
What does recruitment agency compliance mean for references?
Recruitment agency compliance means following the law and your clients' rules when you vet candidates. For references, that means a lawful, transparent process under UK GDPR, the checks the Conduct Regulations 2003 require, any sector rules your clients work under, and records you can produce on request. RefAssure collects signed consent, chases referees and files a PDF audit trail for every candidate.
What does recruitment compliance cover?
Recruitment compliance is the set of legal and contractual duties an agency or employment business has to meet when it registers, vets and places people. References sit inside several of them at once.
The law that applies to every agency
- Employment Agencies Act 1973 and the Conduct Regulations 2003. Before you introduce or supply someone, you must confirm certain facts about them, and for roles with vulnerable people you must obtain two references. Our guide to the Conduct Regulations explains each duty.
- UK GDPR. Referee and candidate data needs a lawful basis, clear information and sensible retention. See reference consent and UK GDPR.
- Right to work. Checks follow Home Office guidance and are separate from references. See right to work checks.
Rules your clients bring with them
Place into care and your client answers to the CQC under Regulation 19 and Schedule 3. Place into schools and Keeping Children Safe in Education Part 3 applies. Supply the NHS and the NHS Employment Check Standards apply through your framework. Each one changes what a reference should ask and how far back it should reach.
Audits
Client audits, framework audits, MSP supplier reviews and REC membership checks all sample candidate files. If you are an REC member, its compliance assessment and the optional REC Audited accreditation look at how you follow the law and its Code of Professional Practice. Whoever is asking, a reference without a date, a consent record or a verifiable referee is hard to defend.
What every candidate file should show.
Six things that turn a reference into evidence.
Candidate consent
A signed, dated record that the candidate agreed to you contacting their referees.
A verifiable referee
Name, job title, organisation and a work email address you can stand behind.
The right questions
Questions that match the role and sector, asked the same way for every candidate.
A timeline
When the request went out, each reminder, and when the reference came back.
A signed answer
The referee signs what they wrote, so nobody can say it was changed later.
A file you can find
One PDF per reference, ready for a client or auditor in seconds.
One PDF answers the audit question.
RefAssure records each step automatically, so the evidence exists whether your busiest consultant ran the check or your newest.
- Consent collected online with signature before any referee is contacted
- Referees use a unique secure link, no login, on any device
- Bounced requests flagged, most within minutes, so you can fix the address
- Replies sent by email instead of the form are captured and forwarded
Spreadsheet compliance vs RefAssure.
| By hand | With RefAssure | |
|---|---|---|
| Consent | Ticked on a registration form, if at all | Signed online before referees are contacted |
| Chasing | Consultant remembers, or does not | 5 emails and up to 2 texts over 12 days |
| Consistency | Depends on who sends it | Same template and questions every time |
| Timeline | Rebuilt from inboxes when asked | Timestamps on every step, in the PDF |
| Cost | Hours of consultant time | From 80p per reference, no monthly fee |
Recruitment compliance questions
More in the full FAQs.
What is recruitment compliance software?
It is software that helps an agency collect, track and store the evidence behind its vetting, so files are complete and audit-ready. RefAssure covers the references and employment history part. Identity, right to work and DBS checks run through their own official services. See reference checking software.
Does the law require agencies to take references?
The Conduct Regulations 2003 require two references when a work-seeker will work with, care for or attend vulnerable people, along with other confirmations for every placement. Many clients require references for all roles through their contracts. Our Conduct Regulations guide sets this out.
What does an REC compliance check look at?
The REC asks members to complete a compliance assessment, and offers an REC Audited accreditation with an onsite review. Both look at legal compliance and its Code of Professional Practice. Contact the REC for current requirements; a tidy, dated reference file helps whatever they sample.
How long should agencies keep reference records?
The Conduct Regulations require records to be kept for at least one year, measured from the last time you provided services to that person for work-seeker details. UK GDPR says not to keep personal data longer than you need it, so set and document a retention period that fits your clients and sector.
Can one account cover several consultants and branches?
Yes. Team members are unlimited and share one pool of credits, so every consultant sends references the same way. See pricing.
Can clients see the evidence?
Each completed reference produces a PDF with the answers, signatures and a timeline. You can share it with a client or auditor in the same way you share any document.
Is RefAssure regulated sector compliance in a box?
No. It gives you the evidence for the reference part of a regulated sector check and helps you meet those rules. There are no built-in CQC, KCSIE or NHS templates, so add the questions your sector expects to your template once.
Related guides
Compliance evidence on every placement.
Your first reference is free. No monthly fee, no contract, credits never expire.