Annual Internal Audit Pack for Sponsor Licence Compliance

Holding a sponsor licence is not a static status. It is an ongoing compliance responsibility.

An annual internal audit pack for sponsor licence compliance ensures your business remains inspection-ready, audit-resilient, and fully aligned with UKVI expectations.

This guide outlines what your yearly compliance review must cover — before UKVI does it for you.

Key Points at a Glance

• Sponsor licence compliance requires continuous monitoring — not reactive fixes.
  
  

• Reporting duties must be actioned within strict 10 or 20 working day deadlines.
  
  

• Internal mock audits significantly reduce licence downgrade risk.
  
  

• HR systems must match SMS records exactly.
  
  

• A structured annual compliance pack protects your ability to sponsor talent.
  
  
  

What Is Sponsor Licence Compliance?

Sponsor licence compliance refers to the legal and operational duties imposed on UK employers approved by UK Visas and Immigration (UKVI) to sponsor migrant workers in certain visa routes, such as Skilled Worker and Global Business Mobility.

By holding a sponsor licence, you agree to:

• Monitor sponsored workers
  
  

• Report relevant changes promptly
  
  

• Maintain detailed HR records
  
  

• Ensure salary and role compliance
  
  

• Prevent illegal working
  
  

UKVI may conduct announced or unannounced audits at any time.

An annual internal audit ensures you identify weaknesses before UKVI does.

Part 1: Annual Compliance Risk Review

Reporting Duties Audit 

You must report relevant changes to sponsored workers’ circumstances within 10 working days via the Sponsor Management System (SMS):

• Delayed start dates
  
  

• Unauthorised absences (10+ consecutive working days)
  
  

• Change in work location
  
  

• Change in salary
  
  

• Termination of employment
  
  

• Significant change in duties
  
  
  

Example

If a sponsored worker changes office location or switches to hybrid working permanently, this must be reported.

Failure to report = breach of sponsor duties.

You must report relevant changes to your organisation within 20 working days via the Sponsor Management System (SMS), for example:

• Changes to Key Personnel details, such as a change in work address

• Change of organisation name or structure

• The organisation is subject to a merger/takeover

• Changes to any registration the organisation requires to legally operate.

  
  

Record-Keeping Compliance Review

You must retain:

• Passport copies
  
  
  

• Biometric Residence Permit (BRP) / eVisa status
  
  
  

• Contact details
  
  
  

• Employment contract
  
  
  

• Salary records
  
  
  

• Right to Work check evidence
  
  
  

Annual Review Question

Do your physical/digital files mirror the information recorded on SMS?

If not, that discrepancy is a compliance risk.

Part 2: Right to Work Audit

Pre-Employment Checks

• Conducted before employment begins
  
  

• Verified against Home Office guidance
  
  

• Stored securely
  
  

• Dated and signed (for manual checks)
  
  

Follow-Up Checks

• Tracked before visa expiry
  
  

• Automated reminders recommended
  
  

• HR escalation process defined
  
  

Right to Work failures can result in civil penalties of up to £60,000 per illegal worker.

Part 3: Salary & SOC Compliance Review

As of March 2026:

• Skilled Worker general salary threshold: £41,700 per year
  
  

• Must also meet SOC going rate
  
  

Annual audit must verify:

• Current salary matches CoS
  
  

• Salary increases are reported if required
  
  

• Role duties still align with assigned SOC code
  
  

• No material role drift has occurred
  
  
  

Example

A worker initially sponsored as a Software Developer is gradually reassigned to a Project Manager function without updated SOC alignment.

This creates a compliance gap.

Part 4: SMS Access & Governance Review

Your annual audit should confirm:

• Active Level 1 user assigned
  
  

• Key Contact still employed
  
  

• Authorising Officer up to date
  
  

• SMS login monitored
  
  

• Defined CoS allocation reviewed
  
  

Crisis Planning Check

What happens if your Level 1 user resigns tomorrow?

Have you documented internal SMS continuity procedures?