The NHS framework compliance audit: what a Fail costs an agency

The audit date is chosen for you. PwC notifies suppliers of it on behalf of NHS Workforce Alliance, then examines worker files. An NHS framework compliance audit tests decisions your team made months earlier, at whatever pace the roster demanded, against the six NHS Employment Check Standards as revised on 23 July 2026.

Nothing in a worker's record can be built backwards after the notification lands. For a compliance lead the day looks ordinary until the email arrives, and from that point the records already sitting in your system carry your entire position on the framework.

Who runs the NHS framework compliance audit and which agreements it covers

Trusts bound by NHS England's agency rules have had to buy all agency staff, clinical and non-clinical, through approved framework agreements since 1 April 2016. NHS England publishes the approved list and updates it as agreements expire. As at 4 August 2026 it holds six agreements. One is HealthTrust Europe's Total Workforce Solutions III. The other five belong to NHS Workforce Alliance and cover clinical and healthcare staffing (RM6281), staff bank and flexible resource pool (RM6278), non-clinical temporary and fixed term staff (RM6277), international recruitment (RM6333) and permanent recruitment (RM6229).

NHS Shared Business Services does not appear on that list. Its frameworks cover corporate services, so a place on one carries no route into a trust's temporary staffing spend.

The Alliance agreements are policed by the Health Assurance Audit, delivered by PwC. PwC notifies suppliers of their audit date, conducts the audit, issues the result and writes the report. The framework documents sit with the Government Commercial Agency, formerly Crown Commercial Service, renamed on 1 April 2026.

Timing is not fixed. The RM6281 user guide states that "suppliers have an ongoing obligation to compliance, and audit inspections can be carried out on both a pre-selected and ad-hoc basis". Neither frequency nor sample size is published, so any interval circulating in the market is an estimate.

What a worker file is tested against, and where agencies get caught

An auditor tests a worker file against the NHS Employment Check Standards and against the obligations written into your individual framework agreement. The third test is your own policies for managing the ongoing compliance of workers and subcontractors, and it is the one agencies underestimate, because it moves the question from a single file to the system that produced it.

NHS Employers revised all six standards on 23 July 2026. They cover identity, right to work, professional registration and qualifications, employment history and references, criminal records and barred lists, and work health assessment. The right to work standard was revised to take in Home Office guidance on the use of digital verification service providers.

One gap is worth noting now. NHS Employers has confirmed the refreshed standards do "not yet include the extension of civil liability guidance", which arrives when the legislation activates on 1 October 2026. Employment businesses supplying clinical staff pick up direct right to work liability on that date.

Framework obligations sit alongside the standards. Under RM6281, suppliers must always offer whichever is lower of the NHS England price cap or the framework rate, and rate evidence is as auditable as check evidence.

Pass, Pass with Requires Improvement, Fail: what each one does to next month's revenue

A Fail carries an immediate commercial consequence, and the RM6281 user guide sets it out plainly: "Suppliers receiving a fail outcome will immediately be suspended from the relevant frameworks and are unable to supply new workers or engage in new work whilst suspended. The suspension period is currently set to a minimum of seven calendar days plus the time taken to fully remediate and receive NHS Workforce Alliance approval of framework reinstatement".

Read that as a cash flow event. New supply stops on the day of the result, the floor is seven calendar days, and the restart date belongs to the Alliance. Remediation time sits on top, and remediation is measured in reference response times and Disclosure and Barring Service turnaround, neither of which your team controls. A supplier that fails repeatedly and does not engage with remedial steps can be removed from the framework permanently.

Pass with Requires Improvement sits between the two. The user guide names the outcome without publishing a remediation timetable, so treat it as findings you will be re-tested against on another date you do not set.

Why a Fail cannot be remediated once you have been notified

Most of the evidence an auditor wants carries a date, and a date cannot be manufactured after the fact. A reference requested the week you are notified arrives after the audit and is stamped accordingly. A registration check run late shows as run late.

The Disclosure and Barring Service's own performance data sets the limit on catching up. In 2025-26 the DBS issued 75 per cent of Enhanced checks within 14 days against a target of 80 per cent, and took an average of 12.4 calendar days to issue one. Both figures come from its annual report for that year, ordered to be printed on 15 July 2026. A worker whose Update Service subscription has lapsed needs an entirely new check, so a missed £16 renewal costs roughly a fortnight of deployability. Neither clock fits inside an audit window.

A 30 per cent agency spend cut makes a suspension harder to come back from

NHS England's medium-term planning framework of 17 November 2025 requires trusts to cut agency spend by 30 per cent in 2026/27, then 25 per cent in each of the following two years, reaching no agency spending in 2029/30. The reduction is measured against the month 6 forecast outturn.

An agency suspended in that market loses ground twice. Trusts fill the gap from suppliers still on the framework, and those relationships harden while you remediate. Coming back from a failed NHS framework compliance audit means competing for a smaller pool from a standing start.

What an audit-ready file looks like across the six standards

• Identity. A verified identity record for every worker, with the documents or digital verification evidence retained and the verifier identifiable.
• Right to work. A prescribed check completed before the engagement started, with the share code or digital verification output on file, and any time-limited permission carrying a follow-up date on or before expiry.
• Professional registration and qualifications. Registration verified against the regulator's register, checked at engagement and re-checked since, with qualification evidence for the role.
• Employment history and references. References that verify the stated history rather than the stated employer, with gaps explained and the chasing trail visible.
• Criminal records. A check at the level the role requires, plus a live Update Service subscription or a check recent enough to stand up.
• Work health assessment. Clearance appropriate to the role, with any reasonable adjustments recorded.

Add the framework layer on top: subcontractor evidence held to the same standard as your own, and rate records showing the lower of price cap or framework rate was offered.

Preparation that has to happen before the notification

Reconcile the roster against the files first. Every worker currently booked onto a trust shift could be sampled, and the reconciliation is where records that decayed between placements tend to show up.

Run the expiry horizon forward across registration renewals, DBS Update Service subscriptions, time-limited right to work permissions and work health clearance, far enough ahead that a re-check can complete before anything lapses. After that, run a dry sample of your own. Ask a colleague who did not onboard those workers to assemble the full evidence set from scratch, and time it. That is a better read on your evidence trail than any policy review.

Building the evidence trail as the work happens

The evidence trail an auditor asks for is assembled continuously or not at all. Credentially runs real-time compliance monitoring across the checks those standards require, with automated expiry detection and daily re-checks so a file does not decay between placements, automated reference requests and reminders, and blocking of non-compliant workers from booking shifts. Audit reporting produces the evidence trail on the day it is asked for.

Merco, which supplies clinicians through NHS frameworks, uses the platform and scored 100 per cent in its HealthTrust audit and 99.82 per cent in its Crown Commercial Service audit, run under the CCS name before the rename. It cut onboarding from two weeks to one day and now places framework clinicians inside 24 hours. Network Recruitment Wales moved compliance from 68 to 95 per cent over two months.

The detail on compliance monitoring and audit reporting sits on the compliance features page, and the pre-employment checks page and NHS page cover how the six standards are handled in workflow. To put a number on what a suspension would cost you, the ROI calculator gives you the placement values to set against a seven-day floor and a remediation period you do not control.

Your next NHS framework compliance audit result is being decided now, by the records being created this week for workers who will still be on shift when the notification arrives.