What an NHS framework compliance audit samples, and what it costs to pass

An auditor sits down with a list of workers your agency supplied last quarter, picks a handful of names, and starts opening files. They want the identity documents you copied, the date the register was checked, the name of the person who checked it, and what happened on that file between the check and the shift. By the third file they have found the sequence or found a gap. You will not know which until they say so.

An NHS framework compliance audit is a request you did not schedule, against files you did not choose. The standards it measures you against were written by someone else, and the scope is published in detail. No public source states how many files it reaches.

What NHS England requires an NHS framework compliance audit to reach

Framework operators do not choose whether to audit the agencies they list, and the result does not stay between the two of you. Operators must report the number of adverse findings over the last 12 months and what remains unresolved. Trusts are told about failures affecting the agencies they use.

The conditions come from NHS Improvement, now NHS England, in its 2017 guidance for framework operators, still the operative approvals guidance and named by the current agency rules. The guidance requires an operator to explain how it audits supplier performance. It also requires evidence that the operator can obtain through that audit "details of standards applied by the agencies to pre-recruitment compliance checks of agency personnel, including referencing and identity checks". The benchmark it names is the minimum of NHS Employers' six check standards.

The audit reaches the standards you apply, which is a question about how your agency works and not only about what sits in the folder.

An operator must also evidence that it can investigate, instruct the agency to withdraw an unsuitable worker, carry out re-inspections, and suspend or remove agencies from the framework. Those audits benchmark to six NHS Employers standards, all revised on 23 July 2026. They cover identity, right to work, criminal record, professional registration and qualification, work health assessments, and employment history and references.

Nobody publishes the sample size or the pass mark

You cannot rehearse for a date you are not given, or work to a mark nobody publishes. How many files an auditor pulls is not published. Neither is the method used to select them, and the same documents are silent on how often an agency is audited. That absence was looked for rather than assumed, across NHS England's operator guidance and NHS Workforce Alliance's published audit documentation. Any reader can follow the links below and confirm it.

NHS England sets conditions the process must satisfy and leaves the methodology to the operator. NHS Workforce Alliance is one of the approved operators. Its audit page states that inspections happen on a pre-selected and an ad hoc basis, so there is no date to work back from. The same page gives three outcomes with no percentage attached: a pass, a pass with requires improvement, and a fail.

Under that scheme a fail is immediate. It suspends the supplier from the relevant frameworks, blocks new workers and new work, and holds until a re-audit is passed and the operator approves reinstatement. Designated timescales for remedial action exist, and are not published.

For a margin-thin desk, that is a documentation problem turning into a revenue problem inside a day, and the published process sets out no appeal stage before suspension.

The evidence request that arrives with every booking

Treating the NHS framework compliance audit as the compliance event of the year understates the work, since most of the evidence burden arrives one booking at a time.

The Alliance's due diligence guidance tells NHS trusts they should be informed, via a pre-placement checklist from the supplier, that checks have been completed against the six NHS Employment Check Standards. The checklist must also detail all training provided pre-placement, aligned to the Skills for Health Core Skills Training Framework.

That is per placement, and NHS Employers is also explicit in its employment check FAQs. The employing organisation keeps the overarching responsibility for assuring safe working practice, and organisations should seek assurances through their own scheduled audit and monitoring processes. Every trust you supply runs its own assurance on the same files.

Three layers sit on the same files: a checklist for every booking, a client-side check from every trust, and an unscheduled sample over all of it. Assembly cost rises with placements and clients, while retrieval cost stays flat.

A DBS certificate carries no expiry date, so the file has to

The easiest gap for a sample to find is a certificate nobody has re-checked. The criminal record checks standard states that DBS disclosure certificates have no specific term of validity. They only provide information known about an individual at the time of issue. Currency cannot be read off the document, so it has to be shown by a dated status check. Where a temporary worker is not subscribed to the DBS Update Service, NHS Employers recommends annual rechecking as a minimum.

Professional registration works the same way, and it is the core of any clinical credentialing file. Employers must check registration with the appropriate regulatory body before an individual starts, and the standard names eight regulators. It sets no frequency after that, requiring instead that employers have mechanisms in place to respond to any action a regulatory body may take affecting registration. How that mechanism works is left to the employer.

Two more requirements land specifically on agencies. Employment history and reference checks require three consecutive years of employment or training immediately prior to the application, with gaps explained. For agency placements the standard steers employers towards a reference from the agency itself. Your own placement records become the reference of record for your workers.

Right to work sits differently. The Home Office employer's guide states that a statutory excuse cannot be established where a third party such as a recruitment agency performs the check. The exception is a digital check on a British or Irish passport holder through a certified provider. In practice, this means the excuse is yours for a worker on your payroll.

Merco, Ison Nursing and Network Recruitment Wales changed the state of their files

Merco supplies clinical staff to the NHS and holds 35 to 40 documents per candidate. Its onboarding moved from two weeks to one day, with framework clinicians cleared inside 24 hours. Admin time fell by three hours a day. Merco also reports one NHS framework compliance audit at 100 per cent and a second at 99.82 per cent. Those are Merco's own results under the schemes those audits used. The NHS Workforce Alliance scheme, the only one found published, awards three outcome categories with no percentage attached.

Network Recruitment Wales moved compliance maintenance from 68 per cent to 95 per cent over two months and now onboards in four days. Ison Nursing took over three weeks to onboard before the change and now takes one day.

All three run on Credentially. For a sampled request, what matters is audit reporting and the logged activity trail. Every action is recorded against the candidate, with the person who took it and the date. The answer to "show me how you knew" is retrieved rather than reconstructed. Daily re-checks run against the connected registers, covering DBS, GMC, NMC, HCPC, GPhC and GDC, and staff who fall out of compliance can be blocked from booking shifts.

Where the week goes when the request lands on a Monday

The request arrives on a Monday and asks for six candidate files by Friday. The number is chosen for this example, since no sample size is published.

Assembled by hand, at 35 to 40 documents a candidate, that is 210 to 240 documents to locate. They sit across email threads, a shared drive and a tracking spreadsheet, and each has to be opened to confirm it is current. Then the six standards need their evidence pulled separately. That means identity copies, the right to work check and any follow-up date, the criminal record position, the registration check, the work health clearance and three consecutive years of employment history. The sequence of who checked what, and when, gets rebuilt from email timestamps, because the auditor asks how each check was done and by whom. Four days go on finding paperwork the desk collected months ago, and the answer is only as good as the memory of whoever wrote the emails.

Held as records, with a dated check and a named checker behind each document, the same request is a search on six names and a download.

Thirty per cent fewer agency shifts to win in 2026/27

The pool this work competes for is being deliberately shrunk. NHS England's medium term planning framework for 2026/27 to 2028/29 sets annual agency limits for individual trusts, against a national target of a 30 per cent reduction in agency use in 2026/27. It also sets a 10 per cent year-on-year reduction in bank staffing spend, with zero agency spend by 2029/30.

The agency rules require trusts to procure all agency staff through framework agreements NHS England has approved, and one national agreement for clinical and healthcare staffing lists 320 suppliers. Fewer shifts are available while the same number of desks chase them, and a suspension stops new supply the day it is issued. An agency that can answer a framework compliance audit inside a day keeps shifts that a four-day scramble loses to a competitor on the same framework.

Three hours a day, against a £2.23 fee

Three hours a day is Merco's published figure for compliance admin across the whole desk, and it is not a figure for one audit response. No tier-1 source publishes what that administration costs a UK healthcare staffing agency, NHS England, NHS Employers and NHS Providers included. Any benchmark you are shown sits outside those sources, and the only hours worth trusting are the ones your own team logs.

Those hours sit against a published price card. From 1 April 2026 the cap on a band 5 day shift is £19.60 an hour. NHS England's workbook breaks that cap down and shows a combined framework fee, agency fee and other of £2.23. The workbook describes the breakdown as indicative and not mandatory. That £2.23 an hour has to cover the desk producing the evidence behind your NHS framework supply, alongside everything else it funds.

Merco's desk got three hours a day back. On a band 5 day shift, whatever your own desk spends is paid for out of £2.23 an hour.

References

1. NHS Improvement, Agency rules: framework agreement approval, guidance for framework operators, publication code CG13/17, February 2017. https://www.england.nhs.uk/wp-content/uploads/2020/08/Framework_Operator_Guidance_Feb2017.pdf
2. NHS England, "Agency rules", revised October 2025, page last updated 19 November 2025. https://www.england.nhs.uk/long-read/agency-rules/
3. NHS England, Medium Term Planning Framework: delivering change together 2026/27 to 2028/29, published 27 October 2025. https://www.england.nhs.uk/long-read/medium-term-planning-framework-delivering-change-together-2026-27-to-2028-29/
4. NHS England, "Agency price card", agency price card 2026/27 v2, effective 1 April 2026, page last updated 27 March 2026. https://www.england.nhs.uk/publication/price-card/
5. NHS Employers, "Employment standards and regulation", all six check standards last updated 23 July 2026. https://www.nhsemployers.org/recruitment/employment-standards-and-regulation
6. NHS Employers, "Criminal record checks standard". https://www.nhsemployers.org/publications/criminal-record-checks-standard
7. NHS Employers, "Professional registration and qualification checks standard". https://www.nhsemployers.org/publications/professional-registration-and-qualification-checks-standard
8. NHS Employers, "Employment history and reference checks standard". https://www.nhsemployers.org/publications/employment-history-and-reference-checks-standard
9. NHS Employers, "Employment check FAQs", last updated 11 August 2026. https://www.nhsemployers.org/articles/employment-check-faqs
10. NHS Workforce Alliance, "Our audit process". https://www.workforcealliance.nhs.uk/about/audit-process/
11. NHS Workforce Alliance, "Booking agency staff: due diligence guidance for NHS trusts". https://www.workforcealliance.nhs.uk/news/booking-agency-staff-due-diligence-guidance-for-nhs-trusts/
12. Government Commercial Agency, RM6281 National Framework for the Provision of Clinical and Healthcare Staffing, 320 suppliers. https://www.gca.gov.uk/agreements/RM6281
13. Home Office, Employer's guide to right to work checks, version of 26 June 2025. https://assets.publishing.service.gov.uk/media/6878ead80263c35f52e4dd76/26_06_25_Guidance_Right_to_work_checks_-_an_employer_s_guide.pdf

All sources accessed 23 August 2026.