Employee Document Tracking: Visas, Permits, Right-to-Work [2026]

An employer in the retail sector hired a worker on a time-limited visa. The right-to-work check was done correctly at the point of hire. The HR administrator set a calendar reminder, but then left the business eight months later. Nobody transferred ownership of the reminder. The visa expired. The worker carried on. Eighteen months after the visa lapsed, a Home Office compliance visit found the breach.

The employer had a clean record, cooperated fully, and still received a civil penalty notice. The fine was not a warning letter. It was a bill for tens of thousands of pounds per worker.

This scenario is not unusual. The UK Home Office issued 1,921 civil penalty notices in the year to Q1 2025, a 40 per cent increase year-on-year, with Q1 2025 alone totalling £41.6 million in fines. The legal maximum for a repeat breach is now £60,000 per worker, following increases that came into force in February 2024. Even a first breach carries a maximum of £45,000 per worker.

The fine did not arrive because the employer was careless at hire. It arrived because of what happened after hire: nobody re-checked the document when the permission expired.

What is employee document tracking?

Employee document tracking is the practice of recording every employee document that has an expiry date, and managing the timeline of re-checks and renewals before those dates pass.

The documents involved include:

• Work visas and entry clearance (Skilled Worker, Intra-Company Transfer, Global Talent, and others)
• Biometric Residence Permits (BRPs) and eVisas
• Right-to-work documentation where permission is time-limited
• Passports (particularly for staff who travel internationally as part of their role)
• Medical and health certificates (food hygiene, first aid, HAVS, occupational health clearances)
• DBS checks where the employer has a policy on renewal frequency
• Professional certifications employees hold in their own name (driver's licences for HGV roles, CSCS cards in construction, SIA licences in security, food hygiene for hospitality staff)

These documents are held by individuals, not organisations. That is what makes them easy to lose track of. Nobody sends you an invoice. There is no automatic renewal. The document just expires, and the legal exposure falls on the employer.

Right-to-work re-checks: the check most employers forget

The right-to-work check at hire is now well understood. Most HR teams do it. Many use the Home Office online checking service, which is fast and leaves a clear audit trail.

The check most employers miss is the re-check.

Under UK law, where an employee's permission to work in the UK is time-limited, the employer must carry out a follow-up right-to-work check when that permission expires. This is not optional, and it is not covered by the initial check. If a worker's visa gave them the right to work for two years and HR only checked on day one, there is no statutory excuse against liability for the period after the visa expired.

The Home Office guidance is clear: employers who rely on a time-limited document at the point of hire must diarise a repeat check for when that document expires. A correct repeat check before the expiry date provides a fresh statutory excuse. A missed re-check removes the protection entirely, even if the original check was done perfectly.

The enforcement pattern is consistent: investigations often start months or years after the permission lapsed. By then, the original HR administrator may have left, the calendar reminder may have been deleted, and the employer has no evidence of any follow-up check.

The lead time problem

Many HR teams think of a 30-day or 60-day reminder as adequate lead time. For most renewals it is not, and for visa renewals it can be catastrophic.

UK visa applications take time. A Skilled Worker visa extension application, prepared and submitted via a sponsor, typically requires several weeks of internal preparation before the application is lodged, and the Home Office processing time adds further weeks on top. Some categories take months. If HR notices a visa expiry when there are 30 days left, the renewal will almost certainly not be granted before the current permission lapses. The employee may have to stop working during the gap.

The same problem appears in other document categories. First aid certificate renewal requires attendance on a one-day course, which must be booked in advance. In peak periods, courses in some areas are booked out for four to six weeks. Food hygiene recertification requires a course plus an examination. HAVS assessments require scheduling with an occupational health provider.

Twelve weeks is a reasonable minimum lead time for most employee document renewals. Some visa categories warrant 16 weeks or more. A reminder set 30 days out is often too late to do anything except manage a crisis.

For a broader look at why single-reminder setups fail, see Why Renewal Reminders Fail.

Other employee document types worth tracking

Right-to-work gets the most attention because the penalties are the most visible. But it is far from the only employee document category that carries a compliance obligation.

Medical and health certificates

Food Hygiene Level 2 (Highfield, Chartered Institute of Environmental Health, and others) is mandatory for food handlers and expires every three years. First aid at work certificates run three years, with an Emergency First Aid at Work (EFAW) that must be refreshed annually. HAVS (hand-arm vibration syndrome) health surveillance requires periodic assessments for workers exposed to vibration above the exposure action value. Occupational health clearances for safety-critical roles (working at height, operating machinery, driving for work) often have annual or biennial renewal requirements.

DBS checks

The Disclosure and Barring Service does not expire DBS certificates. However, many employers set internal renewal policies (typically three years for enhanced DBS roles), and regulated sectors including social care, healthcare, and education often have external requirements or guidance specifying minimum re-check frequency. Without a tracking system, these internal commitments drift.

Professional certificates held by individuals

CSCS cards in construction, SIA door supervisor and security guard licences, forklift operator certificates, HGV and LGV driving licences (including Driver CPC periodic training requirements), gas safe registration for engineers, and sector-specific training cards all expire on a fixed schedule and sit with the individual employee rather than the organisation. The organisation still bears the compliance risk if the employee is working without a current certificate.

For tracking professional certificates more broadly, see How to Track Certificate Expiry Dates and the certificate management software page. For professional licences (solicitors, healthcare professionals, HGV operators), the license management software page covers licence-specific tracking.

Passports for travelling staff

This is the category most frequently overlooked until a crisis hits. An employee with a passport expiring in three months may be unable to board a flight to a destination that requires six months of remaining validity. An employee mid-assignment abroad with an expiring passport may find their work authorisation linked to the passport becomes invalid. Tracking passport expiry dates for staff who travel internationally or hold work authorisation tied to a passport is a straightforward precaution that most businesses do not do until an employee is stranded.

The HR admin who leaves

Spreadsheet-based tracking has one structural weakness that no template or formula can fix: it depends on the person who built it.

When the HR administrator who maintained the employee document spreadsheet leaves, the tracking does not just stop being updated. It stops being noticed. Nobody flags when a visa check is due. Nobody realises that the first aid renewal date is in three weeks. Nobody chases the food hygiene certificate that expired last month. The knowledge was in one person's head and on their calendar, and both walked out the door with them.

This happens because spreadsheets are documents, not systems. They have no concept of ownership that survives a personnel change. They do not send reminders to the person who replaced the previous administrator. They do not escalate when a deadline is approaching and nobody has looked at the file in six months.

A shared system where all team members with HR responsibility can see the same dashboard, where reminders go to a role rather than a named individual, and where the record of each check is logged centrally, removes the single-point-of-failure. The knowledge lives in the system, not in one person.

For a longer look at this problem across all renewal categories, see 7 Things That Quietly Lapse and Cost You Money.

A note on GDPR and data sensitivity

Employee documents contain sensitive personal data. Visa details, biometric permit numbers, and health certificates all relate to individuals and are subject to UK GDPR and the Data Protection Act 2018.

This matters for how you store them in any tracking system. The right approach for most employers is to store the expiry date, the document reference number, and the employee name in the tracker. Store the document itself in your HR system or secure employee file. Do not copy sensitive documents into a tracking spreadsheet or general project tool where access cannot be controlled at the individual level.

Lapsewise is designed as an expiry calendar, not a document vault. You track the date and reference number; the document stays in the appropriate HR system. If you want a record to include a copy, you can attach a redacted version (passport number blocked out, for example). The system is not designed to replace your HR information system or serve as a repository for unredacted personal documents.

If you are uncertain whether your current approach to storing employee documents meets your GDPR obligations, that is a question for your data protection officer or legal adviser, not a tracking tool.

Where Lapsewise fits

Lapsewise is the Employee Docs module inside a broader expiry tracker. You create one record per document per employee, set the expiry date, add a reference number, and choose a reminder schedule. The system then sends email (and optional SMS or Slack) reminders to the relevant people at the intervals you set.

You are not limited to one reminder per record. The typical setup for visa tracking might be: 90 days out, 60 days out, 30 days out, and on the expiry date itself. Each reminder can go to a different recipient if your HR team has different people responsible for initial action versus escalation.

The module sits alongside Certifications, Contracts, Grants, Licenses, Insurance, Warranties, Memberships, Domains, Inspections, Permits, and Leases in the same dashboard. If you have compliance obligations across multiple categories, everything is visible in one place rather than spread across separate tools.

Lapsewise is not a replacement for a full HR information system (HRIS) or an HR management platform. If you need to manage employment contracts, payroll, performance reviews, and onboarding alongside document expiry, a dedicated HRIS will serve you better. Where Lapsewise adds value is the expiry-date layer that most HR systems track poorly or not at all.

The free plan covers one module with up to 25 records. For most small employers starting with right-to-work tracking, that is enough to get all current employee documents loaded and reminders running within an afternoon. Paid plans start at £19 per month for unlimited records across three modules.

See the full employee document management software page for a detailed breakdown of what the module covers.

For the broader system behind tracking renewal and expiry dates across a business, Expiry Tracking 101 is a good starting point.

FAQ

What is a right-to-work re-check and when is it required?

A right-to-work re-check is a repeat right-to-work check carried out when an employee's time-limited permission to work in the UK expires. It is required where the initial right-to-work check was made against a time-limited document, such as a visa or biometric residence permit. The employer must carry out the re-check before the permission expires to maintain a statutory excuse against civil liability. A correct re-check before the expiry date provides legal protection; a missed re-check removes it entirely, even if the original check was done correctly.

What is the maximum penalty for employing illegal workers in the UK?

As of February 2024, the maximum civil penalty is £60,000 per illegal worker for a repeat breach (where the employer has received a civil penalty in the previous three years). For a first breach, the maximum starting point is £45,000 per worker. These figures were introduced by The Immigration (Employment of Adults Subject to Immigration Control) (Maximum Penalty) (Amendment) Order 2024, which came into force on 13 February 2024. Financial penalties can be reduced for mitigating factors such as cooperating with the investigation or reporting suspected illegal working. Source: UK Home Office penalty guidance.

How much notice do I need for a work visa renewal?

This depends on the visa category and the employee's circumstances, but 12 weeks is a minimum for most UK work visa applications and 16 weeks or more is advisable for complex cases or sponsor licence renewals. Processing times vary and the preparation required before the application is submitted (gathering supporting documents, compliance team review, sponsor licence verification) takes additional time before the application is even lodged. Waiting until 30 days before expiry is too late in most cases.

Do DBS checks expire?

DBS certificates issued by the Disclosure and Barring Service do not carry a formal expiry date. However, the information they contain becomes dated over time. Many employers set internal renewal policies for roles requiring enhanced DBS checks, typically every three years. Some regulated sectors (social care, healthcare, education) have external guidance or requirements that specify re-check frequency. If your organisation has an internal DBS renewal policy, tracking those dates as a recurring obligation in a system rather than relying on individual managers to remember is a good practice.

Is Lapsewise a right-to-work checking service?

No. Lapsewise does not carry out right-to-work checks, verify documents, or connect to the Home Office online checking service. It is an expiry calendar and reminder system. You use it to record the date by which a re-check must be completed, and it reminds you and your team in advance. The actual check is still carried out through the Home Office digital checking service or by examining original documents as required by the current code of practice.