Cleaning subcontractor compliance: cross-checking files

Cleaning subcontractor compliance comes down to one habit: never accept a document on its own. Each certificate, roster and invoice from a cleaning or security contractor carries fields (legal name, company number, dates, headcount, bank account) that must match the same fields on another document or on an official register. This article lists those comparisons for the United Kingdom, what a mismatch looks like, and what the reviewer does next. It is general information as of November 2026, not legal advice.

Why cleaning and security contracts need cross-checks, not a document pile

Facility services contracts combine high staff turnover, night-time site access and long subcontracting chains, so a file that looks complete can still describe three different legal entities. A cleaning contract may be signed by a trading brand, invoiced by a limited company, insured under a third name and staffed by workers employed by a sub-subcontractor. A checklist of "documents collected" does not notice this. A comparison does.

The same logic applies to security contractors, with one extra layer: the people on site are often individually licensed or vetted, so the roster itself becomes a document to check. For the generic supplier version of this exercise, see our supplier onboarding documents checklist; for the sector view, the industry verification guide.

The cross-check matrix

The table below is the backbone of the review. Each row names the field, the two sources compared, the typical mismatch and the next step.

Nothing in this matrix proves that a document is authentic. It shows whether the file is internally consistent and whether the facts match public records.

Check 1: the legal entity behind the contract

Companies House is the public record for company number, registered name, status and registered office of a UK limited company (Companies House search). Compare four things: the name and number on the contract, the same on the invoice, the registered office against the address on the insurance certificate, and the status (active, in liquidation, dissolved).

A register lookup tells you the entity exists and is active. It does not tell you the PDF in your inbox is genuine, and it does not tell you that the people on your site work for that entity. For VAT, the HMRC VAT number checker confirms that a number is registered and returns the name it is registered to; a different name is a prompt for a question, not a conclusion.

Check 2: the people on site

In the UK the right to work check is a duty of the employer, so the client cannot run it for the contractor's staff, but it can check that the contractor's evidence exists and matches the roster. GOV.UK sets out the steps: an online check using a share code or an original document check done with the applicant present, then a retained copy kept for the length of employment plus 2 years (GOV.UK, check a job applicant's right to work). The same page notes that agency staff, freelancers and contractors are covered by different rules, so confirm in the contract which party carries the duty for each worker category.

What the client reviewer compares:

• Names and dates of birth on the worker list against the contractor's check records, on a sample.
• Expiry dates of time-limited permission against the contract end date.
• Names on the site badge or access log against the worker list.

A cleaner who badges in nightly and appears on no list is the classic mismatch. The fix is not a quick note; it is a request for the contractor's check record for that person, and stopping access if none exists.

Check 3: insurance against the actual scope

An insurance certificate is only useful if the insured entity, the insured activities and the period match the contract. Three fields matter: the policyholder name (against the contracting entity), the described activities (cleaning, guarding, key-holding, window cleaning at height) and the dates. A certificate for "office cleaning" does not obviously cover high-level glazing work or a key-holding service added later.

The limit of indemnity should be read against the clause in your contract, not against a generic expectation. If the figure is below the clause, record the gap and decide whether to accept or to request an uplift. The certificate does not show whether premiums are paid; for that, ask for the insurer or broker to confirm in writing.

Check 4: invoices, bank accounts and hours

Payment fraud and billing drift both surface as mismatches between the invoice and the contract file. Compare the account name on the remittance details with the legal entity and the original onboarding form. A change of account sent by email is verified through a call to a number already on file, never the number in the email.

For hours, compare invoiced hours with the rota and site access log. Contractors often bill the contracted headcount even when a post was unfilled for a week. A consistent gap of one or two shifts is a commercial dispute; a gap that grows after each audit points to a different problem.

What the reviewer does when fields disagree

Record the mismatch, the question asked and the answer. The audit trail is what a regulator or your own audit committee will read.

Questions practitioners ask

Two questions come up repeatedly in practitioner discussions. First: "Is the supplier's cleaning rota enough evidence of who is on site?" No. A rota is the contractor's own statement; the check is whether it agrees with what your access system recorded. Second: "Do I have to re-check everything every year?" Re-check what has an expiry date (insurance, right-to-work permissions, licences) at that date, and re-compare identity fields whenever the contracting entity, the site list or the bank details change. Our guide on recheck dates for supplier certificates covers the calendar side.

How a tool fits in

Doing these comparisons by hand across dozens of contractors is where files drift. A document validation workflow extracts the fields (names, company numbers, dates, account holders) from each upload and compares them across the file, flagging the rows above for a human to decide. It checks consistency and expiry; it does not certify that a document is genuine. If you manage subcontractors in construction-adjacent facilities work, the subcontractor verification solution shows how a file review is organised, and the security page explains how documents are handled. Pricing is on the pricing page.

Frequently Asked Questions

What documents should I collect from a cleaning subcontractor?

Collect the company registration details, VAT registration, insurance certificate, the worker list with evidence of right-to-work checks held by the contractor, and the bank details. Then compare them against each other and the contract.

Does a Companies House lookup prove a cleaning contractor is compliant?

No. It confirms that the entity exists, its registered name and its status. It says nothing about insurance, workers or payment of tax.

Who carries the right to work check for subcontracted cleaners?

The employer of the worker. If the contractor's own staff clean your site, the contractor does it; if agency workers are used, the allocation depends on the agreement. Check the contract wording and sample the records.

How often should security contractor files be reviewed?

At each expiry date and at each change of entity, site list or bank details, plus a periodic sample comparison of the roster against access logs.