How to audit a contractor before you engage one

Most contractor audits are a document collection with a signature at the end. The licence is photocopied, the provident fund code noted, the GST certificate filed, and the vendor is cleared. Every one of those documents can be genuine and still describe a different workforce from the one standing at your gate.

That gap is not academic. Under the labour codes in force since 21 November 2025, the principal employer pays wages first when a contractor fails to, and employing contract labour through a contractor who should hold a licence but does not is deemed a contravention of the Code itself — a penalty on the establishment, not a dispute with the vendor (OSH&WC Code, 2020, s.54). One of those failures is invisible in a vendor file. The other is invisible if you only check that a licence exists. A file records what was true on the day the vendor handed it over; it cannot tell you who is on your site this month.

This guide covers the audit that can: what to collect before award, how to verify each document at its source, the four reconciliations that catch an uncovered workforce, the ten-worker trace that tests them, and the one audit that actually matters — the first payroll cycle. It follows the pre-signature checklist in our contract labour compliance guide; this post is about testing the claims on it, and about what to do when a test fails.

Key takeaways

• A contractor audit is four reconciliations, not a certificate folder: headcount, money, wage base and the minimum-wage floor.
• The licence names the number of contract labour the contractor may supply, and that number rises only by amendment with a larger security deposit (s.48(3)). Deploying above it is unlicensed supply, whatever the paperwork says.
• Compare the licence with your peak headcount, including relief cover for weekly offs and leave — not with the number of sanctioned posts. The gap is usually where the uncovered workers sit.
• The first payroll cycle is the only audit that tests delivery. Hold the labour component of the first invoice until the contribution return, the challans and the bank file agree, and write a cure window into the contract before you need it.
• Ask what happens on 1 April and 1 October, when the wage floor moves. A contract with no revision clause is a vendor priced below its own future cost.

What a contractor audit is actually for

Two failures look alike in a vendor file and are not the same failure.

The first is structural: the contractor is not licensed, or not licensed for this state, this work, or this many workers. A document check catches it — provided the check is against the licence’s own terms rather than its existence.

The second is operational: the contractor holds a valid licence, files returns on time, and still runs your site on a workforce that is partly invisible, because some of it is paid in cash, rotated below the headcount, or left off the contribution return. No certificate catches that. Only one document compared against another does.

So the audit has two halves. A file answers the structural question. A reconciliation answers the operational one. Most procurement functions do the first and assume it covers the second.

The file: what to collect, and where to verify it

Collect the documents, then verify each one at its source rather than from the vendor’s own PDF. The right-hand column is the part most audits skip.

Document	What it actually proves	Where to check it
Contract labour licence	That the contractor may supply up to the number of workers named, for the works described	The issuing authority’s record and the licence’s own annexure, against your peak deployment
Work-order intimation	That this contract has been notified to the designated authority	The intimation acknowledgement (s.50)
Establishment registration	That the entity is registered where it operates	The registration certificate; changes of ownership, management or particulars must be intimated within 30 days (s.3(4))
PF code and latest ECR	That a covered establishment exists and filed contributions for a specific set of members	EPFO establishment search on the establishment code, plus the member-wise ECR
ESI code and contribution history, where covered	That insured persons exist and contributions were paid for them	The ESIC employer record; the wage ceiling is ₹21,000 in most states (ESIC)
PSARA licence, for any guard deployment	That the agency may supply guards in the districts the licence covers	The state Controlling Authority; five-year term, renewed 45 days before expiry (PSARA, 2005, ss.7(5), 8(1))
Guard eligibility records	That the individuals may lawfully be deployed	Training, antecedent verification, the agency register and photo ID cards (ss.10, 15, 17) — check these on site
Professional tax registration	That the vendor can remit PT in the states where it deploys	The state PT portal; registration follows the place of work, not the head office
GST registration and filing status	That the entity invoicing you is a going concern	The GST taxpayer search, matched to the licence holder’s legal name
Employees’ compensation cover	That a workplace claim has somewhere to land	The policy schedule and the renewal date, not the cover note

Two rules make the file worth anything. Verify at source. A vendor-supplied screenshot of a portal is not a portal record, and it takes ten minutes to check the establishment code yourself. And date the file. Every licence, registration and policy in it expires, so a file assembled in March is a claim about March. Licence status is a live procurement item, not an onboarding document, which is why it belongs on the statutory compliance calendar alongside your own returns.

The entity test sits across all ten rows: the name on the invoice, the name on the licence and the name on the PF code should be the same name. Vendors routinely bid through one company, invoice through a second and supply through a third, and a licence does not follow a purchase order.

The licence is a number, not a certificate

The most common finding in a contractor audit is a valid licence that is too small.

The Code is explicit. A licence “shall specify the number of such contract labour who can be supplied or engaged and the amount of security to be deposited by the contractor” (s.47(1)). It is then “valid for a period of five years in respect of the number of contract labour specified therein”, and if the contractor wants to supply more, they must apply for an amendment and deposit security for the balance of the term (s.48(3)). The number is a cap with a deposit behind it, not a formality.

Three consequences follow for how you read the document.

Compare against peak, not posts

A 100-post site is not a 100-person site. Weekly-off relief, leave cover and a festival or audit-season peak can put 115 to 120 people through the gate in a month, and a contractor licensed for 100 is outside the licence on the days the extra people work. The test is the maximum headcount on any single day, not the roster you signed.

A licence for somewhere else is a licence for a different site

Under PSARA the licence comes from the state Controlling Authority, and the fee schedule itself distinguishes operating in one district, up to five districts, or the whole state. Under the Code, a contractor can hold one licence for more than one state, but only where it was obtained from the Central authority for that purpose after consulting the states concerned (s.47). Read what the document covers rather than what the account manager says it covers.

An amendment in process is not a licence

Until it is issued, supply above the licensed number is supply without a licence — and employing contract labour through a contractor who should hold a licence but does not is deemed a contravention of the Code for the establishment (s.54). That is the difference between a vendor problem and your problem. Our CLRA explainer covers how the licensing chain worked before the Code and what replaced it.

The four reconciliations

These are the tests that catch an uncovered workforce. Run them together; each one alone can be explained away.

Reconciliation	Line up	What a gap means
1. Headcount	Peak deployment, the number on the licence, the ECR member count, the ESI insured-person count	People are working outside the licence, outside the contribution return, or both
2. Money	Wage sheet net payable, the bank transfer file, the labour line on the invoice, the challan totals	A bank file smaller than the wage sheet means cash is in the chain, and cash leaves the worker no provable record
3. Base	The wage base in the ECR, basic plus dearness allowance on the wage sheet, the 50% basic test	An understated base depresses provident fund, gratuity and bonus at the same time
4. Floor	Basic plus dearness allowance against the notified minimum wage for that state, employment, skill and zone on the effective date	A shortfall is the principal employer’s liability to pay, not the contractor’s alone (s.55(3))

A worked example makes the arithmetic concrete. Take a site with 120 guards on two shifts, 26 working days in the month, and a licence that names 96.

• Roster: 3,120 man-days, or 120 people at work. The ECR reports 96 members, and the ESI record shows the same 96.
• Wage sheet: 120 workers at ₹19,500 gross, so ₹23.4 lakh. The bank transfer file for the month totals ₹18.72 lakh, which is 96 workers at the same rate.
• Contribution base: the ECR wage base is ₹12 lakh, against ₹15 lakh of basic plus dearness allowance on the wage sheet.

Read the four numbers in one pass. Twenty-four people are outside the licence and outside both contribution returns. ₹4.68 lakh of the labour invoice never passed through a bank. The contribution base is ₹3 lakh short, which is the same 24 people at ₹12,500 of basic each.

What makes the example worth keeping is that the documents agree with each other. The licence, the ECR, the ESI record and the bank file all say 96. They disagree with the only number that is yours: the roster. That is why a file-only audit cleared this vendor, and why every certificate in it was real.

The figures above are constructed to show the method, not drawn from a client site. Two tolerances keep the test honest. Allow roughly 2% drift for joiners and leavers inside the cycle, and for the lag between a mid-month joiner and their first ECR line. Treat any gap that persists across two cycles as a finding regardless of size, because small persistent gaps are what a payroll looks like when it is reconciled to the vendor’s convenience rather than to your roster.

The base test has its own arithmetic, covered in the PF and ESI guide: because basic must be at least half of total remuneration, a wage sheet with a thin basic and a fat allowance does not lower the contribution base — it moves it, and it moves gratuity and bonus with it.

How to run the trace: ten workers, six stops

A census proves nothing, because nobody checks a thousand rows. Ten workers do, if you pick them for the awkward cases: one joiner inside the last 30 days, one who left mid-cycle, one relief guard covering a weekly off, one paid exactly at the floor wage, one with overtime, and one in the second state if the contract spans states.

Then follow each of the ten through six stops.

1. The roster. The named post, the shift, and the man-days billed for that person.
2. Attendance. Biometric or muster data for the same dates. A roster without attendance is a plan.
3. The wage sheet line. Basic, dearness allowance, allowances, deductions and net for that person, not a site total.
4. The bank credit. Amount and value date against the wage sheet, for the same month.
5. The PF line. The UAN, and the member-wise ECR entry for that month with a contribution against it.
6. The ESI line, where the worker is covered: the insured-person number and the contribution for the same month.

Every stop needs a document, and the output is one sheet per site listing the ten names, the six stops and the exceptions. A break at any stop is recorded as a finding, not discussed as a misunderstanding. The point of the sample is that it cannot be assembled from a template — the vendor has to produce evidence that matches a person you can point at on the gate.

That sheet supports one of three decisions, and the third is the useful one: cleared, cleared with conditions — deploy, but the ECR line and the licence amendment are due by a named date — or not cleared to mobilise. A review that ends in an opinion rather than one of those three has not produced an audit.

When to run it: three dates, one gate

Timing	Scope	Output
Before award	The file, the licence numbers, the entity match	A pass or a list of missing evidence, before the commercial evaluation closes
Before deployment	Work-order intimation, licence headcount at or above peak, UAN and ESI registration in place before the first salary, training and antecedent records for every guard	Written clearance to mobilise
After the first payroll	The four reconciliations on live data, plus the ten-worker trace	The gate: the labour component of the first invoice is released against it

After that the clock slows. The headcount reconciliation quarterly, because it is cheap and it fails first; the full audit at renewal, on any change of subcontractor, and whenever the wage floor is revised.

The first-cycle gate is the only one that tests delivery, and it has to exist before it is needed. Hold the labour component of the first invoice until the member-wise ECR, the challans and the bank file reconcile, and write the hold and a 15-day cure window into the contract. Asking for the ECR after the invoice is paid is not an audit; it is a request.

Can the vendor absorb a wage revision?

The wage floor moves. In the central sphere the variable dearness allowance is revised with effect from 1 April and 1 October, and states run their own cycles through the year, which is why the statutory calendar treats a notification as a change to the payroll and not just to a circular.

That makes a second question worth asking at the same meeting: at the next revision, what is the per-head cost, and what is the contract rate? A vendor priced at the floor plus a thin service charge has no room for a VDA increase unless the agreement has a revision clause tied to the applicable notification. Without one, the vendor absorbs the increase by thinning relief and ageing the wage sheet — and both show up in the headcount reconciliation six months later.

The wage notification guide sets out how to rebuild the floor from the notification itself, and the minimum wages guide explains how a state rate is set. Ask for the calculation rather than the assurance; a vendor who cannot produce the per-head build-up cannot price a revision either.

What the audit cannot tell you

Three things, each of which needs a different test.

Whether the vendor can fund a failure

The Code makes the contractor primarily liable and the principal employer the payer of first instance, which means a wage shortfall on a 120-person site is a recovery demand you have to carry. Compare the annual value of your contract with the vendor’s turnover from audited accounts. A contract that is a large share of turnover is a concentration risk for both sides, and it is the reason an indemnity is a recovery route rather than a shield.

Whether supervision works

Compliance is provable from documents. Supervision is not. An unannounced visit at a shift change tells you more than a quarterly review meeting, because it is the one moment when the relief pattern, the handover and the supervisor’s presence are all visible at once.

Whether the workforce will still be there in 90 days

Ask for replacement and attrition figures for your site and your category, and check whether relief cover is funded in the rate or billed as extra man-days. Billed relief is a warning: it means the vendor earns more when the roster breaks.

When the audit fails: the consequence ladder

Have the ladder written before the first finding, so the response is mechanical rather than personal.

1. Query, with a clock. Five working days and one specific document. Joiners, corrections and a lag in portal updates are the ordinary explanations.
2. A written cure window. Fifteen days, with the document named and the date. The OSH&WC Code gives the employer a 30-day compliance window before prosecution (s.110), but the commercial clock should be shorter than the statutory one.
3. Hold the labour component of the next invoice until the item is cured. Without that right in the contract, withholding payment is a breach on your side.
4. Recover. Set off against amounts payable, or treat the amount as a debt (s.55(3)); the designated authority can also direct payment out of the contractor’s security deposit (s.55(4)).
5. Replace. The crew for a compliance failure, the vendor for an expired licence or an unamended headcount.
6. Carry it if the failure has already landed. Wages under s.55(3), contributions under the Code on Social Security, 2020, s.31, and the general penalty of ₹2 lakh to ₹3 lakh plus ₹2,000 a day where contract labour was employed without a licence (ss.54, 94). The full exposure is set out in principal-employer liability.

Frequently asked questions

What documents should I ask a contractor for before engaging them?

The contract labour licence with the number of workers it names, the work-order intimation, the establishment registration certificate, the PF code with the latest member-wise ECR, the ESI code where the scheme applies, the PSARA licence with training and antecedent records for guards, professional tax registration in each state of deployment, GST registration, and employees’ compensation cover. Then verify each at its source — the issuing authority, EPFO, ESIC, the GST portal — rather than from a copy the vendor supplies.

How do I confirm that PF is actually being paid for the workers on my site?

Match the member-wise ECR to your roster rather than accepting the establishment-level filing total. Pick ten workers, including a joiner, a leaver and a relief guard, and confirm each UAN appears in the return for that month with a contribution against it, and that the bank file shows the net wage credit. If the ECR member count sits below your peak deployment, that shortfall is the finding, whatever the challan total says.

Is a contractor’s licence proof that they are compliant?

No. It proves the contractor may supply up to the number of workers named on it, for the works it describes, while it remains valid for its five-year term (ss.47, 48). It says nothing about whether those workers were paid on time, registered for provident fund, or covered by ESI. Employing contract labour through a contractor who should hold a licence but does not is a deemed contravention against the establishment (s.54), which is why the licence is a number to reconcile rather than a document to file.

How often should a contractor be audited?

A full audit before award and again at renewal or on any change of subcontractor. The four reconciliations after the first payroll cycle, and then the headcount reconciliation quarterly, because it is cheap and it fails first. Re-run the full audit whenever the wage floor is revised, since a revision changes the contract rate, the contribution base and the relief margin at the same time.

What if the licence does not cover our peak headcount?

Deployment above the licensed number stops until the licence is amended. The contractor applies for the amendment and deposits additional security for the balance of the five-year term (s.48(3)); until that is issued, the extra workers are being supplied without a licence, and the exposure sits with the establishment as well as the vendor (s.54). If the amendment takes longer than the mobilisation date, the options are to reduce the deployment to the licensed number or to move that work to a contractor whose licence already covers it.

The bottom line

A contractor audit is not a folder. It is a set of comparisons that force the documents to agree with each other and with the roster: licence against peak deployment, wage sheet against bank file, contribution base against wage sheet, wage against the notified floor. Then one payroll cycle on live data proves whether any of it holds. Run the file at award, the trace at mobilisation, the reconciliations at the first cycle, and the headcount check every quarter after that — with the cure window, the invoice hold and the termination trigger already in the contract, because a remedy you negotiate after the finding is a concession.

Our due diligence centre sets out the documents we publish for our own clients, and the compliance and licences page covers the operating licences involved. The staffing service runs contract labour with attendance reconciled to a named roster and the first-cycle reconciliation pack issued alongside the first invoice, and the payroll service handles the contributions and returns behind it. If you are auditing an incumbent vendor, send us the licence, the last two ECRs and one month’s roster, and we will run the four reconciliations against your peak deployment.