Follow one flagged subcontractor from first entry to evidence pack.

Step 1 of 9 / Onboarding

Five minutes of inputs. That is all the admin there is.

Company name, company number, UTR and VAT number identify the entity. Then the commercial shape of the deal: engagement type, the daily quote, how many workers it covers, trade and region. Everything you enter feeds the analysis; nothing is filed away unused.

Kestrel are quoting £1,360 a day for an eight-person groundworks team. Keep that number in mind.

Step 3 of 9 / The Digital Blast

One click screens everything. Then it keeps screening, monthly.

The Digital Blast rates the subcontractor across three areas: their standing with HMRC, their forensic history at Companies House, and whether the commercial terms make sense. Each area is rated red, amber or green, and each opens into the detailed analysis behind the rating, which the next three steps walk through.

Kestrel comes back clean on two of the three. The price is the problem.

A rating is never a verdict on the subcontractor. It is a prompt for your judgement, and the platform records how you exercise it.

Step 5 of 9 / Inside the analysis

Forensic History: the company's record, read the way an investigator reads it.

Every officer is screened against sanctions, tax defaulter and disqualification lists. The corporate history is tested for phoenix patterns: serial dissolutions, director linkages, a young company with familiar faces. And the filing record is examined for insolvency proceedings, overdue accounts and registered charges.

Kestrel's record is clean, and the check is now on the record. The evidence of the check matters as much when nothing is found as when something is.

Step 7 of 9 / The decision on the record

The flag is not the failure. The unrecorded flag is.

A flagged risk does not always reflect the real position, and CIS Defence never pretends your judgement away. A Manager Override records it formally instead: what you found, what you did about it, who took the decision and for how long it stands. When it expires, the risk wakes up and must be reconsidered.

Your rationale appears word for word in the Passport. Write it as if HMRC will read it, because that is precisely the circumstance in which it will be read.

Step 9 of 9 / The evidence pack

Everything above becomes the HMRC Passport.

One generated PDF per subcontractor. What you see opposite is the summary page of a document that runs well beyond it: the detailed findings under every rating, each override rationale reproduced in full, the site verification records, the declared supply chain tier by tier, and a section explaining how to read the document, so it stands on its own in front of your adviser, your insurer, or an inspector.

Generate a new version whenever the position changes materially, and export it the day an enquiry letter arrives. Each Passport is a fixed, dated snapshot; the monitoring behind it carries on monthly regardless.

This is the document you slide across the table when HMRC asks what you knew.