The register
Every umbrella company an agency pays through is a record: its name, its risk status, whether it is on the preferred supplier list, and the placements running through it. An umbrella placement must name its umbrella, which means the register is complete by construction rather than by discipline.
Changes to a risk status or preferred-supplier standing are audited with what it was and what it became, because the question is not what you think of an umbrella today. It is whether you can show that you assessed it, and kept assessing it.
The evidence file
Each umbrella carries evidence: accreditations, audits, insurance, whatever the agency relies on. Items carry an expiry date where they have one.
Red and amber mean two different things
Red is therefore reserved for the two states that mean there is no current assessment at all: live placements with no evidence whatsoever, or an umbrella the agency itself has marked red. Stale evidence raises an amber note naming how many items have lapsed.
What counts as enough
HMRC published no standard for what a sufficient file looks like, so the bar is the agency's own defensible position rather than a constant hidden in the code. It lives in the umbrella rule pack with its source, and it can be raised.
April 2027
Umbrella regulation under the Employment Rights Act 2025 lands from April 2027, and agencies answer for the umbrella companies they pay through. The chain is already a first-class record here, so the change is a rule pack rather than a migration. The guide covers the liability itself.
The register, with the holes showing
The demo agency has an umbrella with live placements and a thin file. Open compliance and see how it is flagged.