Table of Contents

Introduction
Nature and variety of risk
Worker misclassification
Co-employment
Health and safety
Security
Data security and privacy
Changing laws and regulations
What companies can do
Proactively manage compliance processes
Maintain a single source of truth for contingent workforce data
How technology can help
Vendor management systems
Next steps

Introduction

In September 2021, The New York Times reported that a U.S.-based technology company could be liable for more than $100 million in back salaries for over nine years of noncompliance with pay parity laws in 16 countries covering agency-provided temporary workers. The whistle-blower complaint not only alleges worker underpayment but also accuses the company of securities violations because it had failed to disclose the risk to investors.

Financial penalties and reputational damage are just two of the risks companies can face when they fail to manage their contingent workforce in compliance with labor regulations. This paper discusses the changing regulatory landscape involving non-employee workers and the techniques and technologies businesses can use to mitigate their compliance risks.

Nature and variety of risk

Worker misclassification

Worker misclassification is one of the most common problems that occurs in the management of an external workforce. Misclassification happens when a business incorrectly identifies the relationship that exists between their organization and a contingent worker.

Since businesses typically rely on a mix of agency workers, independent contractors (ICs), freelancers, consultants, and statement of work (SOW)-based service providers the risk of misclassifying some of this non-employee talent is always present.

This is further complicated by the fact that countries have different laws governing the classification of contingent workers, these laws are subject to change, and due to disparate policy priorities, some countries are making it easier to use non-employee workers while others are making it harder. This document can help you in your assessment, so that you can determine how well the providers you evaluate can meet your organization’s needs.

Co-employment

Co-employment – also called “joint employment” – is when a third-party supplier (typically a staffing agency) works with a client to fill roles at the client’s company. Crucially, the supplier doesn’t just provide workers for a fee but takes an active role in their employment arrangements. This can result in shared responsibilities for employment issues and potential misclassification risk if these shared responsibilities are not managed in compliance with applicable laws and regulations.

In a 2020 report on managing co-employment risk, Staffing Industry Analysts (SIA) observes that co-employment is not a legal term, and there is no single definition of joint employment in U.S. law. Tests or standards (e.g., “20 Factors Test,” “ABC test,” “Economic Realities Test”) for determining when a company is acting as a joint employer may be different based on different statutes and different jurisdictions. Under these circumstances, SIA advises that “the use of external workers of any type means the assumption by a client employer of at least some co-employment risk.”

As an example of shared legal responsibilities, the supplier may handle the workers’ payroll taxes, pension, and health insurance contributions, while the client manages their place of work, supervises workloads, and handles on-site health and safety. Hence the term “co-employment.”

Co-employment is not recognized the same way in all countries. For example, in most of Europe, when a worker is paid by one entity – a “professional employer organization” or “PEO” – and managed by another entity, the PEO is considered the Employer of Record (EOR) and is legally responsible for all HR, payroll, and tax withholding requirements, and compliance. However, the situation is changing, and the French Supreme Court’s position on co-employment has evolved due to increased worker complaints under the country’s Legal Code.

When mismanaged, risks associated with co-employment can include litigation, fines, and payment of statutory remittances (income tax, health insurance, etc.). If it is determined that co-employed individuals should have been classified as employees rather than contingent workers, the results can include payment of employee entitlements (sick pay, vacation pay, medical and family leave, overtime, etc.). Such situations can also create adverse publicity and reputational damage.

Health and safety

Legal and regulatory risks are not the only hazards facing companies when they use contingent labor. They also must manage health, safety, and security risks when they add external talent to their workforce mix. The same work-related hazards employees face can affect non-employee workers. To prevent occupational injuries and illnesses, businesses must provide safety training and discuss hazardous conditions with their contingent workers. Maintaining auditable records of this health and safety training may be a required step in the compliance protocol.

Security

In most businesses, security processes and procedures for employees are standardized and controlled. However, contingent workers are often managed by Procurement, with separate onboarding, offboarding, and supervisory protocols. This means that the oversight that applies to employees may not exist for contract workers.

Some security risks result from the lack of operational controls, while others are due to a lack of visibility. These risks apply to all workers but are heightened for contingent workers because of the duration of their assignments and the volatility of the temporary talent pool. While many companies don’t have a centralized, standardized onboarding and offboarding process, others aren’t even aware that such a process is necessary.

For example, it is common for outsourced work or managed services to be supervised by a supplier account manager rather than an employee manager. Since these managers don’t directly manage contractor teams, they may not even be aware whether a worker was reassigned or replaced. With no visibility, the manager has no idea that a worker should have been offboarded and their access privileges terminated.

It is impossible for businesses to protect themselves completely from unscrupulous individuals. But it is possible to ensure that all external workers have been properly vetted, that their access to company facilities, networks, and data is limited to those required to accomplish their assignments, and that this access is terminated as soon as their assignments are complete.

Standardized, centralized onboarding and offboarding processes—for both on-premises and remote contingent workers—help ensure that everyone in the company’s extended workforce follows enforceable security guidelines.

Data security and privacy

Maintaining data security is a critical part of every company’s overall security protocols. But it also involves compliance concerns that are different from those related to the protection of physical property. This is because every business is responsible for protecting the personal information of people in its database, including its customers, employees, and contingent workers. This data includes Personal Identifiable Information (PII) that can be used to distinguish or trace an individual’s identity and is, therefore, vital to the person it represents and a danger if it falls into the wrong hands.

Because of its importance, governments have passed various data privacy laws to regulate how personal data is collected and maintained. In the U.S., no single federal law regulates the protection of PII. Instead, there is a patchwork system of federal and state laws, sector-specific regulations, common law principles, and self-regulatory programs developed by industry groups.

Just a few of the federal laws that regulate the collection, processing, and disclosure of PII include:

The Federal Trade Commission Act (FTC Act) prohibits unfair or deceptive trade practices involving the collection, use, processing, and disclosure of PII.
Health Insurance Portability and Accountability Act (HIPAA), which applies to health care and health plan information.
Telephone Consumer Protection Act (TCPA), which applies to telemarketing activities.
Fair Credit Reporting Act (FCRA), which applies to consumer credit and other information.

In addition to federal laws, hundreds of privacy and data security laws govern the protection of PII at the state level. These laws vary in their scope and obligations. In 2016, the European Union adopted the General Data Protection Regulation (GDPR) to enhance individuals’ control and rights over their personal data and simplify the regulatory environment for international business. The regulation, which applies to all EU member states and all companies who do business within the European Economic Area (EEA), establishes rules for the collection, control, and processing of personal data. It details the requirements for compliance and establishes remedies, liability, and penalties for noncompliance.

GDPR also outlines individuals’ rights over their own data, including the right to request erasure of personal data. Under GDPR, an individual also has the right to stop or prevent any business from processing their personal data. The regulation became a model for many other laws across the world, including Argentina, Brazil, Chile, Japan, Kenya, Mauritius, South Africa, South Korea, and Turkey. The United Kingdom retains an identical law despite no longer being an EU member state.

Changing laws and regulations

The regulatory landscape of labor laws, tax laws, and data privacy regulations is constantly changing. In 2021, the UK extended its IR35 anti-tax-avoidance legislation, which regulates the off-payroll use of “personal service companies,” to include private sector businesses. In September 2022, it was announced that this regulation would be repealed. A month later, the UK’s chancellor announced that the repeal had been canceled.

While this may be an extreme case of changeability in workforce regulations, it is also reflective of the increased interest governments have taken in the growth of the contingent workforce. Companies must stay abreast of changing laws and regulations if they are to achieve and maintain compliance with the rules wherever they do business.

It is hard to keep up with every change in labor law and government regulations. Unless your organization maintains in-house counsel specializing in global labor and employment law or human resource representatives who are well-versed in the intricate issues around using contingent labor, you will want to select partners with the right expertise and resources. They will be able to provide guidance in mitigating the various risks associated with the extended workforce.

These can include outside counsel from firms specializing in labor and employment law, and third-party vetting services. Talent platforms are also emerging as significant and convenient sources of contingent labor. Many of these claim to have safeguards built into their offering for vetting independent contractors. This new technology offers a viable option for engaging independent workers in a manner that is compliant with local, state, and federal laws and regulations, but it is important to use it only if they have the right tools and safeguards built in.

What companies can do

Proactively manage compliance processes

Companies should adopt certain best practices to ensure that their contingent workforce policies and processes are compliant. First, it is important to identify the applicable compliance requirements and assign responsibility for meeting each requirement. Then the company must establish processes and procedures for meeting these requirements and documenting the results. It is a good practice to conduct periodic internal audits to ensure that these processes are being followed and are achieving the desired results.

Once global compliance objectives have been established, businesses must address more specific procedures, such as the requirements specific to a position or location.

Having a standardized process for onboarding and offboarding all contingent workers, including consultants and statement of work (SOW)-based service contractors, helps to ensure that vital processes are followed and properly documented.

For maximum compliance, your global and specific compliance procedures should be automated both to ensure that requirements are met consistently and to track and document compliance status for your entire contingent workforce.

Maintain a single source of truth for contingent workforce data

Using technology to manage the entire contingent worker or project lifecycle can significantly reduce risk. Consolidating data into a single system of record keeps information secure, current, and streamlined.

While some companies attempt to manage contingent workforce data within their Human Capital Management (HCM) information systems, this is not very efficient. Most HCM systems are optimized for recruiting and managing employees and are designed to handle employee data only. They rarely provide for the collection and management of data regarding talent suppliers, managed service providers (MSPs), talent and direct sourcing platforms, private talent pool curators, and others involved in the provision of contingent talent.

HCM systems also have few or no provisions for collecting data related to outsourced service contractors, independent contractors (ICs), consultants, and other service providers, who represent more than half of many companies’ extended workforce.

How technology can help

Vendor management systems

For more than 20 years, the vendor management system (VMS) has been the preferred system of record for all contingent workforce data. These comprehensive solutions were designed to automate the sourcing and management of an organization’s non-employee workforce.

Delivered through a Software-as-a-Service model, VMS solutions procure, manage, and pay for all types of contingent labor and statement of work (SOW)-based contractors. Most VMSs also automate and document processes required to ensure that these non-employee workers’ engagements comply with applicable laws, regulations, and company policies.

Document policies and procedures

The idea of documenting policies — especially creating them from scratch – can appear daunting. But your contingent workforce policies and procedures do not have to be over-complicated. The most important aspect is having documentation—establishing the procedures and policies in writing, and then continually tweaking them over time.

Change management is easier if you solicit input from all your program’s stakeholders. Keep in mind that you’re creating a living document that will need to be maintained regularly. As things change, you should update your guidelines. Any document that remains static will inevitably become outdated and irrelevant.

Apply your policies and procedures consistently

Your policies and procedures should be implemented from the top down, and everyone involved should be expected to adhere to them. You won’t get buy-in from your stakeholders if the rules don’t apply equally to everyone. Don’t make exceptions for business units or individuals who want to engage contingent talent – especially SOW-based services – without going through your contingent workforce program. This “rogue spend” typically increases costs and leads to compliance violations.

Stay current with ever-changing laws and regulations

Compliance doesn’t just happen. It requires the organization to continually and consistently review the current compliance environment, update processes and practices based on new laws and industry best practices, and implement policy changes when necessary.

Schedule periodic compliance audits

Unless you test your systems and processes, you’ll never know if they are working. Schedule compliance audits of your contingent workforce program to make sure its procedures and processes are current and compliant. Audits can also bring to light any gaps or bottlenecks in your compliance plan.

Use technology to simplify compliance

The right tools can make compliance easier. Manual data entry and management by emails and spreadsheets are more likely to introduce errors and omissions than using specialized software like a VMS, designed to handle the complexities of talent sourcing, workforce management, invoicing, and payment.

To find the right VMS, review reports on the VMS landscape by industry analysts like Everest Group, Staffing Industry Analysts, Ardent Partners, Forrester, and other unbiased third parties. Then contact the company that fits your requirements best. They will be happy to demonstrate their technology and discuss what they can do to meet your needs.

The sooner you act, the more likely your company will establish a compliant contingent workforce program. And the less likely it will be to see your company’s name on in the media for failing to comply with contingent workforce laws and regulations.

The value of compliance in contingent workforce management