Your IT person is off for six weeks, or has left, and the laptops, the Microsoft 365 tenant and the printer that only works on Tuesdays have nobody looking after them. Bringing in temporary IT support staff is the obvious fix. It is also the moment a small firm hands someone the keys to every account it has, often on the strength of a CV and a phone call.
This guide is for the office or operations manager at a small business who has to make that call this month. It covers how the person is engaged, the checks that changed this autumn, and what to set up on the IT side before they log in.
Decide how temporary IT support staff are engaged
There are three common routes and each puts the paperwork in a different place.
Through an agency, the person is an agency worker. The agency or its payroll provider pays them, and the agency carries the right to work check and the vetting. After 12 weeks in the same role they are entitled to the same basic pay and conditions as someone you hired directly, under the Agency Workers Regulations 2010. If you later want to take them on permanently, the Conduct of Employment Agencies and Employment Businesses Regulations 2003 let the agency charge a transfer fee only within 14 weeks of their first day or 8 weeks after their last, whichever ends later, and only if your terms say so.
Through their own limited company, you are buying a service from a business. That brings in the off payroll working rules, usually called IR35, which we cover below.
On your own payroll as a fixed term employee, everything sits with you: right to work, PAYE, pension auto enrolment, holiday and the written statement of terms on day one.
For cover of a few weeks to a few months, most small firms are better off with the first route. It keeps the employment risk off your books and gives you one invoice.
Right to work checks now reach beyond employees
This is the change most small firms have not heard about. From 1 October 2026, section 48 of the Border Security, Asylum and Immigration Act 2025 extends illegal working rules beyond contracts of employment to workers and some individual sub contractors, for engagements that start on or after that date. Penalties can reach £45,000 per worker for a first breach and £60,000 for a repeat, according to guidance from Howes Percival on the new rules.
The Home Office looks first at whoever has the direct contract with the worker, so with an agency hire that is normally the agency. It can then look further up the chain if that business cannot be found or the checks were not done properly. The practical step for you is simple. Ask the agency in writing to confirm the right to work check has been done to the Home Office standard before the first shift, and keep that email. If you engage someone directly, do the check yourself, whatever their contract is called. The Home Office Code of Practice was still in draft at the end of June, so watch for the final version.
Vetting someone who will hold admin rights
An IT support role does not usually qualify for a standard or enhanced DBS check, because those are reserved for roles listed in law, such as work with children or vulnerable adults. What any employer can ask for is a basic DBS check, which shows unspent convictions. The Disclosure and Barring Service cut the fee for a basic check to £20 from 5 October 2026, so cost is no longer a reason to skip it.
Ask for two references, and make one of them a previous IT manager or client who can speak to how the person handled access and passwords, not only whether they turned up.
IR35 if they come through their own company
If the contractor works through a limited company, someone has to decide whether the work would be employment if the company were not there. For a small client, that decision sits with the contractor’s company, not with you. For a medium or large client, you must make the decision, give the contractor and any agency a status determination statement with your reasons, and offer a way to challenge it.
Whether you count as small depends on meeting two of three tests: turnover, balance sheet and an average of 50 employees. The turnover and balance sheet limits rose to £15 million and £7.5 million for financial years starting on or after 6 April 2025. The tests look back over two financial years, so commentators disagree on whether firms drop out from April 2026 or April 2027. Check your position with your accountant before you sign a contract with a limited company contractor. Our IR35 guide for IT contractors goes through the status questions in more detail.
What to set up before they log in
The Cyber Essentials requirements published by the National Cyber Security Centre in April 2026 are a sensible baseline even if you are not certified. They ask for a process to create and approve accounts, a unique login for every person, separate accounts for admin work, multi factor authentication on every cloud service, and accounts removed or disabled when no longer needed.
In practice that means the temp gets their own named account, never the shared admin login or the previous IT person’s account. Admin rights go on a separate account with multi factor authentication switched on. Write down every system they are given access to on day one, because that list is what you will work through on their last day. Put the end date of the assignment in the diary with a reminder to disable those accounts and change any shared passwords they saw.
Brief them properly on day one
Half an hour on the first morning saves days later. Show them where the documentation is, if there is any. Tell them which suppliers they can call and which they cannot, what they can buy without asking, and who signs off changes to email, backups and the firewall. Ask for a short written handover at the end of every week. It keeps the knowledge in your business when they leave.
Flamingo Workforce supplies IT and technical staff for short cover and longer projects, with right to work and vetting done before the first day. If you need someone at short notice, get in touch and tell us what systems they will be looking after.