How to Audit Your Global Contractors Before Regulators Do

Our four-step guide for stress-testing your international contractor relationships before it’s too late

Good news: you found a great developer in Argentina!

But alas, bad news: you've been paying them as a contractor for 18 months, they're working exclusively for you, on your schedule, with your equipment, and Argentina is not a country that looks kindly on that arrangement. 

"One contractor is different from two, two is different from three," Kevin Pratt, Director and Senior Managing Counsel at Oyster HR, says. "Once you start to get into expanding numbers of engagements, you're probably at a point where you should consider something different." 

Kevin, sadly, has had this conversation more times than he can count.

He and our legal team spend a lot of their week on the same problem: working out what a company's contractor arrangements actually look like on paper, what they'd cost if a regulator disagreed, and which version of the setup can be defended.

Now, he’s sharing the same exact step-by-step contractor audit process we use for our clients.

Key Takeaways

• More contractors in one country means higher misclassification risk. Review early.
  

• Legal fines are only part of the cost. Operational disruption often costs more.
  

• A documented contractor review creates legal protection, but an undocumented one doesn't.

A simple hire can become a legal nightmare

Most companies that end up with a misclassification problem didn't set out to cut corners. They have an agreement with a contractor in another country because it was faster and more cost effective than formal employment. The arrangement worked, so they kept it. Months passed, then a year, then two. 

Regulators know exactly how common this is. The European Commission estimates that of the 28 million people working through digital labor platforms in the EU, roughly 5.5 million are misclassified as self-employed. That number covers platform work specifically, but it's a fair measure of how wrong this question gets at scale, and it's the estimate that drove an entire EU directive.

That trajectory is playing out well beyond the gig economy, too. Self-employment across the EU climbed 15 percent between 2019 and 2024, according to Eurostat. IT and professional services are growing even faster, which means more companies than ever are running the same experiment your Argentina developer represents.

What triggers the problem is almost never a regulator deciding to go looking. According to Kevin, the root cause is almost always a disgruntled contractor. Someone who had a bad experience, felt wronged at the end of an engagement, and said something to the right (or wrong) authority. A messy contractor divorce often leads to unwanted regulatory scrutiny.

Which means the compliance risk and the employee experience risk are the same risk. 

A contractor or team member who leaves on reasonable terms, treated fairly through a well-managed offboarding, is much less likely to become the complaint that opens the file. Sure, getting the ending right is common decency in HR practice, but it's also one of the most affordable forms of legal protection available.

In Germany, a single misclassification of a contractor means back payment of social security contributions of typically four years, but this can climb up to 30 years. Plus, there’s a late payment surcharge of 1 percent for every month the money was late. Executives carry personal criminal exposure of up to five years under section 266a of the German criminal code. 

In Spain, the labor ministry fined Glovo €79 million for misclassifying more than 10,000 delivery riders as self-employed. It might be easy to brush these off as cautionary tales about reckless companies, but the truth of the matter is that this could be any company (yours even) that never stress-tested an arrangement they assumed was fine. 

And the fines are only the part you can put in a spreadsheet. A reclassification also buys you months of distracted leadership, legal fees, and a decision that should have been made at the start, now being made under pressure. Kevin calls this the operational risk, and in his experience, it's the part companies almost always undercount.

The 4-step process we run on every contractor risk review

Kevin's position is direct and simple: 

Before asking whether a contractor relationship is legally defensible, ask what it would actually cost if it isn't. 

That calculation (fines, back pay, management time, operational drag, the works) almost always changes the decision.

The goal of running this analysis is not to convert every contractor to an employee. Some arrangements are fine as they are. Others need adjustment, and a few might just need to end. What Kevin says our counsel team provides is an objective read on which situation you're actually in, so the decision is informed rather than assumed. 

"We just want to give a true objective lay of the land.”

Step 1: Build the full fact pattern.

Before any risk analysis can happen, our legal team collects a complete picture: how many contractors, in which countries, how long they've been engaged, what they're actually doing day-to-day, and whether the company has a local legal entity in any of those countries.

That last detail matters more than most companies expect. If you have a legal entity in the country where your contractor is working, a regulator's first question is predictable: why aren't you employing this person through it? The existence of a local entity doesn't make misclassification automatic, but it makes the contractor arrangement substantially harder to defend.

Volume matters too. One contractor in Spain reads differently than five contractors doing similar work across Western Europe. The risk profile isn't the same and shouldn't be treated as such.

Step 2: Run it by country.

Each country uses its own set of factors to determine whether a contractor should legally be treated as an employee. Our lawyers work through those factors, weighing them against the customer's specific situation: supervision, exclusivity, how the person appears on org charts and in internal communications, and how invoicing works.

Even administrative requirements can create risk. Poland is a good example of how granular this gets. Polish contractors are required to invoice using a government-specified e-invoicing format. If they don't, it can independently increase misclassification risk, or worse, trigger VAT obligations that inflate costs for the company and reduce the contractor's take-home pay. That outcome has nothing to do with how the employment relationship is structured. It's a compliance failure on a technicality most companies never think to ask about.

The output of this step is a risk rating: low, medium, or high, with the specific factors that drove it.

Step 3: Translate the risk into numbers a CFO will recognize.

A risk rating doesn't move a budget until it's attached to real numbers. Our legal team separates practical risk from theoretical risk, estimates potential fines and back-pay exposure, and includes the operational cost: far beyond just the legal line items. "You have to help them understand what's the likelihood of occurrence and what's the true exposure," Kevin adds.

A good start is our employment cost calculator, which gives companies a concrete picture of what converting a contractor to a formal employee would actually cost. That number belongs in the same conversation as the risk rating. Without it, you're comparing a known cost (the current arrangement) against an abstract one (the alternative), and the abstract one always loses.

Step 4: Make the decision and document it.

After the analysis, there are three paths, and different groups of contractors often end up on different ends: 

• keep the contractor structure in place, with documentation that reflects how independent those relationships actually are
• convert some or all of them to employment
• set a timeline to revisit. 

All three will hold up in front of a regulator, as long as you pick one. What won't hold up is when a contractor was never reviewed, and thus stayed as a contractor because a conversation about reclassification never came up.

Contractors who remain contractors after a formal review are in a materially different legal position than those who were never reviewed at all. Documentation of independence, like how work is scoped, how invoicing works or supervision is handled, is what separates a defensible arrangement from an exposed one.

Kevin will tell you, carefully, that no team member employed by us on a customer’s behalf has ever been reclassified as a direct employee of that customer through a regulatory or legal process. He's careful because saying it out loud has a cost.

"When you make statements like this publicly,” he explains, “it puts a target on your back.”

But the point stands: when contractor engagements are structured correctly and reviewed against country-specific factors, the risk of reclassification drops substantially.

Run it before regulators do

The most expensive consequences of misclassification usually don’t show up first. Fines and back payments land on a specific date. Reputational damage, nervous stakeholders, and a leadership team relitigating a two-year-old hiring decision take longer and cost more, and none of it shows up on the invoice.

Which brings us back to the developer in Argentina from earlier on. Right now, that's a solvable problem, and probably a cheap one. Eighteen months from now, after a bad offboarding and a complaint you didn't see coming, it's the same problem with none of the good options left.

That’s why Kevin’s advice is the same every time: run the review early, before you need it and while all three paths are still open to you. The companies that call him early still get to decide what happens next.

If you’re assessing the potential risk of a contractor misclassification, or just getting started on your global hiring journey, why not talk to our expert team? Book a demo today.