The Subcontractor Compliance Gap That Ends National Security Contracts

Picture this. It’s a crisp Tuesday morning, and your annual audit has just wrapped. You’re braced for the usual minor operational tweaks. Instead, your auditor slides a thick, grim-looking folder across the table and pauses before speaking.

They’ve just handed you an ugly diagnosis.

Your direct operations are spotless. But they’ve dug into your Tier 2 and Tier 3 subcontractors, and down there, buried in the layers of outsourced national coverage, is a sprawling mess. Ghost workers. Guards on post without valid state licenses. Unverified I-9s. Off-the-books cash payments. Without ever realizing it, your supply chain has been used to facilitate payroll tax evasion and wage theft. And as the prime contractor, the IRS and the Department of Labor are looking directly at you.

It’s the nightmare scenario for any national security or multi-site FM provider. You can’t operate without a subcontracted labor supply chain, but that very chain is a loaded gun pointed at your brand, your margins, and your hard-won contracts.

Why “we use reputable subcontractors” is no longer a defense

The US security industry runs on layered labor. A national contract is won, coverage is subcontracted to regional firms, and those firms lean on staffing agencies, PEOs, and “independent contractors” to fill the schedule at 2 a.m. on a holiday weekend. Each step is a reasonable commercial decision. Stacked together, they create something most boards have never mapped: a labor supply chain three or four tiers deep, with no single source of truth for who is compliant.

Here is what can live in those lower tiers, whether you can see it or not:

• Worker misclassification: guards labeled “1099 independent contractors” to sidestep payroll taxes, overtime, workers’ compensation, and unemployment insurance. When it unwinds, liability doesn’t always stop at the company that did it. Under joint-employer theories, it can travel up the chain.
• Shell payroll and PEO fraud: payroll providers that collect withholding and employment taxes from their clients, then fail to remit them to the IRS. Businesses up the chain can end up facing the fallout.
• Wage and hour violations: unpaid pre-shift briefings, uncompensated travel between posts, off-the-clock work, and missed overtime under the FLSA and state law. Enforcement actions are public, and the brand on the badge is yours.
• Licensing gaps: unlicensed or improperly licensed guards deployed by a subcontractor’s subcontractor, on your client’s premises, under your contract. Licensing is state by state, so the rules differ from California to Texas to Florida to New York.
• Work authorization failures: missing or invalid I-9 documentation. Federal law also restricts knowingly using contract labor to obtain unauthorized workers, which makes this a risk for the prime too.

The uncomfortable truth: you can be fully compliant as a business and still be exposed to, and even unknowingly financing, violations happening two tiers below you. That is exactly the scenario an auditor, a client procurement team, or a government investigator is trained to look for.

Ignorance is no longer a defense. The entire point of the modern compliance environment is that not knowing is the failure.
 

The uncomfortable truth: you can be fully compliant as a business and still be exposed to - and even unknowingly financing - fraud happening two tiers below you. That is exactly the scenario an auditor, a client procurement team, or an HMRC officer is now trained to look for.

Ignorance is no longer a defence. The entire point of the modern compliance regime is that not knowing is the failure.
 

But here's the secret the market leaders won't share

Avoiding disaster is only half the story. The firms quietly ahead have worked out something the rest of the market hasn’t: bulletproof, multi-tier compliance isn’t just insurance. It’s a weapon.

One of the largest guarding firms we work with has been running this kind of visibility across its entire labor supply chain. Their candid view? It’s the best solution they’ve seen in the market, and they have no intention of telling their competitors about it. When you’re bidding for national contracts, being able to prove compliance from the top of the chain to the bottom is a clear advantage. Why would anyone hand that map to the firms they’re bidding against?

It’s a fair point. It’s also the most expensive kind of quiet, because the firms without that visibility don’t realize the game has already changed. They’re not losing bids on price. They’re losing them on the assurance question they didn’t know was being scored.

So consider this the noise nobody else was going to make.

Rewriting the rules of the tender

When you bid on a $50 million national guarding contract, the procurement board isn’t only looking at your price. They’re looking at your risk profile, including whether your subcontractors meet Service Contract Act wage requirements and your client’s vendor compliance standards.

Now imagine pulling up a screen and showing them exactly how your operation runs. Real-time visibility across every tier of your workforce. Combined with Arez Operate’s workforce scheduling and contractor management capabilities, organizations can demonstrate operational control throughout the entire supply chain. Worker assignments geofenced to your exact specification, with no blind spots. Work authorization, state license status, and payroll classification are verified and evidenced before a guard ever steps onto the client’s site.

That isn’t just passing an audit. That’s rewriting the rules of the bid, turning compliance from a cost you dread into the edge that wins you the contract.

This is why generic field service software and fragmented spreadsheets no longer cut it. FM and national security are, at heart, data businesses. You cannot manage national-scale risk by emailing schedules to subcontractors and hoping. What the modern landscape demands, and what the winners are quietly using, is a true compliance-aware CAFM that sits across your whole supply chain.

Shine a floodlight to the very bottom

The fix isn’t a rip-and-replace project, and it isn’t another year of consulting. It’s visibility: a single source of truth across your entire labor supply chain that works alongside the workforce scheduling, shift management, and CAFM systems you already run.

Arez connects your Tier 1, Tier 2 and Tier 3 suppliers in one platform so you can answer, instantly and with evidence, the questions an auditor or client will ask:

• Who is actually supplying labor to your business, and who employs the workers delivering on your behalf?
• Are their state guard licenses, I-9 documentation and qualifications current at every tier?
• Is everyone classified correctly (W-2 vs. 1099) and paid correctly?
• If the IRS, the DOL, a client, or an auditor asked you to prove it tomorrow, could you do it in minutes rather than weeks?

That is the difference between hoping your supply chain is clean and being able to demonstrate it. Between an ugly diagnosis and a clean bill of health you can put in front of any client you want to win.

Get the diagnosis before someone else does

We built the Labor Supply Chain Risk Scorecard so you can find your blind spots on your own terms, quietly and in a few minutes, before anyone else puts your supply chain on the table.

You’ll get a clear read on where your compliance and visibility gaps sit across Tiers 1, 2 and 3, practical recommendations, and a free 14-day trial of Arez with Tier 2 and Tier 3 supplier visibility included.

Government scrutiny of subcontracted labor is tightening, and the leading firms are already insulating themselves and winning bids as a result. The only real question is whether you secure your supply chain before your competitors lock you out of the market.

Take the Labor Supply Chain Risk Scorecard →

Arez provides labor supply chain compliance and workforce assurance for national security and facilities management providers. It works alongside your existing scheduling, workforce management and CAFM systems, with no rip-and-replace required.