A Guide to Permanent Establishment Risk Assessment

What Is Permanent Establishment Risk and Why Does It Matter?

Permanent establishment risk turns ordinary international contractor relationships into possible tax, employment, and liability exposure when the worker’s role starts to look like a local business presence. By the end of this audit, you will have a practical risk scorecard, the documents needed to defend it, and a clear view of which relationships need action.

The friction is that PE risk rarely announces itself in a contract. It builds through tenure, day-to-day work, local authority, customer contact, equipment, email access, and management habits that may look harmless one by one. This guide gives you a disciplined way to turn that vague concern into an audit-ready assessment before a regulator, tax authority, or worker complaint forces the issue.

Prerequisites for Your PE Risk Audit

A useful PE risk audit requires complete inputs, clear ownership, and shared definitions. Before scoring any worker, gather contracts, payment records, role descriptions, access permissions, management history, and local work details to reflect what the contractor actually does, not merely how the company labels the relationship.

Documents and Data

Begin by creating a working folder for each international contractor and a simple, understandable tracker for legal, HR, finance, and business teams. The aim is to identify recurring facts across countries, teams, managers, and long-term relationships, not to draft a legal memo.

At minimum, collect:

• Contractor agreement and all amendments
• Statement of work or project brief
• Start date, renewal dates, and current tenure
• Country of residence and usual working location
• Payment history and invoice cadence
• Manager or main internal contact
• Company systems, email, device, and workspace access
• Customer-facing responsibilities
• Authority to negotiate pricing, scope, renewals, or contract terms
• Any documents describing exclusivity, hours, reporting lines, or performance management

If your records are scattered, use the audit to centralize them. While a missing document isn't inherently high-risk, recurring gaps hinder demonstrating compliant intent.

Internal Stakeholders

Beyond legal review, facts reside with operations, finance, HR, procurement, IT, and the contractor's business owner.

Assign one overall audit owner and one respondent from each function. Each person should validate only the facts they can directly confirm:

• Finance confirms payment patterns and invoice terms.
• IT confirms systems, device, and email access.
• HR confirms worker involvement in people processes.
• The hiring manager confirms day-to-day supervision.
• Legal confirms classification and PE risk interpretation.

This division is crucial because a PE audit fails if responsibility for practical details is assumed to rest elsewhere.

Legal Definitions

Before scoring, agree on clear, specific internal definitions for permanent establishment risk, contractor misclassification, fixed place of business indicators, dependent agent indicators, employee-like control, and remediation options, ensuring they are accessible to non-lawyers.

Do not apply the same standard universally without country-specific review. This guide offers an audit method, not local legal advice. When a worker scores high, initiate local legal review to determine the next steps.

Step 1: Map Your Global Contractor Footprint

With your inputs in place, the audit starts by mapping who is working for you internationally, where they are located, how long they have worked with you, and which business function they support. You cannot reduce exposure, maintain workforce visibility, or own compliance decisions for relationships you cannot see.

Start with a spreadsheet or workforce system export. One row should represent one contractor relationship, not one invoice or project. If a contractor has changed roles over time, note the changes in the same row so you can see how the relationship has developed.

Use columns like these:

Field	Why it matters
Contractor name or ID	Creates a single audit record
Country of residence	Identifies where local analysis may be needed
Start date	Shows tenure and possible dependency
Business unit	Connects the work to company operations
Manager	Shows who controls the relationship
Work description	Helps separate project work from operational work
Customer interaction	Flags possible market-facing activity
Systems access	Shows integration into company operations
Renewal pattern	Shows whether the role is temporary or continuing

The “why” comes before the “how” because geography is only the surface layer. A single contractor in a country may be low risk if they perform a narrow, independent project. Several contractors in the same country, all doing core business work for the same manager, may point to something closer to an operating presence.

After you build the map, sort it three ways:

1. By country, to see concentration.
2. By tenure, to find relationships that have become permanent in practice.
3. By function, to find contractors doing core operating work.

This step worked if you can answer, without chasing emails, which countries contain contractors, who manages them, what they do, and which relationships have lasted long enough to require deeper review.

Step 2: Analyze the Nature of the Work

Once the footprint is visible, analyze what each contractor actually does. Permanent establishment risk depends less on a "contractor" title and more on the substance of the activity, especially when the person performs core work or represents the business in a local market.

Core vs. Ancillary Functions

Classify each contractor’s work as core, supporting, or incidental. Core work is closely tied to how money is made or customers are served. Supporting work aids business operations but may not represent the company locally. Incidental work is narrow, temporary, and easily separated from ongoing operations.

A practical scoring prompt is: “If this contractor stopped working tomorrow, would the local business activity continue normally, slow down, or stop?” If local delivery, sales, support, or production would cease, it indicates more than a project vendor.

Use these labels:

• Low concern: discrete deliverables, limited access, no customer authority, short duration.
• Moderate concern: recurring work, regular internal meetings, access to systems, some operational dependency.
• High concern: core role, long tenure, direct customer contact, business authority, or integration into team routines.

The contract matters, but the working reality matters more. If an agreement states "project-based consultant," yet the manager describes weekly priorities, performance expectations, and ongoing coverage, prioritize the reality over the written label.

Authority to Conclude Contracts

After classifying the work, determine if the contractor can bind the company commercially or acts as if they can. This is a clear instance where operational convenience can become a compliance exposure.

Look for practical authority, not just formal delegation. A contractor may not sign agreements but might negotiate pricing, promise delivery scope, approve renewals, manage local customer relationships, or present themselves as the company’s representative. These facts are crucial for the audit record.

Ask managers these questions:

1. Can the contractor negotiate terms with customers or vendors?
2. Do customers treat the contractor as a company representative?
3. Does the contractor approve scope, pricing, service levels, or renewals?
4. Does the contractor use a company title, email signature, or business card?
5. Does the contractor manage other workers or coordinate local delivery?

This step is complete if every contractor has a written activity classification and a brief explanation for their score. The explanation is vital for defending your reasoning should the decision be challenged.

Step 3: Quantify and Score the Risk

With the facts gathered, a scorecard turns scattered legal and operational concerns into a remediation queue. PE analysis is not purely mathematical, and the score cannot guarantee the answer, but it does make high-risk relationships visible enough for timely legal, tax, and workforce decisions.

Create a five-factor scoring model. Give each factor a score from 1 to 5, where 1 means low concern and 5 means high concern. Keep the model simple enough that managers can understand it, but structured enough that legal can review it.

Suggested factors:

Factor	Score 1	Score 5
Tenure	Short, defined engagement	Long-running or repeatedly renewed
Function	Incidental or project-based	Core business operation
Control	Independent delivery	Day-to-day management by company
Market authority	No customer authority	Negotiates or represents company
Integration	Limited access	Company email, systems, meetings, routines

Then total the score:

• 5 to 10: monitor and keep documentation current.
• 11 to 17: review contract, role scope, and management practices.
• 18 to 25: escalate to legal, tax, and workforce leadership for remediation.

Do not let the scorecard replace judgment. A single severe factor, such as authority to negotiate customer terms, may justify escalation even if the total score is moderate. Likewise, a long-tenured contractor with clean independence and limited business authority may need documentation more than restructuring.

This step worked if you can produce a ranked list of contractor relationships, show why each one landed where it did, and identify the owner for the next decision.

Troubleshooting Your Audit

Hard cases often involve worker movement, company access, workspace, or gradual factual changes. Treat these as opportunities to improve documentation, decision ownership, and audit readiness, rather than abandoning review or letting liability linger.

What if a contractor moves between countries?

If a contractor changes countries, re-open the audit record. The risk profile shifts with changes to location, tax analysis, work permissions, and local classification.

Request the new country of residence, usual work location, effective move date, and any scope changes. Update the scorecard from the move date forward. If the move was undisclosed, document discovery and review.

The updated record should clearly show old and new locations, timing, and the decision made after review. Do not retain only the old country as the location in your system.

Does having a company email or laptop create risk?

Company email or a laptop indicates integration, but doesn't provide a definitive answer. A contractor with company tools, a company title, regular internal meetings, and manager-directed priorities appears more integrated than one submitting deliverables through limited channels.

Review access in context; some is essential for security or project delivery. The concern is whether access makes the contractor operate like an employee.

Practical fixes:

• Remove unnecessary internal distribution lists.
• Avoid employee-style titles.
• Limit systems access to project needs.
• Document deliverables and approval paths.
• Train managers not to treat contractors as direct reports.

Success is when IT access, contract scope, and manager behavior align.

My contractor works from a coworking space. Is that a "fixed place of business"?

A coworking space raises questions, but risk depends on the company's connection to it. The key is whether the company controls, pays for, directs, brands, or repeatedly uses the location as part of local operations.

Inquire if the company arranged, reimburses, lists publicly, stores equipment, sends customers, or assigns multiple workers to the space. Affirmative answers to several points warrant escalation.

A successful review distinguishes personal workspace choice from a company-controlled location, helping legal determine if the space is merely where the contractor works or a company business location.

Next Steps: From Audit to Action

An audit earns its value only when it changes decisions. You are done when every contractor has a location record, activity classification, risk score, supporting rationale, and named owner for remediation or monitoring. The natural next step is choosing the right compliant structure for each high-risk relationship.

For low-risk relationships, tighten documentation and set a review date. For moderate-risk relationships, adjust scope, access, management practices, and contract terms. For high-risk relationships, consider whether the worker should become an employee, move into an Employer of Record model, or be managed through a structure that owns the compliance position.

If you are comparing those options, this guide to Employer of Record Services can help you evaluate when employment through a local hiring model is safer than extending a contractor relationship.

Papaya Global may enter the decision process when the business needs workforce visibility, financial control, and compliant coverage across 180+ countries. The platform can support contractor management, EOR, and workforce payments, while the broader operating model is described in its how it works overview.

The close of the audit should be practical: a scorecard, a remediation queue, and a calendar reminder for review. Permanent establishment risk is not controlled by a one-time spreadsheet. It is controlled by proving that the company knows where its people are, what they do, who manages them, and why each classification decision is defensible.