When a reference goes wrong: lessons from the £370k Wood-Hope tribunal – and why automation is fast becoming HR’s safest option

The headline everyone’s talking about

Imagine learning that a single e-mail from your school is quietly killing a former teacher’s career and that a tribunal will trace it back to you. That is the reality Catherine Wood-Hope uncovered when an employment tribunal ruled she had been dismissed for her trade-union activity and then hamstrung by “unfounded, dama- ging” references from her former head-teacher. The award that followed – £370,563 – underlines how post-employment conduct can cost an organisation almost as much as a flawed dismissal itself.

Why does a single school dispute matter to every employer? Because it distils three perennial risks about references:

1. retaliation or discrimination can turn a simple letter into a six-figure liability;
2. even informal emails or phone calls count; and
3. the paper-trail lasts for years – the tribunal traced each rogue reference line by line.

Rental applications, mortgage underwriting, visa sponsorship and even insurance quotes routinely ask for an employer reference or income confirmation. A letting agent’s checklist, for instance, will verify salary and contract length before approving a tenancy. Mortgage providers also phone or e-mail HR teams for written assurances that pay and employment are stable. When those references are late, inaccurate or coloured by bias, the applicant can lose a home purchase or miss out on a flat, multiplying the reputational risk for the employer that supplied the data, or failed to supply it.

What UK law really expects from a reference

Behind the modest request – “Could you confirm their dates and duties?” – sits a tangle of overlapping duties that few managers appreciate until something goes wrong. Four separate regimes converge: the com- mon-law duty of care, equality legislation, trade-union protections and modern data-protection rules. Add any sector-specific code (schools, financial services, healthcare) and the margin for error shrinks fast. The table that follows breaks those strands into plain-English obligations HR can pin to the wall.

Government and ACAS guidance package those duties into plain-English expectations: employers don’t have to give a reference at all, but if they do, it must be true, accurate, and not misleading.

HMRC data and Open Banking: convenient, but not a silver bullet

More recruiters and letting agents now ask applicants to pull a five-year employment-history PDF from their HMRC Personal Tax Account and e-mail it as proof of work dates. It is quick, but it only shows PAYE income that has been processed. Recent starters, zero-hour contractors and overseas assignments may be missing. Over-reliance risks rejecting perfectly qualified hires you want on payroll on incomplete data. HR teams remain liable if they encourage this route without explaining the blind spots.

Important limitation: the HMRC PDF confirms only who paid you and for which tax years. It does not include your job title, duties, or the reason you left, so it cannot stand in for the qualitative detail a recruiter, lender or landlord often needs.

Open banking services can pull live salary feeds straight from an applicant’s bank – a boon for lenders and letting agents – but they do nothing to confirm job title, disciplinary history or regulatory notes. Regulatory standard such as the NHS Employment History and Reference Checks Standard (2024) insists on at least three years of factual references and a documented audit trail. An automated employer-side platform such as WorkPass is the cleanest way to give verifiers both the financial facts and the employment narrative, with a single, tamper-proof audit log.

Employment vs personal (character) references: why the distinction matters

A surprising number of disputes start because a well-meaning line-manager writes on headed paper “in a personal capacity,” not realising that the stationery alone drags the organisation into liability. Employment references are issued on behalf of the company, stored in HR systems and must survive legal scrutiny; personal/character references are private views and should never quote internal data or sit on corporate letter- head. Flagging the difference in policy – and training managers to use personal e-mail addresses if they genuinely want to help – is a five-minute fix that shuts down a long tail of risk.

• Authority - organisation vs individual.
• Content - verified fact vs subjective character opinion.
• Liability - employer bears the first; individual bears the second.
• Data protection exposure – full SAR duties on the first, limited on the second.

Regulators and professional bodies are nudging the bar even higher.

The CIPD’s 2025 Providing References factsheet reminds HR teams that a reference can only be “futu- re-proof” if it is evidence-based, consistent in length and signed off centrally; anything looser “invites negli- gent-misstatement claims.” Meanwhile, the NHS Employers Employment History and Reference Checks Standard (June 2024 update) hard-wires that principle into public-sector recruitment, insisting on a fully auditable chain of references for every clinical and non-clinical hire.

Four pressure-points HR needs to lock down

Legal knowledge is one thing; stopping human nature from derailing it is another. References typically travel outside the visibility of compliance teams, drafted in haste by well-meaning managers or, worse, by someone with an axe to grind. The four bullets below map the weak spots that turn everyday admin into front-page risk.

1. “Off-piste” managers – line-managers who dash off personal opinions on headed paper blur the line between character and employer references. ACAS advises routing every request through HR and using standard wording.
2. Revenge or bias – as Wood-Hope shows, post-employment acts can be discriminatory or victimise union members.
3. Safeguarding / regulatory data – schools must confirm employment history gaps and any substantia- ted safeguarding findings before appointment offers.
4. Subject-access exposure – since 2018 most references are disclosable to the individual, so anything written can – and usually will – be read later.
5. Fake reference houses & forged PDFs – online “reference houses” sell bogus employer letters and doc- tored HMRC statements to applicants desperate for housing or work; Verifile’s 2022 deep-dive explains how “alibi mills” even pose as HR departments on the phone to back up invented careers.

Policy, Process, Proof: the three pillars of a compliant reference framework

Even the most diligent managers slip when policy isn’t paired with structure. The organisations that avoid Wood-Hope-style disasters all follow the same three-pillar model:

• Policy – publish one short, mandatory policy that says all references must route through HR (or an out- sourced gateway such as WorkPass) and must be factual, evidence-based and non-discriminatory. Quote the ACAS ‘Providing a Job Reference’ guidance and the CIPD factsheet so managers see external authority, not just HR diktat.
• Process – give managers a single template that covers dates, role and (if you allow it) final salary, plus an optional narrative box that HR signs off before it leaves the building. That removes ‘off-piste’ e-mails, the root cause in the Wood-Hope case.
• Proof – keep an audit trail. Whether you use a secure folder or a platform like WorkPass, every request, draft and final version should be time-stamped and retrievable. Auditors, regulators and tribunals all ask for that paperchain.

Finally, refresh training annually. A five-minute e-learning clip reminding managers that personal or union bias can cost six figures is usually enough to keep the policy front-of-mind.

If a bad reference has slipped out – the triage list

First, breathe – then follow a playbook. Speed and honesty contain the fallout, while silence or half-measures compound it. Treat every mis-sent reference like a data-breach: quarantine, correct and communicate. The five-step list beneath is your emergency drill.

1. Stop the flow – instruct the manager to cease all further contact with the recipient immediately.
2. Disclose internally – brief legal/ER and (if you’re regulated) your compliance function.
3. Correct the record – send the recipient an updated, factual reference marked as “supersedes all earlier versions”.
4. Tell the individual and apologise – speed and transparency can head off litigation.
5. Review insurance & notify regulators where sector rules impose reporting duties. Schools must also consider a safeguarding referral; FCA firms must update a Regulatory Reference.
6. Investigate under conduct policy; treat the manager’s actions under your conduct policy. Tribunals look closely at the employer’s response once the error is known.
7. Learn and automate – review why the breach slipped through. In most cases it is a manual bypass of an otherwise solid process. Lock down future requests behind a central HR account or an automated portal so there’s no ‘human shortcut’ left to take.

Prevention beats cure – and why automation is winning

Policies and training help, but they snap under the pressure of inbox fatigue, “urgent” recruiter calls and human bias. That is why many large employers now lift the risk out of e-mail entirely and let automation police the boundary. WorkPass - Verifile’s cloud platform – converts payroll data into tamper-proof, factual references that are delivered instantly and logged forever. It is not a bolt-on; it becomes the only gateway through which a reference can leave your organisation.

Cross-sector good practice distilled from the guidance

Here’s the five-point compliance pattern that ACAS, CIPD and NHS Employers all mirror:

1. Route every request through one channel – policy alone is not enough; build a gating mechanism.
2. Issue standard wording first; allow narrative only after double sign-off.
3. Keep an auditable trail – who asked, who answered, what data left the building.
4. Refresh manager training annually and require an acknowledgement click-through.
5. Correct mistakes fast and tell all three parties (recipient, employee, HR).

Those five moves appear verbatim, in some shape or form, across ACAS, CIPD and NHS Employers guidance – which is why WorkPass bakes them into its default workflow out-of-the-box.

WorkPass in a nutshell:

• Generates only factual, pre-approved data – job title, dates, salary, leaver reason, disciplinary outcome, even FCA “Regulatory Reference” fields – with no room for personal opinion.
• Runs on your payroll feed – once-a-month file upload; no form filling.
• Logs every access – employee and HR see who pulled the reference, when, and what exactly they saw.
• Costs HR nothing – requesters pay a small fee; employers like Virgin Money freed two full-time HR posts and 1,000+ emails a year.
• Builds an audit wall around sensitive data – ISO 27001, Cyber Essentials Plus, GDPR compliance and much more.

“If everybody signed up to WorkPass, how great would that be? All the data is there; whoever needs it can get it quickly. That’s utopia.” – Virgin Money HR team

Take-aways for your next leadership meeting

A tribunal judgment is not just a cautionary tale; it is a roadmap for change. By the next quarter your referen- ce process could be litigation-proof, staff-light and audit-rich – if you make it a line-item now. The four bullets below double as a ready-made agenda slide.

1. Map your reference traffic – how many requests, from whom, and how long they tie up staff.
2. Stress-test your policy – could a manager still send a rogue email tomorrow? If yes, fix the funnel.
3. Cost the risk – Wood-Hope shows six-figure liability is real; add legal fees and reputational hit.
4. Ask whether a zero-human, audit-first model would serve you better. WorkPass pays for itself from day one and eliminates the very human bias that sank Friars Primary.

Whether you’re safeguarding your brand during a Right-to-Rent audit, supporting an employee’s mortgage, or meeting a bank’s SM&CR obligations, WorkPass turns every request into the same stress-free, regulator-re- ady download.

Ready to see how an automated reference workflow looks in practice? We’re here to help you turn an HR vulnerability into a compliance win.