Contractor Safety Management: How to Control Third-Party Risks on Your Site
The Contractor Who Didn't Know the Rules
In 2010, a contractor employee was fatally injured at a chemical facility in Belgium. The contractor had been working on the site for two weeks. He had received a site induction. He had signed the contractor safety rules document.
What he had not been told: the area where he was working had an elevated methane risk during specific weather conditions. The facility's own workers knew this and monitored for it. It was not in the standard site induction because it was considered specialist knowledge for full-time staff.
The contractor employee's employer had no process for receiving and passing on site-specific hazard information. The client facility had no process for verifying that contractors had received information beyond the standard induction.
The gap between "we told them" and "they understood and applied it" is where most contractor safety failures occur.
According to the ILO, contractors and subcontractors account for a disproportionate share of workplace fatalities in industrial sectors — often representing 30–50% of fatalities on sites where they make up a much smaller fraction of the workforce. The pattern is consistent across industries and jurisdictions: contractors are killed at higher rates than directly employed workers doing the same tasks, in the same environments.
Why Contractor Safety Is Different
Managing contractor safety is fundamentally different from managing directly employed worker safety, because:
You have less control over contractor competency. You cannot require contractors to complete your in-house training or maintain your in-house competency records. You can set requirements — but verifying they are met requires a different process than you use for your own employees.
Contractors may not know your site-specific hazards. Your own workers learn the specific hazards of your facility over time. A contractor who arrives on Monday may be working in a high-hazard area by Tuesday morning.
Contractors may have conflicting priorities. A contractor whose commercial relationship depends on completing work quickly may apply different risk tolerance than your own workers, who are accountable to your management system.
You retain legal accountability. ISO 45001 Clause 8.1.4 explicitly requires that outsourced processes and contractors are managed within the organization's OHS management system. Issuing a permit to a contractor does not transfer the duty of care. The client organization remains responsible for what happens on its site.
The 5-Stage Contractor Safety Management Framework
Stage 1: Prequalification
Before a contractor works on your site, verify that they have the capability to work safely. Prequalification is conducted before contract award — not after.
Minimum prequalification requirements:
| Requirement | Verification Method |
|---|---|
| Relevant OHS certifications and accreditations | Certificate copies; expiry date verification |
| Industry registration and licenses | Company registration; license checks |
| Safety incident history | TRIR and LTIR for past three years |
| OHS management system maturity | ISO 45001 certification or equivalent documented system |
| Insurance coverage | Certificate of currency for public liability and workers' compensation |
| Competency requirements for specific work | Trade licenses, qualifications of key personnel |
| References from other clients | Contact references and ask specifically about safety performance |
Prequalification should be proportionate to risk. A low-risk office maintenance contractor requires less scrutiny than a contractor conducting confined space or hot work operations.
Prequalification registers should be maintained for all approved contractors and reviewed annually — a contractor who was compliant 18 months ago may not be compliant now.
Stage 2: Contract and Safety Requirements
The contract with the contractor should specify the OHS requirements they must meet while working on your site. These requirements should be explicit — not assumed.
Key contract OHS provisions:
- Requirement to comply with the client's site OHS rules and procedures
- Requirement to provide SWMS, risk assessments, or JSAs for high-risk work before commencing
- Requirement to induct all workers on the client's site induction program before commencing work
- Incident reporting obligations (including near misses)
- Right of the client to stop work for safety reasons without contract liability
- Requirement to maintain minimum insurance coverage
- Competency requirements for specific task categories
A contractor who refuses to sign safety requirements is not the right contractor for the work.
Stage 3: Induction
Every contractor employee — from the most senior site supervisor to the most junior subcontractor — must complete a site induction before performing any work. The induction must cover:
| Induction Topic | Content |
|---|---|
| Site hazards | Specific hazards of this site: chemical processes, overhead lines, vehicle movements, etc. |
| Emergency procedures | Evacuation routes, assembly point, emergency contacts |
| Site safety rules | PPE requirements, speed limits, restricted areas, hot work procedures |
| Reporting requirements | How to report incidents, near misses, and hazards |
| Permit to work | How the PTW system works; how to obtain a permit |
| Site contacts | Who to contact for safety issues; who is the client's site safety representative |
The induction must be conducted in a language the contractor employee understands. A signed form confirming attendance does not confirm comprehension.
For high-risk or long-duration contractors, a task-specific induction covering the specific hazards of their work area supplements the general site induction.
Stage 4: Supervision, Permit Integration, and Communication
Once on site, contractors require active supervision — not just permission to work.
Client supervision responsibilities:
- The client's authorizing authority is responsible for the Permit to Work for any high-risk work the contractor performs
- Client site management must verify that contractors are following the permit conditions and site safety rules
- Contractors must be included in toolbox talks and safety briefings that are relevant to their work area
- The client must communicate any change to site conditions, hazards, or activities that affects the contractor's work
Contractor supervision responsibilities:
- The contractor must appoint a competent supervisor for each work crew
- The contractor supervisor is responsible for briefing the work crew and ensuring compliance with the permit and site rules
- The contractor supervisor is the primary communication link with the client's site management
Simultaneous operations: When contractor work is adjacent to or interacts with site operations, SIMOPS management must include the contractor's activities in the coordination process. A contractor team is not exempt from SIMOPS requirements because they are external.
Stage 5: Performance Monitoring and Review
Contractor safety performance must be monitored throughout the engagement — not assessed only at the beginning and the end.
Performance monitoring activities:
- Regular safety inspections of contractor work areas
- Attendance at contractor toolbox talks (to assess content quality)
- Review of contractor incident and near-miss reports
- Periodic safety meetings with contractor supervision
- Observation of permit-to-work compliance
Performance data to track:
| Metric | What It Indicates |
|---|---|
| Contractor incident rate (vs. direct employees) | Whether contractor risk is proportional or elevated |
| Near miss reporting rate | Reporting culture health |
| Permit violations | Compliance with PTW system |
| Inspection findings in contractor areas | Physical condition of contractor work areas |
| Repeat findings | Persistent problems that previous corrective actions haven't resolved |
Performance review: At the end of each contract engagement (or annually for long-duration contractors), conduct a formal safety performance review. Use the results to update prequalification status for future contracts.
Contractor Safety and ISO 45001
ISO 45001 Clause 8.1.4 requires organizations to manage the OHS impacts of outsourced processes and contractors. The key requirements:
| ISO 45001 Requirement | How Contractor Safety Management Satisfies It |
|---|---|
| Determine controls for outsourced processes | Prequalification requirements define contractor OHS capability standards |
| Communicate requirements to contractors | Contract OHS provisions and site induction communicate requirements |
| Ensure outsourced processes do not adversely affect OHS performance | Supervision, PTW integration, and performance monitoring |
| Coordinate with contractors on hazard identification | SIMOPS coordination includes contractor activities |
| Ensure contractors follow OHS requirements | Site rules, permit conditions, and inspection |
| Review contractor OHS performance | Post-engagement performance review; updated prequalification |
Contractor safety management is consistently one of the most scrutinized areas in ISO 45001 Stage 2 certification audits. Auditors typically interview both client and contractor personnel to verify that the management system is integrated — not just documented.
Common Contractor Safety Failures
| Failure | Why It Occurs | Prevention |
|---|---|---|
| Contractor bypasses PTW | No verification that contractor has obtained permit before work; assumed compliance | Client supervision spot-checks; PTW visible at work location mandatory |
| Subcontractor not inducted | Main contractor sub-contracted without notifying client; no process for sub-tier management | Contract requires written notification of all subcontractors; sub-tier induction mandatory |
| Site-specific hazard not communicated | Client assumes standard induction covers all relevant hazards | Pre-task briefing for contractors entering areas with specific hazards |
| Incident not reported | Contractor fears commercial consequence; client not following up | Contract requires reporting; client investigates all contractor incidents |
| Different safety standards applied | Contractor believes client's rules don't apply to them | Clear contract language; visible enforcement; right-to-stop-work exercised |
How FindRisk Supports Contractor Safety Management
Pre-task risk assessment: Before contractor work begins, use FindRisk's AI-assisted assessment to identify site-specific hazards the contractor should be aware of for their specific task and location. Share the assessment output as a briefing document during the task-specific induction.
Contractor inspection documentation: Use FindRisk to conduct safety inspections of contractor work areas — capturing photographic evidence of conditions, findings, and corrective actions. Contractor-specific findings can be filtered and shared with the contractor supervisor for action.
Permit integration: Document pre-permit hazard assessments in FindRisk, with contractor-specific hazard identification and control verification before PTW authorization.
Corrective action tracking: Corrective actions identified in contractor areas are tracked to closure in FindRisk — with the contractor supervisor as the assigned owner for actions within their control, and the client's safety officer as the owner for systemic client-side improvements.
Frequently Asked Questions
Is the client legally responsible for contractor safety on their site?
In most jurisdictions, yes — the client organization retains a duty of care for everyone on their site, including contractors. The exact legal framework varies: in the UK, the Client has specific duties under the Construction Design and Management Regulations; in the US, OSHA's multi-employer citation policy holds both the controlling employer and the creating/exposing employer responsible in multi-employer workplace situations. ISO 45001 Clause 8.1.4 makes the organizational requirement clear: outsourced processes must be managed within the OHS management system. Issuing a contract does not transfer liability.
Does every contractor need to be prequalified?
The extent of prequalification should be proportionate to the risk of the work. A low-risk contractor (e.g., office cleaning, catering) requires basic verification of insurance and compliance. A high-risk contractor (confined space, hot work, scaffolding, crane operations) requires comprehensive prequalification including incident history, methodology review, and key personnel competency verification. Most organizations maintain tiered prequalification requirements matched to the risk category of the work.
What should happen when a contractor refuses to follow site safety rules?
The contract should include an explicit right for the client to stop work — without commercial penalty — when a contractor is not following safety requirements. This right should be exercised. A contractor who argues that safety compliance would make the job commercially unviable is demonstrating that their commercial model depends on accepting risk that is your organization's legal responsibility. If the refusal continues, the contractor should be removed from site and the contract terminated for breach of safety provisions.
Conclusion
Contractor safety management is not a separate program from your core OHS management system — it is an extension of it. Contractors working on your site are subject to the same hazards as your own workers. They deserve the same standard of risk control. And when they are injured, the consequences — legal, financial, reputational — fall on the client organization as much as on the contractor.
The organizations that manage contractor safety most effectively treat contractors not as external parties who are someone else's responsibility, but as members of the team for the duration of their work — with the same induction, the same permit requirements, the same supervision expectations, and the same incident investigation process.
The legal standard, the ISO 45001 requirement, and the moral obligation all point in the same direction: contractors on your site are your responsibility.
Download FindRisk to conduct contractor pre-task assessments, document contractor safety inspections, and track contractor corrective actions — all within the same platform you use for your directly employed workforce.
Try FindRisk
Ready to modernize your safety workflow?
Conduct AI-powered risk assessments, generate reports instantly, and keep your team safe — anywhere, anytime.