Contractor Prequalification Playbook for 2026

When contractors work on your site, you share responsibility for how that work is done. OSHA can cite a controlling employer that fails to take reasonable care to prevent and detect violations on its worksite; in Great Britain, section 3 of the Health and Safety at Work etc. Act 1974 requires every employer to protect people not in its employment so far as is reasonably practicable, and CDM 2015 adds client duties on construction projects; and ISO 45001, a voluntary standard, sets requirements for contractors in clause 8.1.4.

PDF binders, spreadsheet insurance trackers and gate sign-in sheets can support an evidence trail if review, approval, expiry and site checks are controlled. Disconnected records make those handoffs harder to maintain; assess the gaps before choosing software. This playbook covers the 2026 model for risk-tiered prequalification, digital induction, mobile check-in and contractor scorecards — without re-keying data across systems.

1. The 2026 contractor risk landscape

Two sets of duties make contractor records a safety and reporting matter, not only a procurement one:

• Multi-employer liability. On multi-employer worksites in all industries, OSHA's Multi-Employer Citation Policy (CPL 02-00-124) allows more than one employer to be cited for the same hazard. A controlling employer, one with general supervisory authority over the site, must exercise reasonable care to prevent and detect violations, although less than it owes its own employees. ISO 45001 clause 8.1.4 covers procurement, with sub-clauses on contractors (8.1.4.2) and outsourcing (8.1.4.3), as ISO's TC 283 FAQ explains; it binds only organisations that adopt or certify to the standard. On construction projects in Great Britain, CDM 2015 requires the client to make suitable arrangements for managing the project (regulation 4) and anyone appointing a contractor to take reasonable steps to check its competence (regulation 8).
• CSRD reporting. Companies in CSRD scope (after Directive (EU) 2026/470, broadly those with more than 1,000 employees and more than EUR 450 million net turnover) report health and safety metrics where the health and safety of their own workforce is material. Under ESRS S1-14 in the 2023 standards, which companies may still use for financial year 2026, those metrics cover the own workforce, which includes self-employed people and agency workers, plus fatalities among other workers on their sites, such as contractors' workers. Under S1-13 in the revised ESRS (see the ESRS disclosures guide) that apply from financial year 2027, fatalities from work-related accidents among other workers on the company's sites are counted in one combined total with own-workforce fatalities, and how self-employed and agency workers are covered in the own-workforce figures depends on the company's ESRS S1-6 materiality assessment (check the final text of the Regulation). Other value-chain workers fall under ESRS S2. Directive (EU) 2026/470, which entered into force on 18 March 2026 and must be transposed by 19 March 2027, also adds a value-chain cap: a reporting company may not require an undertaking in its value chain with no more than 1,000 employees on average to provide more than the voluntary reporting standard specifies, and that undertaking may decline to. For contractor questionnaires, check each data request against that cap with legal advice. Whatever system you use, retain the reporting boundary, data source, review and correction history.

2. Why traditional prequalification fails

Check for these potential failure modes in your current process, whether it uses documents, spreadsheets or software:

• Missing review evidence. Confirm that the retained record identifies who reviewed the submission, the criteria applied and who approved it.
• Expired COIs. A certificate valid at prequalification can lapse before work ends. Assign an expiry check and escalation owner, with alerts where useful.
• Missing field verification. Check that the people arriving match the assessed workers and authorized work; a badge alone does not establish competence.
• Score inconsistency. Give reviewers shared criteria and retain reasons for exceptions. Automating a score does not by itself make the criteria valid.

3. The risk-tier framework

One workable approach is to tier contractors by hazard exposure, spend criticality and site footprint. Three tiers are a common starting point:

Tier A — High-risk

Hot work, confined space, working at height, energy isolation, hazardous materials handling. Requires:

• Full prequal questionnaire (financial, safety, insurance, ESG)
• COI verification with carrier letter
• In-person site induction
• Per-trade competency cards
• Supervisor scorecard reviewed quarterly

Tier B — Mid-risk

Routine maintenance, light construction, low-energy electrical, scheduled cleaning. Requires:

• Standard prequal
• COI upload with OCR validation
• Digital pre-arrival induction
• Annual scorecard review

Tier C — Low-risk

Office services, deliveries, vending, landscaping outside the operating envelope. Requires:

• Lightweight prequal (insurance + sanctions check)
• Check-in only

Tier criteria should be reviewed annually and re-tiered when scope changes. Tier inflation (everything is Tier A) is a risk to watch for: it can slow onboarding and spread scoring effort thinly.

4. Insurance and COI auto-tracking

A workable baseline for COI handling in 2026 (our recommendation, not a published standard):

• OCR extraction of carrier, policy number, limits per coverage type, and expiry dates
• Automatic expiry alerts at 60, 30 and 7 days to both contractor and buyer
• Renewal workflow that gates site access at the moment of expiry — not the next audit
• Coverage matrix by tier (general liability minimum, auto, workers comp, professional, umbrella, environmental for chemical contractors)

A manual process can meet the same baseline if one person owns the expiry diary and the gate check is enforced; a tool can automate it. Test either with your own certificates, including one that has just lapsed. On paper, the free contractor compliance record template keeps one record per contractor company, with each document's issue and expiry dates, its next check, who reviewed it and whether it was accepted, queried or rejected.

5. Digital site induction and badge issuance

Site induction is the hiring client's main chance to brief the contractor on the site's hazards and rules. A 2026 induction stack includes:

• Per-site induction modules — site-specific hazards, emergency mustering, contact tree, site-specific PPE
• Multilingual delivery — minimum English plus the dominant languages on site
• Completion testing with pass threshold and re-test workflow
• Digital badge with QR code, photo, contractor company, trade, expiry date
• Per-trade competency cards uploaded and verified (working-at-height, confined-space, forklift, etc.)

Badges should expire — annually as a default, more frequently for Tier-A trades. Expired badges block site access automatically.

6. Mobile check-in, geofencing and lone-worker overlap

Gate sign-in sheets create three risks: no real-time muster list in emergencies, no geofence verification (contractor signs in then leaves), and no lone-worker overlap. Mobile check-in can address all three, depending on the product and how it is configured:

• QR badge scan at the gate or via the contractor's phone
• Geofence verification — contractor must be inside the site boundary (this uses location data, so settle the lawful basis and retention first; see our GDPR and EHS data guide)
• Daily roll-call with auto-muster on alarm
• Lone-worker overlap — if the contractor is the only person on a sub-site, lone-worker protocols engage automatically
• Check-out enforcement — open check-ins at end of shift trigger supervisor follow-up

7. Contractor scorecards and continuous monitoring

Prequalification is a moment-in-time decision. Scorecards make it continuous:

• Incident rate — recordables, near-misses, stop-works per contractor company per period
• Audit findings — open findings, repeat findings, time-to-close
• Induction compliance — % of contractor workers with valid induction and badge
• COI lapses — count and duration per year
• Permit performance — permits issued vs revoked or escalated

Scorecards drive tier reassignment (a Tier-B contractor with three Tier-A incidents gets escalated) and procurement conversations (a poor scorecard goes into the next sourcing event).

8. Integration with permit-to-work, incident and ESG

A contractor system that does not connect to your other records becomes a parallel process. Integrations to scope, and to mark native, configured, integrated or outside the proposal:

• Permit-to-work — contractor identity, induction status, competency cards and COI validity must flow into the permit issuer's screen. Expired credentials block issuance — not warn after the fact.
• Incident management (see the incident investigation guide) — every contractor incident is recorded against the contractor company's record, feeds the scorecard, and triggers CAPA assignment to the contractor where appropriate.
• ESG / Scope-3 — contractor incident and exposure data feeds the company's CSRD disclosures, where it is in scope, and supplier sustainability scoring.
• ERP / procurement — contractor master is synced bi-directionally with the ERP supplier master so procurement and safety share one truth.

9. 30-60-90 day rollout

SMB rollout

Days 1–30 — Charter. Risk-tier definitions, prequal questionnaire (start with 25 questions, expand later), COI policy, induction content for the highest-risk site.

Days 31–60 — Pilot. Highest-risk site live: digital prequal for top 20 contractors by spend, COI upload with auto-expiry, digital induction with badge issuance, mobile check-in.

Days 61–90 — Scale. Remaining sites on the same template. Scorecard launch. Monthly programme review with procurement and ops.

Enterprise rollout

Add: ERP integration design (month 2), access control hardware procurement (months 2–4), multi-country localisation (months 3–6), works-council and union engagement (continuous).

10. KPI dashboard template

The dashboard a 2026 contractor programme should publish monthly:

• Compliant-contractor rate at site access (set your own target; for example, above 98%)
• Tier-A contractor incident rate vs internal employee baseline
• Induction completion rate per site
• COI lapse count and total lapse-days
• Permits issued to contractors / permits revoked
• Scorecard distribution by tier (red/amber/green)
• Time-to-prequal (median days from invitation to approval)

11. Worked example: tiering two contractors

This is a constructed example, not an observed case. A site has two contractors arriving next month.

The tiering decision is written down with the reason, the reviewer and the date. If the grounds firm starts work next to an energised substation, the record shows who re-tiers it.

12. What to ask a vendor

This site does not rank vendors on contractor management. The QHSE Software Capability Map 2026 groups statements about supplier or contractor access, workflow, mobile and audit trail by status, and the security, trial and offline evidence study covers attestations and trials. Then ask each shortlisted vendor to show, with your data:

1. A certificate expiring today: who is told, and what happens at the gate.
2. A subcontractor's worker added by the primary contractor, and who approves it.
3. The permit issuer's screen showing induction and competence status (see permit-to-work software).
4. What personal data about contractor workers is held, for how long, and how it is deleted.
5. A full export of contractor records on exit.

For wider guidance see the contractor safety software evaluation guide, site induction software and the glossary entry on permit to work.

13. FAQ

Do we still need a contractor network like ISN or Avetta if we have an in-house platform? That depends on what you need. The directory profiles for ISNetworld and Avetta record what each documents, and the ISNetworld vs ComplyWorks and Avetta vs ComplyWorks pages set the documented scope side by side; the alternatives to ISNetworld page lists other products to look at. A shared network can mean a contractor completes one prequalification for several buyers; an in-house system gives you control over your own criteria and records. Compare what each holds, who owns the data and what each costs for your contractor population before choosing, and ask whether your contractors already belong to a network.

How do we get contractors to actually use the mobile app? One option is to make it the only route onto site after a short parallel-run period for contractors who need help. Whatever you choose, give contractors a way to ask for assistance and record who needed it.

What about subcontractors of subcontractors? Decide how many tiers down you will track. At minimum, the contract should require the primary contractor to flow down prequalification, induction and check-in to subcontractors, and spot checks can test whether it happened.

How long do we keep contractor records after termination? Set retention from the law where the work took place, with local counsel. Limitation periods for personal-injury claims differ by jurisdiction: in England and Wales, for example, the period is generally three years from the injury or from the date the injured person knew of it (Limitation Act 1980, section 11), and entries in the record of reportable incidents, and of work injuries that keep a person off routine work for more than three consecutive days, must be kept for at least three years (RIDDOR 2013, regulation 12).

What about one-day visitors? Visitors are not contractors. Use a lightweight visitor module (sign-in, NDA, basic safety briefing, escort assignment). In our view, putting visitors through the contractor prequal adds delay without adding control, and makes the programme look like paperwork.

Can we use the same platform for both contractor safety and supplier ESG? Yes, where the platform supports it. Some platforms overlay supplier ESG/Scope-3 data on the contractor record so procurement, safety and sustainability share one source of truth. This site does not rank vendors on this; ask each shortlisted vendor to show the contractor record and the supplier ESG data in the same workflow during the demo.

Corrected 2026-09-23: an earlier version of this section named Tekmon, a commercial partner of this site, first among example platforms for this capability without disclosure or supporting evidence; the vendor examples have been removed.

---

For contractor safety platforms we have researched, see our Contractor Safety Management Software 2026 buyer's guide. Pair this playbook with our Permit-to-Work, Incident Management, Behavior-Based Safety 2026, EHS for Construction 2026 and ISO 45001 Software guides.

Research by The QHSE Standard.

Updated 21 October 2026: the OSHA, CDM, Limitation Act and RIDDOR provisions and ISO/TC 283's FAQ were re-read, a dated list of what we could not verify was added, and the certificate section links the contractor compliance record template.

Reviewed 4 October 2026: regulatory statements rechecked, unsupported claims about platforms and adoption softened, worked example and vendor questions added.

What we could not verify

• Checked 21 October 2026. OSHA's Multi-Employer Citation Policy (CPL 02-00-124, effective 10 December 1999), regulations 4 and 8 of CDM 2015, section 11 of the Limitation Act 1980 and regulation 12 of RIDDOR 2013 were re-read and match the statements above. We have not reviewed court decisions on how the multi-employer policy is applied, or the rules of OSHA state plans.
• On 21 October 2026 EUR-Lex sent our requests for Directive (EU) 2026/470 to its Official Journal home page, so the CSRD scope thresholds, the directive's entry-into-force and transposition dates, its value-chain cap and the ESRS S1 references rest on our reading of 4 October 2026. Check them against the Official Journal before relying on them.
• ISO 45001 clause 8.1.4 was read only through ISO/TC 283's public FAQ, re-read on 21 October 2026. It confirms that 8.1.4.2 and 8.1.4.3 both apply when part of a process is outsourced, and quotes short extracts of 8.1.4.3 and of the definitions of contractor and outsource, but not the rest of the clause; the standard is sold and we have not read it.
• The risk tiers, the 60-, 30- and 7-day certificate alerts, the 25-question starting questionnaire, annual badge expiry and the 98% compliant-at-the-gate example are our suggestions. No source we found sets them.
• Insurance cover levels, retention periods and limitation periods outside England and Wales were not checked; ask local counsel and your insurer.

Sources

• OSHA, Multi-Employer Citation Policy, CPL 02-00-124 (effective 10 December 1999).
• Health and Safety at Work etc. Act 1974, section 3.
• The Construction (Design and Management) Regulations 2015, regulation 4 and regulation 8.
• ISO, ISO 45001:2018, and ISO/TC 283, ISO 45001 FAQ on clause 8.1.4.
• Directive (EU) 2026/470, amending the CSRD scope.
• Commission Delegated Regulation (EU) 2023/2772, ESRS S1, Disclosure Requirement S1-14, and Commission Delegated Regulation (EU) 2026/1563, revised ESRS S1, Disclosure Requirement S1-13.
• Limitation Act 1980, section 11.
• The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013, regulation 12.

Corrected 23 September 2026: statistics without a primary source were sourced, labelled as examples or removed, and the regulations cited now link to their official texts. The descriptions of OSHA's Multi-Employer Citation Policy, ISO 45001 clause 8.1.4 and the CSRD's contractor-safety reporting now match those texts, and an unsourced claim about insurers' requirements was removed.