Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Contractor Compliance

    Also known as: Contractor safety compliance, Contractor compliance management

    Definition

    A host's checks that a contractor and its workers meet its requirements and the law before and during work, with the records of those checks.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/contractor-compliance

    Scope: It is the host's checking, not the contractor's own legal duties, which stay with the contractor. Duties differ by country and by the work.

    Example for your evaluation: Follow one contractor from prequalification through a worker's induction and a permit to a monitoring visit, with the record behind each step.

    Sources checked: . Examples are editorial illustrations.

    What OSHA, HSE and the law say about a host's duty to contractors

    On this page contractor compliance means the checks a host organisation makes that a contractor, and the people it sends, meet the host's requirements and the law before and during work, together with the records of those checks. The sources opened give no single definition, so this is a working one, covering prequalification, credentials, insurance, induction, permits, monitoring and records. It is separate from the contractor's own legal duties, which stay with the contractor. This page is general information, not legal advice, and duties differ by country and by the work.

    In Great Britain, HSE's guide Managing contractors (HSG159, second edition, 2011) says the Health and Safety at Work etc. Act 1974 requires employers to ensure, so far as is reasonably practicable, the health and safety of other people at work on their site, including contractors, and that contractors must comply with the Act too. Where employers share a workplace, it says the Management of Health and Safety at Work Regulations require each to co-operate, to take reasonable steps to co-ordinate with the others and to inform them of risks. It sets out five steps: planning, choosing a contractor, contractors working on site, keeping a check and reviewing the work. This guide predates CDM 2015. Under regulation 8 of CDM 2015 a designer or contractor must not accept an appointment unless it has the skills, knowledge, experience and, for an organisation, the organisational capability for the role, and whoever appoints must take reasonable steps to check. Under regulation 15 a contractor must plan, manage and monitor its own work, supervise and inform its workers, including a site induction unless the principal contractor provides one, and not appoint anyone to work on site who lacks, or is not obtaining, the necessary skills, knowledge, training and experience.

    In the United States, OSHA's multi-employer citation policy (CPL 02-00-124, effective 10 December 1999) says more than one employer may be cited for a hazard on a multi-employer worksite in any industry. It names creating, exposing, correcting and controlling employers. A controlling employer, one with general supervisory authority over the worksite, must exercise reasonable care to prevent and detect violations, which the directive says is less than it owes its own employees. Its questions cover the frequency of inspections, a system for correcting hazards and enforcement of compliance. Where the process safety standard applies, 29 CFR 1910.119(h) requires the host to obtain and evaluate a contractor's safety performance and programmes when selecting it, to evaluate its performance periodically and to keep a contract employee injury and illness log, and requires the contract employer to document that each of its employees received and understood the required training. Under 29 CFR 1904.31(b) an injury to a contractor's worker goes on the log of the employer that supervises that worker's day-to-day work.

    Sources opened :

    What a contractor compliance record holds in software

    • The contractor company, the sites and work it is approved for, and who approved it and when.
    • The selection answers and documents received, such as safety policy, method statements and training records, each with its reviewer and date.
    • Insurance certificates, where the host or the contract asks for them, with cover and expiry dates.
    • Each worker sent, the qualifications held with their expiry, and the induction completed for the site.
    • The job: scope, hazards, controls agreed, whether a permit applies and the named site contact.
    • Sign-in and sign-out, changes of personnel and changes to the scope of the work.
    • Monitoring visits, incidents, near misses and findings, with actions.
    • The end-of-job review and the decision to approve, restrict or remove the contractor.

    Contractor compliance, contractor management and the contractor's own duties

    Contractor management is the wider coordination of selection, access, work and performance, and contractor compliance is the part that checks requirements and keeps the evidence. A host's check does not move a duty. HSG159 says contractors must comply with the Act and supervise their own work, and regulation 15 of CDM 2015 gives a contractor its own duty to plan, manage and monitor. An accepted document shows that evidence arrived, which is not the same as the contractor being competent for this job. A company status, a worker's readiness and permission to start a particular job are three separate decisions.

    A hypothetical example: a lifting ticket that expires mid-shutdown

    Everything in this case is invented and describes no real site or company. A host plans a ten-day shutdown with 9 contractor companies and 54 workers. The record shows 51 workers with a completed induction and 3 without, which is 51 plus 3, or 54. At the pre-start review the site contact finds that one of the 3 is a rigger whose lifting qualification expires on day 4, and that an electrical contractor's method statement describes an isolation method the site does not use.

    The rigger's start is held while the contractor renews the qualification. The method statement is rejected with the reason on the record, revised and approved, and no permit is issued before then. The site contact logs two visits. When a further pipe run is added, the job goes back to planning for a fresh assessment. The end-of-job review notes the late submission and records the decision to approve the contractor again.

    Common misunderstandings about contractor compliance

    • A host's check does not transfer the contractor's duties. HSG159 says contractors must comply with the Act and supervise their own work, and CDM 2015 regulation 15 gives a contractor its own duties.
    • Hiring a contractor does not end the host's duty. HSG159 says the Act protects other people on the site, contractors included, and OSHA's policy expects a controlling employer to take reasonable care, though less than for its own employees.
    • A valid document is not a competent contractor. Regulation 8 asks for skills, knowledge, experience and organisational capability, and HSG159 says competence is not only technical qualifications or training.
    • An insurance certificate is not a safety control. None of the sources opened lists one as a duty, so whether to ask for one is for the host or its contract to decide.
    • The rules are not the same everywhere. The OSHA policy is a directive on citations, CDM 2015 covers construction projects in Great Britain, 1910.119(h) applies only where the process safety standard does, and HSG159 (2011) refers to CDM 2007.

    How contractor compliance relates to other glossary terms

    Contractor compliance sits between the duties on a project, the permit that authorises a job and the records that hold the evidence.

    • Contractor management: the wider coordination of selection, access, work and performance.
    • CDM regulations: the British construction duties, including appointments and the principal contractor's role.
    • Permit to work: the separate authorisation for a high-hazard job that a company approval does not replace.
    • Risk assessment: the assessment of the job, which the contractor's own assessment should fit with.
    • Regulatory compliance: how duties set by law differ from the evidence kept about them.

    Records and evidence that usually exist for contractor compliance

    • Selection answers and the documents received, with the reviewer's name and date.
    • Competence and training records for the workers sent, and insurance certificates where required.
    • The contractor's risk assessments or method statements, and the host's comments.
    • The site induction record, sign-in and sign-out, and the named site contact.
    • Permits issued to the contractor, with their sign-offs.
    • Monitoring notes, incident and near-miss reports, and the end-of-job review.

    What a software tool needs to capture for contractor compliance

    • Separate records for the company, each worker and the job, so one status cannot stand for the others.
    • Document review with a named reviewer, the criteria, the reason for any rejection and the resubmission history.
    • Expiry dates for credentials, with a reminder owner and a recorded decision when one lapses.
    • A route for a changed record, such as an expired qualification, to whoever controls access or issues the permit, with a stated failure path.
    • Visibility limits so that each contractor sees only its own records.
    • Incidents and findings recorded against the contractor company and the job.
    • An export of a contractor's records with their history, for an inspector or an auditor.

    Catalog profiles documenting contractor qualification or site-access records

    The list follows the rule used by the contractor management software guide. It does not show that a product holds credentials, links to a permit or connects an expired qualification to site access, which should be tested with your own contractor records.

    Same rule for every product: tagged “Contractor Management”, with a sourced contractor qualification or onboarding capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 13 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Does a host remain responsible when a contractor does the work?

    In part, according to the sources read. HSE's guide says the Health and Safety at Work etc. Act 1974 requires employers to protect other people at work on their site, including contractors, and OSHA's policy lets more than one employer be cited, with a controlling employer owing reasonable care. The contractor keeps its own duties. This is general information, not legal advice.

    Is contractor compliance the same as contractor prequalification?

    No. Prequalification is the selection check made before work. Contractor compliance, as this page uses the term, continues through induction, permits, monitoring and review, and HSE's guide treats keeping a check and reviewing the work as steps of their own.

    Which records must a host keep about contractors?

    No single list covers every country. OSHA's process safety standard requires covered employers to keep a contract employee injury and illness log, and contract employers to document training. HSG159 and regulations 8 and 15 of CDM 2015 set no such list in the pages read, though other duties, such as the construction phase plan, create records. Check the law that applies.

    More safety terms

    Related guides