What this is
What is an approved contractor list?
What is an approved contractor list?
It is the register of contractors who have been through approval and may currently be engaged, with the tier, categories, approval reference and expiry that make each row checkable. It is master data rather than an event record: built once, amended whenever an approval changes, reviewed on a stated cycle. Its value is in being the single place two people look before anyone starts.
How is the list different from the vendor register?
The Vendor and Contractor Register holds everyone the business buys from, including firms that will never set foot on site. The approved list is the subset holding a live approval to work here, with the expiry and assurance state attached. The register is a commercial record and the list is a safety control, which is why the list carries the Approval ID and the register does not.
What does being on the approved list actually permit?
Engagement, and nothing more. A row says this company has been assessed, is insured, holds current clearances and may be given work in these broad categories. What they may do, where and under what supervision belongs in the Contractor Scope Record; authorisation for a job on a shift belongs in the access authorisation and the permit. Read as a permission, the list overstates itself in the direction that hurts.
Scope
When is an approved contractor list required?
This is master data. It answers a single question, whether a contractor may be engaged, and every neighbouring record answers a different one. Collapsing them into the list is tempting because the list is what people actually open, and it is how a register becomes a licence.
Use this template when
- A contractor programme is being set up and one authoritative answer is needed to who may be engaged
- Security or reception needs a single check before issuing a contractor pass
- Procurement needs a check before raising an order or a call-off against a term arrangement
- A periodic review of approvals, insurance and clearances is due and the exceptions need counting
- A group needs one register across sites, so an approval or suspension at one site is visible at the others
Do not use it for
- Approving the contractor in the first place, which is the Contractor Approval Record (CON-004) resting on prequalification, statistics, insurance and references
- Recording what a contractor may and may not do, which is the Contractor Scope Record (CON-034); the categories column here is a filter, not a permission
- Removing or stopping a contractor after a failure, which is the Contractor Suspension Record (CON-035); the list carries the consequence, not the decision
- Judging how a contractor performed, which is the Contractor Performance Scorecard (CON-014) and Contractor Final Evaluation (CON-032); the list holds the last rating, never the argument behind it
- Holding every supplier the business buys from, which is the Vendor and Contractor Register (FDN-005); this list is the subset cleared to work on site
Compliance mapping
Which ISO 45001 cl.8.1.4 requirements does this satisfy?
Standards ask for the control rather than the artefact: procurement of services governed by defined criteria, external providers selected and monitored against those criteria, and the resulting information identified, reviewed and available where it is used. A maintained approved list is the ordinary way all three are evidenced at once.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001 cl.8.1.4.1 | Process to control the procurement of products and services so they conform to the OH&S management system | Header |
| ISO 45001 cl.7.5.2 | Documented information created and updated with appropriate identification, reviewed and approved for suitability | Header |
| ISO 45001 cl.8.1.4.2 | Coordination with contractors and OH&S criteria applied to selection and continued engagement | Contractors |
| ISO 9001 cl.8.4.1 | Criteria for the evaluation, selection, monitoring and re-evaluation of external providers, with results retained | Contractors |
| BRCGS Issue 9 cl.3.5.3 | Documented procedure for approving and monitoring suppliers of services, with an up-to-date list of approved providers | Contractors |
| OSHA 29 CFR 1910.119(h)(2) | Host duty to obtain and evaluate a contract employer's safety performance and programmes before engagement on covered processes | Contractors |
| ISO 45001 cl.7.5.3 | Documented information available and suitable for use where and when it is needed, and adequately protected | List health |
| BRCGS Issue 9 cl.4.2 | Site security and food defence: only authorised personnel have access to production and storage areas | List health |
What it does not cover
- Contractor Approval Record (CON-004), which holds the decision and the evidence behind a row; the list carries the Approval ID because it points at that record rather than replacing it.
- Contractor Scope Record (CON-034), which states approved categories, areas, high-risk activities and exclusions; a category column and a restrictions field cannot carry a permission.
- Insurance Certificate Record (CON-020) and Insurance Expiry Review (CON-023), which hold the certificates, limits and endorsements; Insurance Current is a flag, and a flag is not cover.
- Workers Compensation Clearance (CON-021), the clearance letter the jurisdiction issued, with its reference and date; Clearance Current summarises it and cannot be produced in its place.
- Site Access Authorization (CON-013) and the permit to work, which authorise these people, this task, this shift; a live row is a precondition for both, never an authorisation.
Global
Approved Contractor List requirements by country
Nowhere is a document called an approved contractor list mandatory. What several regimes do make mandatory is that you evaluated a contractor before engaging them and can show it, which in practice means a register or a very good memory.
OSH Act 5(a)(1); 29 CFR 1910.119(h)(2); Multi-Employer Citation Policy CPL 02-00-124
Host employers must obtain and evaluate contract employer safety performance before engagement on covered processes, and controlling employers are cited for hazards they could have prevented.
On a site with an ammonia or other covered process, engaging a contractor with no prior evaluation is a citable gap in itself, whether or not anything went wrong.
CDM 2015 reg.8; MHSWR 1999 reg.11; HSWA 1974 s.3
Appointments are limited to those with the skills, knowledge, experience and organisational capability for the work, and employers sharing a workplace must co-operate.
The appointment duty is scoped to the work, so a register holding tier and expiry but nothing about capability for particular work meets only half of reg.8.
Framework Directive 89/391/EEC art.6(4); Directive 2014/24/EU arts.57 and 58
Employers must co-operate where undertakings share a workplace, and public bodies apply documented selection criteria and may exclude for deficient prior performance.
Member states differ on retention and format rather than on the duty, and on publicly funded sites the register is what makes a selection reviewable.
Provincial OHS statutes with prime contractor regimes; the due diligence standard
Owners, constructors and employers each carry duties, and due diligence is judged on what was known before the engagement and what was done.
A dated register with the evidence one step behind each row is the standard due diligence artefact, and its gaps read as knowledge the employer avoided.
Model WHS Act s.19 and s.46
A PCBU owes duties to workers whose activities it influences or directs, and duty holders must consult, co-operate and co-ordinate.
Engaging a contractor is an exercise of influence, so the register is how a PCBU shows it engaged on a basis rather than on familiarity.
ISO 45001 cl.8.1.4 with ISO 9001 cl.8.4.1 and BRCGS Issue 9 cl.3.5.3
Procurement of services governed by criteria, external providers monitored and re-evaluated, and an up-to-date list of approved service providers maintained.
Food and quality auditors ask for the list first and then for the evidence behind one row, so the register is the entry point into the whole programme.
How to complete it
How to complete an approved contractor list, step by step
This list is easy to build and hard to keep true, and nothing in the form tells you when it has stopped being true. Four judgements decide whether it will be trusted at a gatehouse.
Approval ID, Approved Until, Insurance Current, Clearance Current, Last Scorecard Rating and the audit dates already exist in the approval, insurance, clearance, scorecard and audit records. Every one stored as a second copy here will diverge from its source, usually within a quarter and always without warning. Link them where the platform allows; where a manual copy is unavoidable, the review interval is doing the work of the link and must be short enough to catch a lapse before the gate does.
The Status field inside the repeating Contractors section ships with the generic record workflow values, which describe the progress of a form rather than the standing of a contractor. A gatehouse needs a different vocabulary: active, conditional, suspended, expired, removed. List health also counts Suspended Contractors while nothing on the row can express suspension. Reconfigure that option set first, because a row reading In progress or Closed will be read at speed and read wrongly.
Expired Approvals Still Listed, Insurance Lapsed and Contractors Used Without Approval are the three numbers worth anything here, and all three read zero on any list nobody has reconciled. Take the gate log and the purchase order extract for the period and match them against the rows; that reconciliation is the exercise, and its numbers are the only honest measure of the register's authority.
There will be a burst main at three in the morning and somebody will ring a firm they trust. The form asks whether an emergency engagement process is defined because the alternative to defining one is not compliance, it is an unrecorded engagement signed in as a visitor. Name the checks that fit in ten minutes, insurance evidence, a short induction, escorted access, a named authoriser, and a retrospective approval deadline, and publish that route beside the list.
What auditors find
Most common approved contractor list findings
Findings here come from comparing the list with something else: the gate log, the purchase ledger, the certificate file, or the same list at the site next door. Read on its own, an approved list almost always looks well kept.
| Finding | Clause | What fixes it |
|---|---|---|
| Contractor on site and working with no row on the list; the order was raised against a familiar name. | ISO 45001 cl.8.1.4.2 | Make the list check a condition of raising the order, and reconcile gate sign-ins monthly. |
| Rows whose Approved Until date has passed still presented as approved. | ISO 9001 cl.8.4.1 | Expire the row on the date and require a renewal record to restore it, rather than a manual edit. |
| Insurance Current shows Yes while the certificate held on file expired months earlier. | ISO 45001 cl.8.1.4.1 | Drive the flag from the certificate record's expiry; never let it be set by hand on the list. |
| Security issues contractor passes from reception's own spreadsheet rather than from this list. | BRCGS Issue 9 cl.4.2 | Retire the local copy and make this register the only source for issuing a pass. |
| Contractor suspended at one site remains approved on another site's list within the same group. | ISO 45001 cl.7.4 | Hold one group register with a site column, so a single decision changes every site's answer. |
| Work Categories Approved recorded with no scope record behind the row, so categories read as permissions. | ISO 45001 cl.8.1.4.2 | Hold a scope record per contractor per site and surface it wherever the row appears. |
| Last Reviewed more than a year old, with Next Review Due already in the past. | ISO 45001 cl.7.5.2 | Set the interval by the shortest expiry tracked, and raise the review as a task, not a date. |
| Contractors Used Without Approval recorded as zero with no reconciliation carried out. | ISO 9001 cl.8.4.1 | Evidence the gate log and purchase order comparison before that field can be answered. |
| Action Required set to Yes with no CAPA reference, no priority and no owner. | ISO 45001 cl.10.2 | Raise the corrective action first and enter its reference; a flagged exception with no owner is a closed one. |
| List held as a spreadsheet on one buyer's drive, unavailable to the gatehouse out of hours. | ISO 45001 cl.7.5.3 | Publish it where the check happens; availability at the gate is part of the control. |
Case in point
Case in point: the register that was immaculate and the drain that was not
A three-site ready-meals group kept a genuinely good approved contractor list. Reviewed quarterly by a buyer who cared, expiries current, insurance and clearance flags accurate, two signatures on every revision. At four on a Sunday morning a wash-down bay drain backed up and the shift manager rang a local drainage firm he had used at a previous employer. They arrived within the hour, were signed in at the gate under visitors because there was no row to check them against, jetted the drain, wrote nothing down, and left before the day shift.
Six weeks later a customer audit asked a question nobody had asked before: match the contractor sign-ins in the gate log to the approved list. Eleven engagements in twelve months had no matching row, four of them in open product areas. One was a refrigeration engineer who had attended a chiller alarm and worked alone in a chill store overnight. None appeared in Contractors Used Without Approval, recorded as zero at each quarterly review, honestly, because nobody had ever compared the two lists.
The register was not the problem and improving it would have changed nothing. What the site lacked was a defined route for the four in the morning problem, and a gatehouse category that could not be used to route around the list. The corrective actions were narrow: an emergency engagement route with four checks and a seventy-two hour retrospective approval deadline, removal of the visitor category for anyone arriving to work, and a monthly gate-log reconciliation that produced the honest number instead of the comfortable one.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
3 sections
- Reference
- CON-033
- Archetype
- Register
- Record ID
- ACL-2026-000
- Scoring
- Not scored
- Direction
- n/a
- Singleton
- No
- Basis
- ISO 45001 cl.8.1.4
- Links
- Links Vendor
- Tags
- Contractor, Master data
- Sections
- 3
- Fields
- 41
- Follow up fields
- 3
- Repeating sections
- 1
- Links out
- 4
Header
8 fieldsList ID*
Auto sequence. Format ACL-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Activenot scored
- Conditionalnot scored
- Suspendednot scored
- Expirednot scored
- Removednot scored
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Last Reviewed*
Reviewed By*
Next Review Due*
One List, Checked At The Gate
This is the list security checks before issuing a pass and procurement checks before raising an order. If those two checks do not happen, the list is decorative.
Contractors
Repeats14 fieldsContractor*
Vendor ID*
Format VEN-0000.
Links to FDN-005 Vendor ID
Work Categories Approved*
Risk Tier*
- Low3 pts
- Medium2 pts
- High1 pt
- Very high0 pts
Contract Owner*
Approval ID*
Links to CON-004 Approval ID
Approved Until*
Status*
- Activenot scored
- Conditionalnot scored
- Suspendednot scored
- Expirednot scored
- Removednot scored
Insurance Current*
- Yes3 pts
- Expiring1 pt
- Lapsed0 pts
Clearance Current*
- Yes3 pts
- Expiring1 pt
- Expired0 pts
Last Scorecard Rating
- Excellent4 pts
- Good3 pts
- Acceptable2 pts
- Poor0 pts
Last Audit Date
Next Audit Due
Conditions Or Restrictions
List health
19 fieldsContractors On List*
Currently Active*
Approvals Expiring Within 90 Days*
Expired Approvals Still Listed*
Insurance Lapsed*
Suspended Contractors
Contractors Used Without Approval*
The finding that matters. Usually an urgent breakdown where somebody called their usual firm.
Emergency Engagement Process Defined*
There will be emergencies. Define a fast route with minimum checks rather than pretending it never happens.
- Yes3 pts
- Informal1 pt
- None0 pts
Security Checks This List*
- Yes3 pts
- Sometimes1 pt
- No0 pts
Procurement Checks This List*
- Yes3 pts
- Sometimes1 pt
- No0 pts
List Accessible To Those Who Need It*
- Yes3 pts
- Partly1 pt
- No0 pts
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Contract Owner*
Signature*
Procurement*
Second Signature*
CON-033 · record IDs look like ACL-2026-000 · Links Vendor
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The register is rarely wrong on the day it is reviewed. What fails is everything around it: the certificate that expired between reviews, the order raised without a check, the gate category that lets work in as a visit, and the site next door that never heard about the suspension.
Holds the list as a view over the approval, insurance, clearance, scorecard and scope records, so a row cannot read approved once the evidence behind it has lapsed.
Puts the check where the decision happens, at the gate and the permit desk, so no pass or permit is issued to a contractor without a live row and a scope behind it.
Keeps the register and its review history in the form a customer or certification auditor asks for, with the evidence behind any row one step away.
Watches approaching expiries, lapsed insurance and gate sign-ins with no matching row, raising the exception in the week it happens rather than at the next audit.
This template lives in KnowContractor — contractor management. Prequalification, approval, induction, permits and performance.
Meet KnowContractor→Glossary
Approved Contractor List definitions and key terms
- Approved contractor list
- The standing register of contractors who may currently be engaged, with tier, categories, approval reference and expiry, checked before a pass or an order.
- Vendor and contractor register
- The wider commercial record of everyone the business buys from, of which the approved list is the subset cleared for site work.
- Approval expiry
- The date an approval lapses, after which the row is not a stale entry but a positive statement that engagement is no longer permitted.
- Risk tier
- The classification that sets how much assurance a contractor needs, driven by the work they do rather than the size of the firm, and which sets review frequency.
- Work category
- The broad trade grouping a contractor is approved within, describing what they sell; a filter for engagement rather than permission to perform any particular task.
- Workers compensation clearance
- The jurisdiction's confirmation that a contractor's cover and contributions are current, which lapses on its own timetable, independently of approval.
- Emergency engagement
- A defined fast route with a reduced but explicit set of checks and a retrospective approval deadline, so urgent work does not bypass the register.
- Unapproved engagement
- Work carried out by a contractor with no live row on the register, normally found by reconciling gate logs or purchase orders, not by anyone reporting it.
FAQ
Frequently asked questions about approved contractor list
Is the approved contractor list the same as the vendor register?+
No, and merging them is a common and costly simplification. The vendor register is commercial and includes suppliers who will never attend site; the approved list is a safety control over a smaller population, with expiries, tiers and assurance flags. Keep the list as a view over the register, linked by Vendor ID.
How often should the list be reviewed?+
Quarterly if the rows are typed, continuously if they are derived. The right interval is set by the shortest thing the list tracks, usually an insurance certificate or a clearance letter, and an annual review of a register holding twelve-month insurance dates guarantees a window in which the list is confidently wrong.
Can a contractor stay on the list with no current work?+
Yes, and pruning them is a mistake sites regret. Approval and engagement are different states, and the dormant approved contractor is the alternative supplier you need on the day the incumbent is suspended. Keep them, keep their assurance current, and let the risk tier decide how much a dormant row is worth.
What do we do about genuine emergencies?+
Build the route rather than the prohibition. Define the checks that fit in ten minutes, insist on escorted access and a named authoriser, and set a retrospective approval deadline. A policy saying all contractors must be pre-approved, offering no alternative, produces unrecorded engagements, the outcome it was written to prevent.
Should the list say what each contractor may do?+
It should show it and not hold it. The permission belongs in the Contractor Scope Record, with the areas, high-risk activities and exclusions; the list carries a short scope summary and a link, so whoever reads the row at the gate sees the boundary rather than inferring one from a category. A list with no scope on it is read as a licence, and that is how work starts outside the approval.
One list for the group or one per site?+
One for the group, with a site column and site-specific conditions on the row. Per-site lists fail the same way every time: a contractor is suspended at one plant on Friday and works at the next on Monday, because the decision changed a spreadsheet rather than a register. Where sites differ, the difference belongs in the row's conditions, not in a separate list.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Contractor Onboarding and Management
Contractor Prequalification Questionnaire
Collects a contractor's safety, insurance, training and performance information before they are approved
Contractor Safety Statistics Review
Reviews a contractor's injury rates, citations and experience modifier over recent years
Contractor Risk Classification
Classifies a contractor by the risk of the work they do, from low risk services to high risk construction
Contractor Approval Record
Records the decision to approve a contractor to work on site
Contractor Safety Program Review
Reviews the contractor's own written safety programme against your requirements
Subcontractor Declaration
Records any subcontractors a contractor intends to use
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 45001:2018 clauses 8.1.4, 7.5.2 and 7.5.3
- ISO 9001:2015 clause 8.4.1, control of externally provided processes, products and services
- OSHA 29 CFR 1910.119(h)(2), host employer responsibilities for contractors (US)
- BRCGS Food Safety Issue 9, clauses 3.5.3 suppliers of services and 4.2 site security
- Construction (Design and Management) Regulations 2015, regulation 8 (GB)
- Model WHS Act sections 19 and 46, primary duty and duty to co-ordinate (Australia)
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.