What this is
What is a contractor documentation audit?
What is a contractor documentation audit?
A contractor documentation audit is a paperwork check of whether a contractor's training certificates, equipment inspections, risk assessments, toolbox talks, health surveillance and insurance records are complete and current. It samples or reviews named records rather than observing the work in progress.
Who should carry out a documentation audit?
The contract owner, since they hold the commercial relationship and the authority to act on what the records show, including suspending approval where documentation is inadequate. It does not need to be the person who watches the work; the two audits use different evidence.
How is a documentation audit different from a site safety audit?
A documentation audit is a records check: do the certificates and permits exist, are they current, do they match what is claimed. A site safety audit is a physical check of conditions and behaviour on the day. A contractor can pass one and fail the other, and the gap between the two is itself informative.
Scope
When is a contractor documentation audit required?
This audit is one step in a larger programme, and its boundary with the site safety audit is the one crossed most often. A clean documentation file does not tell you what is happening on the job today, and a good day on site does not tell you the paperwork behind it is real.
Use this template when
- The annual documentation cycle for a significant contractor is due
- A site safety audit or incident has raised a question about whether the contractor's training or insurance is actually current
- Approval renewal depends on documentation being confirmed complete and current
- You are targeting a specific record type after a prior finding, rather than running a full file review
- A linked record needs this one to exist: links vendor; feeds finding
Do not use it for
- Contractor Site Safety Audit, which is the physical, on-the-ground check of a contractor's work against their method statement and your requirements
- Contractor Equipment Verification, which checks that equipment brought on site is inspected, certified and fit for use
- Subcontractor Verification Audit, which checks that subcontractors have been vetted to the same standard as the main contractor
- Contractor Performance Scorecard, which rolls documentation and site results into an overall rating, rather than testing the records themselves
- Anything outside KnowContractor, which belongs in the workspace that owns that process
Compliance mapping
Which ISO 19011 requirements does this satisfy?
ISO 19011 governs how the audit itself is planned and conducted; the substance of what must be documented sits with the training, competence and insurance obligations named in each jurisdiction's own contractor and construction rules.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 19011 cl.6.3 | Preparing audit activities: fixing whether the audit is a full file review, a sample, or targeted at a specific gap before it starts | Header |
| ISO 19011 cl.6.4.7 | Collecting and verifying information by requesting and examining specific records rather than accepting a summary | Records checked |
| HSE CDM 2015 reg.8 | Duty holders must satisfy themselves that anyone appointed has the skills, knowledge, training and experience for the role | Specific checks |
| OSHA training documentation requirements (e.g. 29 CFR 1910.147, 1926.503) | Certain standards require documented, dated training or certification specific to the individual and the task | Specific checks |
| ISO 19011 cl.6.4.8 | Generating audit findings by evaluating evidence against the audit criteria, including discrepancies between records and observation | Findings |
| ISO 19011 cl.6.6 | Completing the audit, including retaining and cross-referencing records from related audits of the same contractor | Related records |
| ISO 19011 cl.6.7 | Conducting audit follow-up to confirm agreed actions on documentation gaps were completed | Result |
What it does not cover
- Contractor Site Safety Audit, which is the physical check of whether the crew is working to their method statement and permit on the day, and is not answered by a records review.
- Contractor Equipment Verification, which physically inspects the equipment itself for tags, certification and fitness for use, not just the paperwork describing it.
- Contractor Prequalification Questionnaire, which is the initial evidence gathered before a contractor is approved, not the ongoing check that it remains current.
- Insurance Adequacy Review, which assesses whether the level of cover is sufficient for the work, distinct from this audit's check that a certificate is present and current.
- Formal investigation of an unreported incident found in a contractor's own records, which needs its own record and a review of why the reporting obligation was not met.
Global
Contractor Documentation Audit requirements by country
Every jurisdiction expects a host to have some basis for believing a contractor is competent and adequately covered. Where they differ is which specific records that expectation forces into writing.
OSHA standard-specific training and certification requirements
General training is not centrally mandated to be documented, but individual standards such as permit-required confined space entry, lockout/tagout and fall protection require documented, verifiable training.
This audit is where a host discovers whether a contractor actually holds the specific certifications its work requires, rather than a general safety orientation that does not cover them.
Construction (Design and Management) Regulations 2015, regulation 8
Duty holders must be satisfied that anyone they appoint has the skills, knowledge, training and, where relevant to health and safety, physical and psychological capability.
Sampling training records is the direct evidence that this satisfaction was actually tested rather than assumed from a contractor's own assurance.
ISO 19011
Defines sampling, evidence verification and audit follow-up as distinct steps in a properly conducted audit.
A documentation audit that skips verification against site reality, or skips the follow-up on a prior gap, is procedurally incomplete even where every record it checked was genuine.
How to complete it
How to complete a contractor documentation audit, step by step
The template prompts for what to request. It does not prompt for the scepticism that decides whether what was produced is real.
A training matrix or a compliance summary is the contractor's own claim about itself. Requesting five specific, named certificates and checking them against the individual is what actually tests whether the claim holds, and the template's own guidance says so directly.
Records that are complete and current but were clearly all produced together, same ink, same handwriting pressure, same date, are evidence of a file built for the audit rather than maintained through the year. Contemporaneous is a separate question from complete, and both need answering.
A training record for someone who left the contractor months ago, or an equipment record for a machine that was swapped out, is a documentation gap even though the paper itself is in order. The check that the records match who and what is currently working is where most immaculate-looking files fail.
Finding an incident in the contractor's own records that was never reported to you is a breach of the reporting obligation itself, and it should be scored and escalated as that, not folded into a general documentation weakness alongside a missing certificate.
What auditors find
Most common contractor documentation audit findings
The findings below are the ones that recur once records are actually sampled and cross-checked, rather than accepted as a complete file.
| Finding | Clause | What fixes it |
|---|---|---|
| Requested records produced slowly, or only partially, after being requested. | ISO 19011 cl.6.4.7 | Note the delay as a finding in its own right; a contractor holding genuine, organised records can usually produce them within the hour. |
| Records appear to have been created together shortly before the audit rather than maintained over time. | ISO 19011 cl.6.4.8 | Raise a finding on record integrity separately from completeness, and widen the sample to test whether it is isolated or systemic. |
| Training records do not match the workers actually present on site. | HSE CDM 2015 reg.8 | Require the contractor to produce current, individual-matched training evidence before the mismatch is closed; do not accept the file as sufficient on its own. |
| Insurance certificate has expired or is expiring during the current contract period. | OSHA training documentation requirements (e.g. 29 CFR 1910.147, 1926.503) | Suspend or condition approval until a current certificate is produced; treat an expiring certificate as due now, not at renewal. |
| Contractor's own incident records contain an event never reported to the host. | ISO 19011 cl.6.4.8 | Escalate as a reporting breach, not a documentation gap; review the contractor's reporting obligation and whether other events have gone unreported. |
| Contractor does not carry out its own internal audits of its crews or equipment. | ISO 19011 cl.6.6 | Record as a systemic control gap; a contractor with no internal check of its own is relying entirely on the host's audit to catch problems. |
Case in point
Case in point: the file that was complete and wrong
A dairy site's annual documentation audit of its refrigeration contractor was a full file review: training certificates for six named engineers, equipment inspection records, a current insurance certificate, and toolbox talk registers going back a year. Every record requested was produced within minutes, all complete and all current. The audit passed and the contractor's approval was renewed without conditions.
A site safety audit run on the same contractor five months later, on a different job, found only two of the six trained engineers still working for the contractor; the other four had left. The training file the documentation audit had reviewed was accurate for the roster as it stood a year earlier, and nobody had checked whether it still matched the crew actually on site. The documentation had never been wrong; it had simply stopped being current, and the annual cycle alone had no way to notice between visits.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
6 sections
- Reference
- CON-026
- Archetype
- Audit
- Record ID
- AUD-2026-000
- Scoring
- Compliance percent
- Direction
- High is good
- Singleton
- No
- Basis
- ISO 19011
- Links
- Links Vendor; feeds Finding
- Tags
- Contractor, Audit
- Sections
- 6
- Fields
- 51
- Follow up fields
- 9
- Repeating sections
- 2
- Links out
- 5
Header
12 fieldsAudit ID*
Auto sequence. Format AUD-2026-00000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Contractor*
Vendor ID*
Format VEN-0000.
Links to FDN-005 Vendor ID
Auditor*
Audit Basis*
Sample of records, full file review, or targeted after a finding.
- Full file review3 pts
- Sample of records3 pts
- Targeted3 pts
Records Sampled*
Sample, Do Not Accept A Summary
Ask for five specific records and check them. A contractor who cannot produce five training certificates within an hour probably does not hold them.
Records checked
Repeats9 fieldsRecord Type*
Training certificate, equipment inspection, risk assessment, toolbox talk, health surveillance or insurance.
Number Requested*
Number Produced*
Produced Within Reasonable Time*
- Yes3 pts
- Slow1 pt
- No0 pts
Records Complete*
- Yes3 pts
- Partly1 pt
- No0 pts
Records Current*
- Yes3 pts
- Some out of date1 pt
- No0 pts
Records Contemporaneous*
Records all signed in the same pen on the same day usually means they were created for the audit.
- Yes3 pts
- Doubtful1 pt
- Clearly not0 pts
Match What We Observed On Site*
- Yes3 pts
- Partly1 pt
- No0 pts
Discrepancy Detail
Specific checks
6 fieldsTraining Records Match Workers On Site*
- Yes3 pts
- Partly1 pt
- No0 pts
Equipment Records Match Equipment Present*
- Yes3 pts
- Partly1 pt
- No0 pts
Insurance Certificates Current*
- Yes3 pts
- Expiring1 pt
- Expired0 pts
Their Own Audits Carried Out*
- Yes3 pts
- Occasionally1 pt
- No0 pts
Their Incident Records Reviewed*
- Yes3 pts
- No0 pts
Incidents Not Reported To Us Found*
Finding an unreported incident on their records is a serious breach of the reporting obligation.
- None3 pts
- Yes0 pts
Findings
Repeats7 fieldsResult*
- Pass3 pts
- Pass with conditions2 pts
- Fail0 pts
Severity
- Minor3 pts
- Moderate1 pt
- Serious0 pts
Element Tag
Groups deficiencies by hazard type across every template.
Deficiency Detail
Photo Evidence
Fixed On The Spot
Finding ID
Raise a finding record where this needs tracking to closure.
Links to FDN-015 Finding ID
Related records
1 fieldSite Audit ID
The site audit carried out alongside this.
Links to CON-025 Audit ID
Result
16 fieldsItems Assessed*
Excludes anything marked N/A.
Items Failed*
Score Percent*
Calculated on submission. High is good. N/A items leave the denominator.
Result Band*
- Pass3 pts
- Caution1 pt
- Fail0 pts
Completeness Percent*
How much of the template was actually answered. A high score on a half completed form is not a high score.
Documentation Adequate*
- Yes3 pts
- Partly1 pt
- No0 pts
Approval Status Affected*
- No3 pts
- Conditions applied1 pt
- Suspended0 pts
Follow Up Audit Required*
- No3 pts
- Yes1 pt
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Auditor*
Signature*
Contract Owner*
Second Signature*
CON-026 · record IDs look like AUD-2026-000 · Links Vendor; feeds Finding
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The audit produces a snapshot. What decides whether it stays true is whether a change in the contractor's crew or cover reaches the record before the next annual cycle does.
Holds the documentation audit against the contractor's approval status, and links a suspension or condition straight to the vendor record.
Cross-checks the training records sampled here against who is actually inducted and working on site, closing the gap this audit alone cannot see between visits.
Tracks insurance and certification expiry dates flagged in this audit and raises the renewal before the certificate lapses rather than at the next annual cycle.
Flags where a documentation audit passed cleanly but a later site safety audit on the same contractor found a mismatch, so the gap between paper and practice is visible.
This template lives in KnowContractor — contractor management. Prequalification, approval, induction, permits and performance.
Meet KnowContractor→Glossary
Contractor Documentation Audit definitions and key terms
- Full file review
- An audit basis in which every record of a given type is examined, rather than a sample, typically used for a smaller or higher-risk contractor.
- Contemporaneous record
- A record created at or close to the time of the event it describes, as opposed to one reconstructed afterwards from memory or convenience.
- Compliance percent
- The scored outcome of this template: the proportion of sampled or reviewed records found complete, current and consistent with site reality.
- Approval status affected
- The field recording whether a documentation finding changes the contractor's standing: unaffected, conditions applied, or suspended.
- Records sampled
- The number of specific, named records actually requested and checked in this audit, as distinct from the number the contractor claims to hold.
FAQ
Frequently asked questions about contractor documentation audit
How many records should be sampled?+
Enough to be a genuine test, not a token gesture. The template's own guidance suggests five specific records as a working minimum: enough that a contractor cannot simply have prepared exactly the ones you ask for, and few enough to check properly within the visit.
What if the contractor cannot produce a requested record on the day?+
Treat that as the finding itself rather than granting an extension by default. A contractor with genuinely current records can usually locate a named certificate within the hour; a long delay is itself evidence about how the records are actually kept.
Why does it matter if records were all signed on the same day?+
Because it suggests the file was assembled for the audit rather than maintained as the work happened. A toolbox talk register with a year of entries in identical ink and handwriting is a stronger signal of a reconstructed file than of a genuinely maintained one.
Should this replace the site safety audit?+
No. A documentation audit tells you whether the paperwork is complete and current; it does not tell you whether the crew on site today is working safely. The two are complementary, and a contractor can pass one while failing the other.
What happens if the audit finds an unreported incident?+
It is treated as more serious than a missing certificate, because it points to a breach of the contractor's obligation to report, not just a filing gap. It should be escalated and reviewed for whether other incidents have similarly gone unreported.
How often should this audit run?+
Yearly per significant contractor as a baseline, brought forward whenever a finding elsewhere, an incident, or a renewal decision creates a specific reason to check documentation sooner than the annual cycle would.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Contractor Onboarding and Management
Contractor Prequalification Questionnaire
Collects a contractor's safety, insurance, training and performance information before they are approved
Contractor Safety Statistics Review
Reviews a contractor's injury rates, citations and experience modifier over recent years
Contractor Risk Classification
Classifies a contractor by the risk of the work they do, from low risk services to high risk construction
Contractor Approval Record
Records the decision to approve a contractor to work on site
Contractor Safety Program Review
Reviews the contractor's own written safety programme against your requirements
Subcontractor Declaration
Records any subcontractors a contractor intends to use
More in Contractor Audits
Contractor Site Safety Audit
Audits a contractor's work on your site against their method statement and your requirements
Contractor Equipment Verification
Checks that contractor equipment brought on site is inspected, certified and fit for use
Subcontractor Verification Audit
Checks that subcontractors have been vetted to the same standard as the main contractor
Contractor Audit Follow Up
Checks whether a contractor has closed the actions raised in a previous audit
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 19011:2018 — Auditing management systems, clause 6
- Construction (Design and Management) Regulations 2015, regulation 8 (UK)
- OSHA standard-specific training documentation requirements, e.g. 29 CFR 1910.147 and 1926.503
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.