Summary
In short
- Approving the company and admitting the person are different processes with different evidence. Insurance and accreditation belong to an organisation; induction and competence belong to individuals.
- OSHA's multi-employer citation policy allows a controlling employer to be cited for hazards affecting another employer's workers, and the defence turns on reasonable care.
- Reasonable care is evidenced by periodic inspections, a system for correcting hazards, and enforcing compliance, which is an activity record rather than a documentation exercise.
- Two-way hazard information exchange is explicitly required in several standards, and the direction from the contractor to the site is the one usually missing.
- Subcontracting is the gap that defeats most onboarding. A verified contractor supplying labour through an agency introduces people the process never examined.
- The check on the day is what the whole arrangement depends on, and it degrades with familiarity faster than anything else.
What it is
What it is
What is contractor onboarding?
The process of approving a contractor organisation to work on site and preparing for their people to arrive: verifying competence and documentation, exchanging hazard information in both directions, and completing induction and site-specific briefing before work begins.
What is the controlling employer concept?
Under OSHA's multi-employer citation policy, an employer with general supervisory authority over a worksite can be cited for hazards affecting other employers' workers, based on whether it exercised reasonable care through periodic inspections and a system for correcting hazards. Every US circuit has now recognised that authority.
When to use it
When to use it, and when not to
This covers approval and first arrival. The permit and the work itself sit separately.
Use it for
- Approving a contractor organisation before engagement
- Verifying insurance, competence, accreditation and safety performance
- Exchanging hazard information in both directions before work begins
- Inducting the individuals who will attend, before their first day
- Re-verification on renewal, ownership change or a change of key personnel
Not for
- The permit to work, authorising a specific activity on a specific day
- Contractor work orders, which define the work to be performed
- Site visitor arrangements, which cover people not performing work
- Procurement and commercial terms, which allocate liability rather than manage risk
- Ongoing supervision and monitoring, which follow onboarding
Standards
What it is built against
Contractor management combines coordination duties, multi-employer liability and standard-specific information exchange requirements.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001 cl.8.1.4.2 | Coordination of the procurement process with contractors to identify hazards and control risks | Before approval |
| OSHA CPL 02-00-124 | Multi-employer citation policy: creating, exposing, correcting and controlling employer categories | Header |
| 29 CFR 1910.147(f)(2) | Energy control information exchange between host and contract employers | Before first day |
| 29 CFR 1910.146(c)(8) | Confined space information exchange in both directions | Before first day |
| 29 CFR 1910.119(h) | Process safety management contractor obligations for host and contract employers | Documents |
| ISO 45001 cl.7.4 | Communication with persons who are not workers but are affected by the organisation's activities | Before first day |
| CDM Regulations 2015 | Duties on clients, principal designers and principal contractors for construction work (GB) | Before approval |
| ISO 45001 cl.9.1 | Monitoring and measurement, including contractor performance evaluation | Result |
What it does not cover
- The permit to work, authorising a specific activity on a specific day.
- Contractor work orders, defining the work to be performed.
- Visitor arrangements, covering people who are not performing work.
- Commercial terms and indemnities, allocating liability without reducing risk.
- Ongoing supervision, which follows onboarding rather than forming part of it.
Filling it in
Filling it in well
Verify the company, exchange information both ways, and check the people at the gate.
Approve the organisation once, with insurance, accreditation, competence evidence and safety performance. Admit individuals separately, each time, with induction, task competence and confirmation that they have been briefed on your hazards. Collapsing the two produces a file about a company and no knowledge of who is on site.
Your hazards to them, and theirs to you. The second direction is required explicitly in several standards and is nearly always missing, which is how a contractor's hot work, chemical use or isolation activity introduces a hazard the site has not planned for and does not know about.
A verified contractor supplying labour through an agency introduces people no part of your process has examined. Requiring disclosure, and applying the same individual checks to subcontracted labour, closes the gap that most reliably defeats contractor management.
Where you are the controlling employer, the position depends on having exercised reasonable care: periodic inspections of the work, a system for correcting hazards found, and enforcement. That is an activity record. A thorough approval file with no evidence of anyone having looked at the work does not demonstrate it.
Audit findings
Common audit findings
Contractor findings concentrate on the individuals and on evidence of oversight.
| Finding | Clause | What fixes it |
|---|---|---|
| Company approved but attending individuals not inducted. | ISO 45001 cl.8.1.4.2 | Induction attaches to people; check at the gate, every time. |
| Subcontracting not disclosed or not subject to the same checks. | ISO 45001 cl.8.1.4 | Require disclosure; agency-supplied labour is the gap that defeats the process. |
| Hazard information exchanged in one direction only. | 1910.147(f)(2) | Both directions are required; the contractor's hazards reach your people too. |
| No periodic inspection of contractor work by the site. | OSHA CPL 02-00-124 | Reasonable care as a controlling employer is evidenced by looking, not by filing. |
| Hazards found in contractor work with no system for correction. | OSHA CPL 02-00-124 | An effective system for correcting hazards is part of the reasonable care test. |
| Competence verified at company level for task-specific work. | ISO 45001 cl.7.2 | Task competence attaches to individuals; verify for the work being performed. |
| Approval not re-verified after ownership or key personnel change. | ISO 45001 cl.8.1.4 | Capability sits with people; both are re-verification triggers. |
| Familiar contractors admitted without the check being performed. | ISO 45001 cl.8.1.4 | Familiarity is the failure mode; the van is recognised and the check is skipped. |
| Contractor incidents and near misses not captured in site reporting. | ISO 45001 cl.10.2 | They perform much of the higher-risk work; their events are the ones you need. |
| Insurance and accreditation lapsing between reviews. | ISO 45001 cl.8.1.4 | Track expiry rather than reviewing annually; cover lapses mid-cycle. |
Worked case
Case in point: the controlling employer test
OSHA's multi-employer citation policy identifies four categories: the employer who created the hazard, the one whose employees were exposed, the one responsible for correcting it, and the controlling employer with general supervisory authority over the site. Every US circuit has now recognised the agency's authority to cite on this basis.
For a site engaging contractors, the controlling employer test is the one that matters, and it does not turn on documentation. OSHA considers whether the employer conducted periodic inspections of the work, implemented an effective system for correcting hazards found, and enforced compliance by other employers on the site.
A comprehensive approval file, insurance certificates, accreditations and signed method statements, does not answer any of those three questions. They are answered by evidence that somebody went and looked.
Definitions
Definitions and key terms
- Controlling employer
- An employer with general supervisory authority over a worksite, including power to correct hazards or require correction.
- Multi-employer citation policy
- OSHA's framework under which creating, exposing, correcting and controlling employers may each be cited.
- Reasonable care
- The controlling employer defence, evidenced by periodic inspection, a correction system and enforcement.
- Information exchange
- The two-way transfer of hazard information between host and contract employers, required explicitly in several standards.
- Company approval
- Verification of an organisation's insurance, accreditation, competence and safety performance.
- Person admission
- Verification that an individual attending has been inducted and is competent for the work, performed each visit.
- Subcontracting disclosure
- Requirement that a contractor declares labour supplied by others, which the onboarding process must then examine.
- Prequalification
- Assessment of a contractor before engagement, distinct from what is verified on the day.
FAQ
Frequently asked questions
What is the difference between approving a company and admitting a person?+
Evidence and frequency. Company approval verifies insurance, accreditation, competence systems and safety performance, and is done periodically. Person admission verifies that this individual has been inducted, is competent for this task and knows your hazards, and is done every time. Contractor management systems are built for the first because organisations produce documents.
What is the controlling employer test?+
Under OSHA's multi-employer citation policy, whether an employer with general supervisory authority exercised reasonable care: periodic inspections of the work, an effective system for correcting hazards found, and enforcement of compliance by other employers. Every US circuit has recognised the authority to cite on this basis, and the test is about activity rather than documentation.
Why does the information exchange matter in both directions?+
Because the contractor's work introduces hazards to your people as well as the reverse. Hot work, chemical use, isolation, excavation and lifting all affect the surrounding site. Several standards require the exchange explicitly, and the contractor-to-site direction is the one nearly always missing from onboarding processes built around telling contractors your rules.
What defeats contractor management most often?+
Subcontracting and agency supply. A verified contractor engages labour at short notice through an agency, and people arrive whom no part of the process has examined. Requiring disclosure and applying individual checks to subcontracted labour closes it, and most systems do not ask.
Do indemnity clauses help?+
Commercially, sometimes. For regulatory liability, no. A controlling employer cited under the multi-employer policy is cited for its own failure to exercise reasonable care, and a contract allocating risk between the parties does not affect that. Periodic inspection of the work is both the better arrangement and the one that answers the question.
The agents
What the agents do with it
Onboarding approves a company and admits people. What fails is the individual nobody checked and the work nobody looked at.
Separates company approval from person admission, tracks document expiry rather than annual review, and requires subcontracting disclosure.
Runs the two-way hazard exchange and records periodic inspection of contractor work, which is the reasonable care evidence.
Holds induction and task competence per individual, including agency-supplied labour arriving at short notice.
Captures contractor incidents and near misses in site reporting, where much of the higher-risk work sits.
This template lives in KnowContractor — contractor management. Prequalification, approval, induction, permits and performance.
Sources
Sources
- OSHA multi-employer citation policy, directive CPL 02-00-124
- ISO 45001:2018 clause 8.1.4, procurement, contractors and outsourcing
- 29 CFR 1910.147(f)(2) and 1910.146(c)(8), contractor information exchange, OSHA
- 29 CFR 1910.119(h), process safety management contractors, OSHA
- Construction (Design and Management) Regulations 2015 (GB)