What this is
What is a contractor risk classification?
What is a contractor risk classification?
A contractor risk classification is a pre-work assessment that places a specific scope of contracted work into a risk tier, and uses that tier to fix the control package applied to it. It looks at the hazards the contractor brings, the exposure they create in your operation, how often they are on site and how they are supervised, then sets prequalification depth, induction level, permit requirements, insurance level and audit frequency accordingly.
How does classification differ from a contractor performance scorecard?
Classification is forward looking and happens before work: it decides how much scrutiny the work warrants. A performance scorecard is backward looking and happens after work: it records how the contractor actually behaved over a period. One sets the gate, the other measures what came through it. A classification that is quietly rewritten to match observed performance has stopped being a classification.
Who should set the risk tier?
The contract owner, because they are the person who knows the scope and who will hold the consequences of getting it wrong. The form requires a second signature from the safety lead, and that countersignature is the point of the control. Left to procurement alone, tiers drift downward, because a lower tier means fewer documents to chase before the job can start.
Scope
When is a contractor risk classification required?
Classification sits between prequalification and approval, and its most common misuse is being treated as the whole of prequalification. It decides how much evidence to demand; it does not collect that evidence and it does not make the approval decision.
Use this template when
- A contractor is being prequalified for the first time and the depth of that prequalification has to be decided
- An approved contractor is being engaged for a scope of work materially different from the one already classified
- A scope changes mid-contract: new hazard, new area, new subcontractor, out of hours working, or entry to a production area
- An incident, violation or performance concern suggests the tier and the oversight it set were both too light
- The scheduled reassessment falls due and the previous tier needs confirming or changing on the record
Do not use it for
- Collecting the contractor's safety, insurance and training evidence, which is the Contractor Prequalification Questionnaire and follows the depth this record sets
- Deciding whether to approve the contractor at all, which is the Contractor Approval Record and is a separate signed judgement
- Assessing the hazards of the task itself, which is a task risk assessment and a Contractor Method Statement Review, not a tiering exercise
- Authorising a particular job on a particular day, which is a permit to work and a Site Access Authorization
- Judging how the contractor performed, which is the Contractor Performance Scorecard and the Contractor Site Safety Audit
Compliance mapping
Which ISO 45001 cl.8.1.4 requirements does this satisfy?
No standard mandates a risk tier for contractors. What standards and regulators do require is that the degree of control over contracted work is proportionate to its risk, which is unanswerable unless someone has decided what the risk is and written it down.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001 cl.8.1.4.2 | Coordinate procurement with contractors to identify hazards and control the OH&S risks arising from their activities | Hazard exposure |
| OSHA 1910.119(h)(2) | For PSM-covered work, obtain and evaluate information on the contract employer's safety performance and inform them of process hazards | Hazard exposure |
| ISO 45001 cl.6.1.2.1 | Hazard identification to account for people in the vicinity and for persons not directly employed, including contractors and visitors | Exposure to our operation |
| BRCGS Food Safety cl.3.5 | Risk-based procedures for the approval and monitoring of suppliers of services, including maintenance, cleaning and pest control in production areas | Exposure to our operation |
| ISO 45001 cl.8.1.4.3 | Type and degree of control over outsourced functions and processes to be defined and applied | Frequency and control |
| Model WHS Act s.46 | Duty to consult, cooperate and coordinate activities with other persons who have a duty in relation to the same matter | Frequency and control |
| ISO 45001 cl.8.1.4.1 | Procurement controls established so that products, services and processes conform to the management system requirements | Classification |
| CDM 2015 reg.8 | Appointed contractors and designers must have the skills, knowledge and experience proportionate to the work, and the client must satisfy itself of that | Header |
What it does not cover
- The prequalification itself, which is the Contractor Prequalification Questionnaire; this record only decides how deep that questionnaire has to go.
- The approval decision, which belongs in the Contractor Approval Record and remains a separate judgement even where the tier is Low.
- Task risk assessment, which must address the hazards of the specific job and its method, and is not replaced by a tier that says the work is high risk.
- Insurance verification, which needs the certificate itself checked against the required limits in the Insurance Certificate Record and Insurance Adequacy Review.
- Subcontractor control, which requires the Subcontractor Declaration and its own classification, because a tiered contractor may bring an untiered one through the gate.
Global
Contractor Risk Classification requirements by country
Every major regime holds the host or client responsible for contracted work to some degree, and none of them accept a signed contract as the discharge of that duty. What varies is how the duty is framed and how it is transferred.
OSHA Multi-Employer Citation Policy CPL 02-00-124; 29 CFR 1910.119(h); 29 CFR 1926.16
Host, controlling, correcting and creating employers can all be cited for the same exposure; PSM work carries an explicit contractor evaluation duty.
OSHA can cite the host as controlling employer for a contractor's exposure, and the classification becomes evidence of what the host knew before work started.
HSWA 1974 s.3; MHSWR 1999 reg.12; CDM 2015 reg.4 and reg.8
Duty to persons not employed, comprehensible risk information to workers of outside undertakings, and client arrangements proportionate to the project.
For construction the classification effectively decides whether CDM duty holders have to be appointed at all, so getting the tier wrong is not just an oversight failure but a missed statutory appointment.
Framework Directive 89/391/EEC Art.6(4) and Art.10(2); Construction Sites Directive 92/57/EEC
Where several undertakings share a workplace, employers must cooperate and coordinate protective measures and inform each other's workers of the risks.
National transpositions differ in formality, but the coordination duty runs both ways and cannot be satisfied by a contract clause allocating responsibility to the contractor.
Provincial OHS Acts (constructor and prime contractor duties); CSA Z1000
Naming a constructor or prime contractor transfers defined statutory duties for the project to that party.
Where no such appointment is made, the owner usually retains those duties by default, so the classification of a project's scale and risk decides who is legally in charge of it.
Model WHS Act s.19 and s.46
The primary duty extends to workers whose activities are influenced or directed by the PCBU, and duty holders must consult, cooperate and coordinate with each other.
Concurrent duties cannot be contracted away, and s.46 makes the pre-work conversation about who controls what an obligation in its own right rather than good manners.
ISO 45001 cl.8.1.4; ISO 9001 cl.8.4; SQF cl.2.3.3
Procurement and outsourcing must be controlled to a degree matched to the risk and the effect on conformity.
Certification auditors ask how the degree of control was decided, and this record is the only place in the contractor programme where that decision is visible.
How to complete it
How to complete a contractor risk classification, step by step
The hazard and exposure questions on this form answer themselves once someone has actually looked at the scope. The judgements that decide whether the classification survives an incident are the four the form cannot prompt for.
The form says this in its own guidance and it is still the most common way the record fails. One classification per vendor produces a tier that is too heavy for their routine work and too light for their occasional work, and the too-light half is the one that hurts. Raise a separate classification for each scope, and treat a new scope on an existing vendor as a new record rather than an edit to the old one.
Nine No answers and one Routinely on confined space entry is a very high risk scope, not an average one. Any method that sums or averages the drivers will bury the answer that matters, because most contracted work is unremarkable in most respects. Use the Highest Contributing Factor field to name the single answer that drove the tier, and check that the named factor and the tier are consistent before signing.
Prequalification depth, induction level, permit requirement, insurance level, audit frequency and inspection frequency are all fields here, and they are the entire point of the exercise. Filling the tier and leaving the consequences blank, or setting them to whatever the site already does, converts the classification into a description. The test is whether a Very high tier and a Low tier actually produce different behaviour at the gate.
A scheduled review is the weakest of the four triggers the form offers, because scope changes do not wait for it. Scope change, incident and performance concern are the ones that catch a wrong tier, and each needs a route into this record from the work order, the incident log and the scorecard. Recording the previous tier makes any movement visible, which is what forces a downgrade to be justified rather than assumed.
What auditors find
Most common contractor risk classification findings
Classification findings rarely concern a missing record. They concern a record that exists, is internally inconsistent, and has not been near the work it describes since the day the vendor was onboarded.
| Finding | Clause | What fixes it |
|---|---|---|
| One classification held per contractor, covering every scope of work they perform. | ISO 45001 cl.8.1.4.2 | Raise a classification per scope of work and link each engagement to the classification that covers it. |
| Tier not reassessed after the scope changed to include a new hazard or a production area. | ISO 45001 cl.8.1.3 | Route scope changes through management of change so a change raises the reassessment. |
| Tier recorded as High but induction level set to General contractor and no permit required. | ISO 45001 cl.8.1.4.1 | Derive the control package from the tier and reject records where the two contradict each other. |
| Contractor working on ammonia or PSM-covered plant classified without any evaluation of their safety performance. | OSHA 1910.119(h)(2) | Obtain and evaluate the contract employer's performance and programme evidence before signing the tier. |
| Confined space entry recorded as routine, but no host and contractor information exchange on record. | OSHA 1910.146(c)(8) | Make the permit space information exchange a mandatory output of any confined space classification. |
| Energy isolation recorded as part of the contractor's work, with no exchange of lockout and tagout procedures. | OSHA 1910.147(f)(2) | Exchange isolation procedures with the outside employer and reference the exchange on the classification. |
| Subcontractors used routinely, but no subcontractor declared, classified or verified. | ISO 45001 cl.8.1.4.3 | Require a Subcontractor Declaration before access, and classify the subcontractor's scope too. |
| Contractor routinely works in food production areas; classification addresses safety hazards only. | BRCGS Food Safety cl.3.5 | Score product exposure alongside safety and set the hygiene requirements the tier implies. |
| Audit and inspection frequencies set on the classification but no audits or inspections raised against them. | ISO 45001 cl.9.1.1 | Generate the audit and inspection schedule from the classification, not from a separate plan. |
| Classification signed by the contract owner alone; safety lead countersignature absent. | ISO 45001 cl.8.1.4.2 | Hold the record open until the second signature is present; it is the control, not a formality. |
Case in point
Case in point: the tier that was right for the wrong job
A chilled ready meals site classified its refrigeration contractor when it onboarded them. The scope was planned preventive maintenance on the ammonia plant: monthly attendance, their own supervisor always present, no confined space, no hot work, no work above open product. The contract owner set the tier at Medium, prequalification depth Standard, induction General contractor, audit frequency Quarterly, permits not required. The safety lead countersigned. On the scope as written, all of that was defensible.
Two years later the same contractor was engaged to overhaul a compressor. That work involved hot work on a pipe run above a chilled preparation area, nitrogen purging, and two nights out of hours with the site's own supervision absent. The purchase order referenced the existing vendor record, and nobody raised a new classification, because a classification belonged to the vendor and the vendor already had one. The crew presented the general contractor induction they had held for two years and started without a hot work permit, because the classification said permits were not required.
The fire was small and the burns were minor, and the investigation was not about the fire. It was about how a Medium tier from a planned maintenance scope came to govern a hot work overhaul above open product. Nothing in the record was false. The record was simply about a different job. The corrective action was not a stricter tier; it was making the classification an attribute of the scope, raised from the work order, so that a new scope on a known vendor cannot inherit the old tier by default.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
5 sections
- Reference
- CON-003
- Archetype
- Assessment
- Record ID
- CRC-2026-000
- Scoring
- Risk tier
- Direction
- High is bad
- Singleton
- No
- Basis
- ISO 45001 cl.8.1.4
- Links
- Links Vendor
- Tags
- Contractor, Risk
- Sections
- 5
- Fields
- 48
- Follow up fields
- 0
- Repeating sections
- 0
- Links out
- 3
Header
12 fieldsClassification ID*
Auto sequence. Format CRC-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Contractor*
Vendor ID*
Format VEN-0000.
Links to FDN-005 Vendor ID
Classify The Work, Not The Company
The same contractor can be low risk painting an office and very high risk entering a brine tank. Classify each scope of work separately.
Scope Of Work*
Assessed By*
Reassessment Trigger
Hazard exposure
9 fieldsWorking At Height*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Confined Space Entry*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Energy Isolation In Their Work*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Hot Work*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Lifting Operations*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Excavation*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Live Electrical Work*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Ammonia Or Refrigerant Systems*
Refrigeration contractors carry a fatality risk that is easy to underestimate because the work looks routine.
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Hazardous Substances*
- No3 pts
- Some1 pt
- Significant0 pts
Exposure to our operation
6 fieldsWorks In Food Production Areas*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Works Above Open Product*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Works On Product Contact Equipment*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Works Near Moving Machinery*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Works Alone Or Out Of Hours*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Interacts With Our Workers*
- Minimal3 pts
- Some2 pts
- Constant1 pt
Frequency and control
6 fieldsFrequency On Site*
A daily contractor is more integrated and easier to manage than one who appears twice a year.
- Daily3 pts
- Weekly2 pts
- Monthly1 pt
- Rarely0 pts
Number Of Workers Typically*
Supervised By Us Or Themselves*
- Our supervision3 pts
- Joint2 pts
- Their own0 pts
Uses Subcontractors*
- No3 pts
- Occasionally1 pt
- Routinely0 pts
Own Supervisor On Site*
- Always3 pts
- Sometimes1 pt
- Never0 pts
Consequence Of Poor Performance*
- Minor3 pts
- Moderate1 pt
- Severe0 pts
Classification
15 fieldsRisk Tier*
- Low3 pts
- Medium2 pts
- High1 pt
- Very high0 pts
Highest Contributing Factor
Previous Tier
Prequalification Depth Required*
Induction Level Required*
Audit Frequency Set*
- Each visit4 pts
- Monthly3 pts
- Quarterly2 pts
- Annually1 pt
Site Inspection Frequency Set*
- Daily4 pts
- Weekly3 pts
- Per package2 pts
- Random1 pt
Permit Requirements Set*
- Yes3 pts
- No0 pts
Insurance Level Required*
Risk Assessment
Risk ID
Format RSK-2026-00000.
Links to FDN-012 Risk ID
Assessed By*
Signature*
Safety Lead*
Second Signature*
CON-003 · record IDs look like CRC-2026-000 · Links Vendor
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The classification is a page of answers. What fails is everything around it: the work order that never asked whether a classification covered this scope, the induction that was issued at the wrong level, and the audit frequency the tier set and nobody scheduled.
Holds classifications against scopes rather than vendors, and blocks a work order reaching the gate where no classification covers the scope being engaged.

Watches work orders, scope changes, violations and incidents for events that should reclassify a scope, and raises the reassessment instead of waiting for the scheduled date.
Turns the tier into the permit, isolation and audit requirements it implies, and flags classifications whose control package contradicts the tier.
Issues the induction level the classification demands and expires it on the tier's cycle, so a Very high scope cannot be worked on a general contractor induction.
This template lives in KnowContractor — contractor management. Prequalification, approval, induction, permits and performance.
Meet KnowContractor→Glossary
Contractor Risk Classification definitions and key terms
- Risk tier
- The Low, Medium, High or Very high band assigned to a scope of contracted work, which determines the depth of prequalification and the intensity of oversight applied to it.
- Scope of work
- The specific activity being contracted, described tightly enough that its hazards and its product exposure can be judged; the unit that is classified.
- Prequalification depth
- How much evidence a contractor must produce before approval, from basic checks to enhanced review of programmes and competence records.
- Induction level
- Which induction the contractor's workers must complete, from escorted visitor through general contractor to a high risk induction covering permits and isolation.
- Host employer
- The employer who controls the workplace where contracted work happens, and who retains duties to the contractor's workers regardless of contractual allocation.
- Multi-employer worksite
- A site where more than one employer's workers face the same hazards, creating concurrent and non-transferable duties in most jurisdictions.
- Prime contractor
- The party formally appointed to coordinate health and safety for a project; absent an appointment, the duties usually stay with the owner.
- Highest contributing factor
- The single hazard or exposure answer that drove the tier, recorded so that the classification can be tested against the reason for it.
FAQ
Frequently asked questions about contractor risk classification
Should the tier be calculated from the answers or decided by the assessor?+
Derived, then overridable upward only. A calculated tier stops the drift toward Medium and makes the classification reproducible between assessors. But averaging is the wrong calculation: use the worst answer, not the mean, because a single routine confined space entry or ammonia exposure sets the risk regardless of how benign the rest of the scope is.
Can a contractor hold more than one tier at the same time?+
They should. A contractor with three scopes on your site should have three classifications, and the tiers will differ. The alternative is one tier set to their worst scope, which then imposes enhanced prequalification and permits on trivial work and quietly trains everyone to treat the tier as bureaucracy.
Does frequency on site increase or decrease risk?+
Decreases it, which surprises people. The daily contractor is known, inducted, supervised in practice rather than on paper, and visible when something looks wrong. The contractor who appears twice a year arrives with an out of date induction, no relationship with the area owner and no memory of the site's rules, which is why rarity is a driver in its own right.
How does the classification relate to insurance limits?+
It sets the requirement; it does not verify it. Insurance Level Required is an output of the tier, and it is the Insurance Certificate Record and Insurance Adequacy Review that check the certificate actually carries those limits, covers the activity being performed, and has not lapsed. A tier demanding Maximum cover against a standard certificate nobody read is worse than no requirement at all.
When should a tier be lowered?+
When the scope changes, not when performance improves. Good performance justifies confidence in the contractor; it does not make working at height lower risk. Lowering a tier on the strength of a good scorecard is the most defensible-looking way to remove controls from work whose hazards have not changed, and it is exactly the reasoning that reads badly after an incident.
Do low risk contractors need classifying at all?+
Yes, and briefly. The value of a Low classification is that it is recorded and reviewable, so the day the office cleaner is asked to work off a ladder above a production line there is something to reassess. Skipping classification for low risk work means the first record for that vendor gets created after the scope has already escalated.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Contractor Onboarding and Management
Contractor Prequalification Questionnaire
Collects a contractor's safety, insurance, training and performance information before they are approved
Contractor Safety Statistics Review
Reviews a contractor's injury rates, citations and experience modifier over recent years
Contractor Approval Record
Records the decision to approve a contractor to work on site
Contractor Safety Program Review
Reviews the contractor's own written safety programme against your requirements
Subcontractor Declaration
Records any subcontractors a contractor intends to use
Prequalification Renewal Record
Renews a contractor's prequalification before it expires
More in Prequalification
Contractor Prequalification Questionnaire
Collects a contractor's safety, insurance, training and performance information before they are approved
Contractor Safety Statistics Review
Reviews a contractor's injury rates, citations and experience modifier over recent years
Contractor Approval Record
Records the decision to approve a contractor to work on site
Contractor Safety Program Review
Reviews the contractor's own written safety programme against your requirements
Subcontractor Declaration
Records any subcontractors a contractor intends to use
Prequalification Renewal Record
Renews a contractor's prequalification before it expires

Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 45001:2018 clause 8.1.4, procurement, contractors and outsourcing
- 29 CFR 1910.119(h), Process Safety Management contractor requirements (US)
- OSHA Multi-Employer Citation Policy, CPL 02-00-124
- Construction (Design and Management) Regulations 2015, regulations 4 and 8 (GB)
- Management of Health and Safety at Work Regulations 1999, regulations 11 and 12 (GB)
- Model WHS Act sections 19 and 46, primary duty and duty to consult, cooperate and coordinate (Australia)
- BRCGS Food Safety clause 3.5, management of suppliers of raw materials and services
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.