Knowella

Contractor Risk Classification

A contractor risk classification decides how much scrutiny a contractor gets before they start: prequalification depth, induction level, permits, audit frequency and who supervises them. Its recurring failure is that the tier attaches to the company rather than to the scope, so the refrigeration firm rated Very high for ammonia work stays Very high while replacing a light fitting, and the office painter stays Low the day they are asked to open a roof hatch.

KnowContractorAssessmentCON-003Pinned in navigation48 fields across 5 sectionsFull researchSee the form

Reviewed by Siddarth SinghCSPLast reviewed 16 August 2026

Basis
ISO 45001 cl.8.1.4
Workspace
KnowContractor
Form type
Assessment
Review trigger
Scope change, incident, or the scheduled review
Sets
Prequalification depth, induction, permits, audit frequency

The short version

  • The unit of classification is the scope of work, not the vendor. The same contractor can be low risk painting an office corridor and very high risk entering a brine tank, and a single tier held against the vendor record will be wrong for one of those jobs.
  • The tier is a decision, not a total. Hazard exposure, operational exposure, frequency and supervision are inputs; one routine confined space entry outranks every other answer on the form and no averaging should be allowed to dilute it.
  • The classification only does work if it binds something. Prequalification depth, induction level, permit requirement, insurance level, audit frequency and inspection frequency are all set on this record, and a tier recorded without those consequences is a label.
  • ISO 45001 cl.8.1.4 requires the organisation to coordinate procurement with contractors to identify hazards and control the OH&S risks arising from their activities, and cl.8.1.4.3 requires the type and degree of control over outsourced work to be defined.
  • Where work is PSM-covered, OSHA 1910.119(h)(2) turns this from good practice into a duty: the host employer must obtain and evaluate information on the contract employer's safety performance and inform them of the process hazards.
  • Frequency cuts both ways. A daily contractor is more integrated, better known and easier to supervise than one who appears twice a year, so rarity is a risk driver even where the hazard profile is identical.

What this is

What is a contractor risk classification?

What is a contractor risk classification?

A contractor risk classification is a pre-work assessment that places a specific scope of contracted work into a risk tier, and uses that tier to fix the control package applied to it. It looks at the hazards the contractor brings, the exposure they create in your operation, how often they are on site and how they are supervised, then sets prequalification depth, induction level, permit requirements, insurance level and audit frequency accordingly.

How does classification differ from a contractor performance scorecard?

Classification is forward looking and happens before work: it decides how much scrutiny the work warrants. A performance scorecard is backward looking and happens after work: it records how the contractor actually behaved over a period. One sets the gate, the other measures what came through it. A classification that is quietly rewritten to match observed performance has stopped being a classification.

Who should set the risk tier?

The contract owner, because they are the person who knows the scope and who will hold the consequences of getting it wrong. The form requires a second signature from the safety lead, and that countersignature is the point of the control. Left to procurement alone, tiers drift downward, because a lower tier means fewer documents to chase before the job can start.

Scope

When is a contractor risk classification required?

Classification sits between prequalification and approval, and its most common misuse is being treated as the whole of prequalification. It decides how much evidence to demand; it does not collect that evidence and it does not make the approval decision.

Use this template when

  • A contractor is being prequalified for the first time and the depth of that prequalification has to be decided
  • An approved contractor is being engaged for a scope of work materially different from the one already classified
  • A scope changes mid-contract: new hazard, new area, new subcontractor, out of hours working, or entry to a production area
  • An incident, violation or performance concern suggests the tier and the oversight it set were both too light
  • The scheduled reassessment falls due and the previous tier needs confirming or changing on the record

Do not use it for

  • Collecting the contractor's safety, insurance and training evidence, which is the Contractor Prequalification Questionnaire and follows the depth this record sets
  • Deciding whether to approve the contractor at all, which is the Contractor Approval Record and is a separate signed judgement
  • Assessing the hazards of the task itself, which is a task risk assessment and a Contractor Method Statement Review, not a tiering exercise
  • Authorising a particular job on a particular day, which is a permit to work and a Site Access Authorization
  • Judging how the contractor performed, which is the Contractor Performance Scorecard and the Contractor Site Safety Audit

Compliance mapping

Which ISO 45001 cl.8.1.4 requirements does this satisfy?

No standard mandates a risk tier for contractors. What standards and regulators do require is that the degree of control over contracted work is proportionate to its risk, which is unanswerable unless someone has decided what the risk is and written it down.

ClauseRequirementWhere it lands
ISO 45001 cl.8.1.4.2Coordinate procurement with contractors to identify hazards and control the OH&S risks arising from their activitiesHazard exposure
OSHA 1910.119(h)(2)For PSM-covered work, obtain and evaluate information on the contract employer's safety performance and inform them of process hazardsHazard exposure
ISO 45001 cl.6.1.2.1Hazard identification to account for people in the vicinity and for persons not directly employed, including contractors and visitorsExposure to our operation
BRCGS Food Safety cl.3.5Risk-based procedures for the approval and monitoring of suppliers of services, including maintenance, cleaning and pest control in production areasExposure to our operation
ISO 45001 cl.8.1.4.3Type and degree of control over outsourced functions and processes to be defined and appliedFrequency and control
Model WHS Act s.46Duty to consult, cooperate and coordinate activities with other persons who have a duty in relation to the same matterFrequency and control
ISO 45001 cl.8.1.4.1Procurement controls established so that products, services and processes conform to the management system requirementsClassification
CDM 2015 reg.8Appointed contractors and designers must have the skills, knowledge and experience proportionate to the work, and the client must satisfy itself of thatHeader

What it does not cover

  • The prequalification itself, which is the Contractor Prequalification Questionnaire; this record only decides how deep that questionnaire has to go.
  • The approval decision, which belongs in the Contractor Approval Record and remains a separate judgement even where the tier is Low.
  • Task risk assessment, which must address the hazards of the specific job and its method, and is not replaced by a tier that says the work is high risk.
  • Insurance verification, which needs the certificate itself checked against the required limits in the Insurance Certificate Record and Insurance Adequacy Review.
  • Subcontractor control, which requires the Subcontractor Declaration and its own classification, because a tiered contractor may bring an untiered one through the gate.

Global

Contractor Risk Classification requirements by country

Every major regime holds the host or client responsible for contracted work to some degree, and none of them accept a signed contract as the discharge of that duty. What varies is how the duty is framed and how it is transferred.

United States

OSHA Multi-Employer Citation Policy CPL 02-00-124; 29 CFR 1910.119(h); 29 CFR 1926.16

Host, controlling, correcting and creating employers can all be cited for the same exposure; PSM work carries an explicit contractor evaluation duty.

OSHA can cite the host as controlling employer for a contractor's exposure, and the classification becomes evidence of what the host knew before work started.

United Kingdom

HSWA 1974 s.3; MHSWR 1999 reg.12; CDM 2015 reg.4 and reg.8

Duty to persons not employed, comprehensible risk information to workers of outside undertakings, and client arrangements proportionate to the project.

For construction the classification effectively decides whether CDM duty holders have to be appointed at all, so getting the tier wrong is not just an oversight failure but a missed statutory appointment.

European Union

Framework Directive 89/391/EEC Art.6(4) and Art.10(2); Construction Sites Directive 92/57/EEC

Where several undertakings share a workplace, employers must cooperate and coordinate protective measures and inform each other's workers of the risks.

National transpositions differ in formality, but the coordination duty runs both ways and cannot be satisfied by a contract clause allocating responsibility to the contractor.

Canada

Provincial OHS Acts (constructor and prime contractor duties); CSA Z1000

Naming a constructor or prime contractor transfers defined statutory duties for the project to that party.

Where no such appointment is made, the owner usually retains those duties by default, so the classification of a project's scale and risk decides who is legally in charge of it.

Australia

Model WHS Act s.19 and s.46

The primary duty extends to workers whose activities are influenced or directed by the PCBU, and duty holders must consult, cooperate and coordinate with each other.

Concurrent duties cannot be contracted away, and s.46 makes the pre-work conversation about who controls what an obligation in its own right rather than good manners.

International

ISO 45001 cl.8.1.4; ISO 9001 cl.8.4; SQF cl.2.3.3

Procurement and outsourcing must be controlled to a degree matched to the risk and the effect on conformity.

Certification auditors ask how the degree of control was decided, and this record is the only place in the contractor programme where that decision is visible.

How to complete it

How to complete a contractor risk classification, step by step

The hazard and exposure questions on this form answer themselves once someone has actually looked at the scope. The judgements that decide whether the classification survives an incident are the four the form cannot prompt for.

Classify the scope, not the company

The form says this in its own guidance and it is still the most common way the record fails. One classification per vendor produces a tier that is too heavy for their routine work and too light for their occasional work, and the too-light half is the one that hurts. Raise a separate classification for each scope, and treat a new scope on an existing vendor as a new record rather than an edit to the old one.

Let the worst answer set the tier

Nine No answers and one Routinely on confined space entry is a very high risk scope, not an average one. Any method that sums or averages the drivers will bury the answer that matters, because most contracted work is unremarkable in most respects. Use the Highest Contributing Factor field to name the single answer that drove the tier, and check that the named factor and the tier are consistent before signing.

Set the control package on the same record, and make it binding

Prequalification depth, induction level, permit requirement, insurance level, audit frequency and inspection frequency are all fields here, and they are the entire point of the exercise. Filling the tier and leaving the consequences blank, or setting them to whatever the site already does, converts the classification into a description. The test is whether a Very high tier and a Low tier actually produce different behaviour at the gate.

Name the reassessment trigger and record the previous tier

A scheduled review is the weakest of the four triggers the form offers, because scope changes do not wait for it. Scope change, incident and performance concern are the ones that catch a wrong tier, and each needs a route into this record from the work order, the incident log and the scorecard. Recording the previous tier makes any movement visible, which is what forces a downgrade to be justified rather than assumed.

What auditors find

Most common contractor risk classification findings

Classification findings rarely concern a missing record. They concern a record that exists, is internally inconsistent, and has not been near the work it describes since the day the vendor was onboarded.

FindingClauseWhat fixes it
One classification held per contractor, covering every scope of work they perform.ISO 45001 cl.8.1.4.2Raise a classification per scope of work and link each engagement to the classification that covers it.
Tier not reassessed after the scope changed to include a new hazard or a production area.ISO 45001 cl.8.1.3Route scope changes through management of change so a change raises the reassessment.
Tier recorded as High but induction level set to General contractor and no permit required.ISO 45001 cl.8.1.4.1Derive the control package from the tier and reject records where the two contradict each other.
Contractor working on ammonia or PSM-covered plant classified without any evaluation of their safety performance.OSHA 1910.119(h)(2)Obtain and evaluate the contract employer's performance and programme evidence before signing the tier.
Confined space entry recorded as routine, but no host and contractor information exchange on record.OSHA 1910.146(c)(8)Make the permit space information exchange a mandatory output of any confined space classification.
Energy isolation recorded as part of the contractor's work, with no exchange of lockout and tagout procedures.OSHA 1910.147(f)(2)Exchange isolation procedures with the outside employer and reference the exchange on the classification.
Subcontractors used routinely, but no subcontractor declared, classified or verified.ISO 45001 cl.8.1.4.3Require a Subcontractor Declaration before access, and classify the subcontractor's scope too.
Contractor routinely works in food production areas; classification addresses safety hazards only.BRCGS Food Safety cl.3.5Score product exposure alongside safety and set the hygiene requirements the tier implies.
Audit and inspection frequencies set on the classification but no audits or inspections raised against them.ISO 45001 cl.9.1.1Generate the audit and inspection schedule from the classification, not from a separate plan.
Classification signed by the contract owner alone; safety lead countersignature absent.ISO 45001 cl.8.1.4.2Hold the record open until the second signature is present; it is the control, not a formality.

Case in point

Case in point: the tier that was right for the wrong job

A chilled ready meals site classified its refrigeration contractor when it onboarded them. The scope was planned preventive maintenance on the ammonia plant: monthly attendance, their own supervisor always present, no confined space, no hot work, no work above open product. The contract owner set the tier at Medium, prequalification depth Standard, induction General contractor, audit frequency Quarterly, permits not required. The safety lead countersigned. On the scope as written, all of that was defensible.

Two years later the same contractor was engaged to overhaul a compressor. That work involved hot work on a pipe run above a chilled preparation area, nitrogen purging, and two nights out of hours with the site's own supervision absent. The purchase order referenced the existing vendor record, and nobody raised a new classification, because a classification belonged to the vendor and the vendor already had one. The crew presented the general contractor induction they had held for two years and started without a hot work permit, because the classification said permits were not required.

The fire was small and the burns were minor, and the investigation was not about the fire. It was about how a Medium tier from a planned maintenance scope came to govern a hot work overhaul above open product. Nothing in the record was false. The record was simply about a different job. The corrective action was not a stricter tier; it was making the classification an attribute of the scope, raised from the work order, so that a new scope on a known vendor cannot inherit the old tier by default.

The template

The template, field by field

The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.

48fields
5 sections
Reference
CON-003
Archetype
Assessment
Record ID
CRC-2026-000
Scoring
Risk tier
Direction
High is bad
Singleton
No
Basis
ISO 45001 cl.8.1.4
Links
Links Vendor
Tags
Contractor, Risk
Sections
5
Fields
48
Follow up fields
0
Repeating sections
0
Links out
3
Field typesOwn ID, generated on saveCase thread and parentPick list from a registryLinked to another templateFollow up, dashed outlineScored

Header

12 fields
Text

Classification ID*

Generated on save

Auto sequence. Format CRC-2026-000.

The record's own ID. Other templates point at this value.

Single Choice

Status*

Scored

Drives who this goes to next.

  • Planned2 pts
  • In progress2 pts
  • Complete3 pts
  • Deferred0 pts
  • Open0 pts
  • Closed3 pts
  • Overdue0 pts
Date & Time

Date and Time*

Users

Completed By*

Pick List

Site*

From FDN-001 Site NameFilter: Status is Active
Text

Site ID*

Linked

Format SITE-000.

Links to FDN-001 Site ID

Pick List

Contractor*

From FDN-005 Vendor Name
Text

Vendor ID*

Linked

Format VEN-0000.

Links to FDN-005 Vendor ID

Info

Classify The Work, Not The Company

The same contractor can be low risk painting an office and very high risk entering a brine tank. Classify each scope of work separately.

Text

Scope Of Work*

Users

Assessed By*

Single Choice

Reassessment Trigger

Optional
ScheduledScope changeAfter an incidentPerformance concern

Hazard exposure

9 fields
Single Choice

Working At Height*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Confined Space Entry*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Energy Isolation In Their Work*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Hot Work*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Lifting Operations*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Excavation*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Live Electrical Work*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Ammonia Or Refrigerant Systems*

Scored

Refrigeration contractors carry a fatality risk that is easy to underestimate because the work looks routine.

  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Hazardous Substances*

Scored
  • No3 pts
  • Some1 pt
  • Significant0 pts

Exposure to our operation

6 fields
Single Choice

Works In Food Production Areas*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Works Above Open Product*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Works On Product Contact Equipment*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Works Near Moving Machinery*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Works Alone Or Out Of Hours*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Interacts With Our Workers*

Scored
  • Minimal3 pts
  • Some2 pts
  • Constant1 pt

Frequency and control

6 fields
Single Choice

Frequency On Site*

Scored

A daily contractor is more integrated and easier to manage than one who appears twice a year.

  • Daily3 pts
  • Weekly2 pts
  • Monthly1 pt
  • Rarely0 pts
Numeric Answer

Number Of Workers Typically*

Scored
Single Choice

Supervised By Us Or Themselves*

Scored
  • Our supervision3 pts
  • Joint2 pts
  • Their own0 pts
Single Choice

Uses Subcontractors*

Scored
  • No3 pts
  • Occasionally1 pt
  • Routinely0 pts
Single Choice

Own Supervisor On Site*

Scored
  • Always3 pts
  • Sometimes1 pt
  • Never0 pts
Single Choice

Consequence Of Poor Performance*

Scored
  • Minor3 pts
  • Moderate1 pt
  • Severe0 pts

Classification

15 fields
Single Choice

Risk Tier*

Scored
  • Low3 pts
  • Medium2 pts
  • High1 pt
  • Very high0 pts
Single Choice

Highest Contributing Factor

Optional
Working at heightConfined spaceEnergy isolationHot workAmmonia systemsFood area accessLone working
Single Choice

Previous Tier

Optional
LowMediumHighVery high
Single Choice

Prequalification Depth Required*

BasicStandardEnhanced
Single Choice

Induction Level Required*

Visitor escortGeneral contractorHigh risk work
Single Choice

Audit Frequency Set*

Scored
  • Each visit4 pts
  • Monthly3 pts
  • Quarterly2 pts
  • Annually1 pt
Single Choice

Site Inspection Frequency Set*

Scored
  • Daily4 pts
  • Weekly3 pts
  • Per package2 pts
  • Random1 pt
Single Choice

Permit Requirements Set*

Scored
  • Yes3 pts
  • No0 pts
Single Choice

Insurance Level Required*

StandardEnhancedMaximum
Pick List

Risk Assessment

OptionalFrom FDN-012 Risk Title
Text

Risk ID

OptionalLinked

Format RSK-2026-00000.

Links to FDN-012 Risk ID

Users

Assessed By*

Signature

Signature*

Users

Safety Lead*

Signature

Second Signature*

CON-003 · record IDs look like CRC-2026-000 · Links Vendor

Open in Knowella

Run it with agents

From a document you fill in to a programme that runs itself

The classification is a page of answers. What fails is everything around it: the work order that never asked whether a classification covered this scope, the induction that was issued at the wrong level, and the audit frequency the tier set and nobody scheduled.

KnowContractor

Holds classifications against scopes rather than vendors, and blocks a work order reaching the gate where no classification covers the scope being engaged.

Ella
Ella

Watches work orders, scope changes, violations and incidents for events that should reclassify a scope, and raises the reassessment instead of waiting for the scheduled date.

KnowSafe

Turns the tier into the permit, isolation and audit requirements it implies, and flags classifications whose control package contradicts the tier.

KnowTrain

Issues the induction level the classification demands and expires it on the tier's cycle, so a Very high scope cannot be worked on a general contractor induction.

This template lives in KnowContractor — contractor management. Prequalification, approval, induction, permits and performance.

Meet KnowContractor→

Glossary

Contractor Risk Classification definitions and key terms

Risk tier
The Low, Medium, High or Very high band assigned to a scope of contracted work, which determines the depth of prequalification and the intensity of oversight applied to it.
Scope of work
The specific activity being contracted, described tightly enough that its hazards and its product exposure can be judged; the unit that is classified.
Prequalification depth
How much evidence a contractor must produce before approval, from basic checks to enhanced review of programmes and competence records.
Induction level
Which induction the contractor's workers must complete, from escorted visitor through general contractor to a high risk induction covering permits and isolation.
Host employer
The employer who controls the workplace where contracted work happens, and who retains duties to the contractor's workers regardless of contractual allocation.
Multi-employer worksite
A site where more than one employer's workers face the same hazards, creating concurrent and non-transferable duties in most jurisdictions.
Prime contractor
The party formally appointed to coordinate health and safety for a project; absent an appointment, the duties usually stay with the owner.
Highest contributing factor
The single hazard or exposure answer that drove the tier, recorded so that the classification can be tested against the reason for it.

FAQ

Frequently asked questions about contractor risk classification

Should the tier be calculated from the answers or decided by the assessor?+

Derived, then overridable upward only. A calculated tier stops the drift toward Medium and makes the classification reproducible between assessors. But averaging is the wrong calculation: use the worst answer, not the mean, because a single routine confined space entry or ammonia exposure sets the risk regardless of how benign the rest of the scope is.

Can a contractor hold more than one tier at the same time?+

They should. A contractor with three scopes on your site should have three classifications, and the tiers will differ. The alternative is one tier set to their worst scope, which then imposes enhanced prequalification and permits on trivial work and quietly trains everyone to treat the tier as bureaucracy.

Does frequency on site increase or decrease risk?+

Decreases it, which surprises people. The daily contractor is known, inducted, supervised in practice rather than on paper, and visible when something looks wrong. The contractor who appears twice a year arrives with an out of date induction, no relationship with the area owner and no memory of the site's rules, which is why rarity is a driver in its own right.

How does the classification relate to insurance limits?+

It sets the requirement; it does not verify it. Insurance Level Required is an output of the tier, and it is the Insurance Certificate Record and Insurance Adequacy Review that check the certificate actually carries those limits, covers the activity being performed, and has not lapsed. A tier demanding Maximum cover against a standard certificate nobody read is worse than no requirement at all.

When should a tier be lowered?+

When the scope changes, not when performance improves. Good performance justifies confidence in the contractor; it does not make working at height lower risk. Lowering a tier on the strength of a good scorecard is the most defensible-looking way to remove controls from work whose hazards have not changed, and it is exactly the reasoning that reads badly after an incident.

Do low risk contractors need classifying at all?+

Yes, and briefly. The value of a Low classification is that it is recorded and reviewable, so the day the office cleaner is asked to work off a ladder above a production line there is something to reassess. Skipping classification for low risk work means the first record for that vendor gets created after the scope has already escalated.

Keep going

Related templates and programmes

Industries this is written for

Siddarth Singh

Written and reviewed by

Siddarth Singh

Founder & Chief Executive Officer, Knowella

Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.

  • Certified Safety Professional (CSP), Board of Certified Safety Professionals
  • MBA, University of Chicago Booth School of Business
  • MS and BS, The Ohio State University, Industrial and Systems Engineering
  • Six Sigma Black Belt
Verify with BCSP →

Sources and last review. Reviewed 16 August 2026 against:

  • ISO 45001:2018 clause 8.1.4, procurement, contractors and outsourcing
  • 29 CFR 1910.119(h), Process Safety Management contractor requirements (US)
  • OSHA Multi-Employer Citation Policy, CPL 02-00-124
  • Construction (Design and Management) Regulations 2015, regulations 4 and 8 (GB)
  • Management of Health and Safety at Work Regulations 1999, regulations 11 and 12 (GB)
  • Model WHS Act sections 19 and 46, primary duty and duty to consult, cooperate and coordinate (Australia)
  • BRCGS Food Safety clause 3.5, management of suppliers of raw materials and services

This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.

Start in Minutes, Not Weeks

Launch a Ready-Made Template and Customize It Your Way

Every template is fully editable. Adjust fields, workflows, and branding to match your processes, then deploy to your team instantly.