What this is
What is a contractor safety program review?
What is a contractor safety program review?
A contractor safety program review examines the contractor's own written health and safety management system, policy, risk assessments, method statements and emergency arrangements against the site's requirements and against evidence the system is actually followed rather than produced for tender.
How is it different from a safety statistics review?
This review is qualitative: it judges whether the contractor's system and implementation are adequate. The statistics review is quantitative: injury and enforcement record over time. A contractor can pass one and fail the other, so the two are recorded separately.
Who carries out a contractor safety program review?
Safety, working from the documents supplied and a sample of implementation records. The review depth field records whether a full file review, a sample review, or only a cover check was performed, since those give very different levels of assurance.
Scope
When is a contractor safety program review required?
This review is one step in a contractor management programme, and it only covers the written system and its implementation. Using it to judge injury rates, or to approve a specific piece of work, pushes those decisions onto the wrong record.
Use this template when
- A contractor is being prequalified and their safety management system needs assessing before approval
- The annual review interval for an already-approved contractor has been reached
- A trigger event, a serious incident, a change of scope, a near miss pattern, calls for an out-of-cycle review
- A renewal decision needs a documented basis in the adequacy of the contractor's system, not just their outcomes
- A linked record needs this one to exist: links vendor
Do not use it for
- Contractor Safety Statistics Review, which reviews the contractor's injury rates, citations and trend, not the adequacy of their written system
- Contractor Method Statement Review, which approves a method statement for a specific piece of work, rather than reviewing the safety programme as a whole
- Contractor Prequalification Questionnaire, which is the broader intake covering safety, insurance, training and performance before any contractor is approved
- Contractor Site Safety Audit, which examines physical conditions and practices on site, not the contractor's paperwork
- Anything outside KnowContractor, which belongs in the workspace that owns that process
Compliance mapping
Which ISO 45001 cl.8.1.4 requirements does this satisfy?
ISO 45001 requires contractors to be coordinated and evaluated as part of procurement, but it leaves the depth and method of that evaluation to the organisation, which is why a review's defensibility rests on what was actually sampled rather than on the document existing.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001 cl.8.1.4.2 | Contractor OH&S management coordinated with the host, and the programme evaluated against defined selection and retention criteria | Header |
| ISO 45001 cl.6.1.2.1 | Hazard identification specific to the actual work, not a generic listing detached from the tasks performed | Content quality |
| ISO 45001 cl.8.1.2 | Elimination and reduction of risk following the hierarchy of controls, rather than defaulting to PPE | Content quality |
| ISO 45001 cl.8.2 | Emergency preparedness and response arrangements coordinated with relevant interested parties including the host site | Content quality |
| ISO 45001 cl.7.5.3 | Documented information controlled, available, and demonstrably in use rather than filed and forgotten | Implementation evidence |
| ISO 45001 cl.7.2 | Competence of workers evidenced by training records, sampled rather than taken on assertion | Implementation evidence |
| ISO 45001 cl.9.1.1 | Monitoring and measurement of contractor performance, with review depth affecting the reliability of the result | Result |
| ISO 45001 cl.10.2 | Nonconformity and corrective action, tracked to closure where the programme is found inadequate rather than merely noted | Result |
What it does not cover
- Contractor Safety Statistics Review, which examines injury rates, enforcement history and trend, not the adequacy of their written system.
- Contractor Method Statement Review, which approves a method statement for one piece of work, rather than the programme as a whole.
- Contractor Prequalification Questionnaire, the broader intake covering safety, insurance, training and performance before approval.
- Contractor Site Safety Audit, which examines physical site conditions and observed practice, not the contractor's documentation.
- Contractor Risk Classification, which sets the inherent risk band of the work itself, independent of a contractor's programme quality.
Global
Contractor Safety Program Review requirements by country
The duty to satisfy yourself that a contractor's safety arrangements are adequate before and during the work is close to universal, though what a regulator expects to see checked varies.
OSHA multi-employer worksite policy; general duty clause
A controlling or host employer can be cited for a contractor's hazard where it had the ability to detect and correct it, including an inadequate programme it never reviewed.
A review that only checked the cover, and never sampled method statements or emergency arrangements, weakens the host's own defence after an incident.
HSE guidance on managing contractors; CDM Regulations 2015 where applicable
HSE expects clients to check that a contractor's arrangements are suitable before engagement, and CDM imposes specific duties where construction work is involved.
Where CDM applies, a generic programme review is not enough on its own; construction phase plan and principal contractor duties sit alongside it.
ISO 45001 cl.8.1.4
Certified organisations must define criteria for evaluating contractors' OH&S management and demonstrate the criteria were actually applied, not merely documented.
Auditors typically ask to see the sampled evidence behind a result, which is why Cover Check Only is a weak position to defend.
How to complete it
How to complete a contractor safety program review, step by step
The template produces a score and a completeness percentage automatically, but neither number means anything unless the review behind it actually sampled the contractor's real work.
A policy that is current, signed and covers every expected heading can still be a document downloaded for tender and never opened again. Reading a sample against work the contractor genuinely performs separates a review from a filing exercise, and Review Depth records which one happened.
A generic manual mentions hazards the contractor never encounters and omits the ones they face daily. Reflects Work They Actually Do and Risk Assessments Task Specific are separate judgement calls from whether the policy exists, and both need an honest answer.
Training, equipment and inspection records sampled and found contemporaneous are stronger evidence than the written programme, because a system nobody follows protects nobody. Records that look prepared for the review rather than produced during the work should be treated as doubtful.
A high score calculated from a half-completed review describes confidence in a small sample, not the programme. Completeness Percent should be checked before Score Percent is relied on, and a high score on low completeness should be treated as inconclusive.
What auditors find
Most common contractor safety program review findings
The contractor's document is almost always present and well formatted. What an audit of this review finds is that the document was accepted rather than tested.
| Finding | Clause | What fixes it |
|---|---|---|
| Review conducted as Cover Check Only, but recorded and reported as a full pass. | ISO 45001 cl.9.1.1 | Record review depth honestly and require at least a sample review before a pass is issued. |
| Policy and risk assessments are generic, mentioning hazards the contractor does not encounter and omitting the ones they do. | ISO 45001 cl.6.1.2.1 | Compare the document's content against the actual scope of work before accepting it as adequate. |
| Method statements resolve every significant hazard into PPE and training, with no higher control considered. | ISO 45001 cl.8.1.2 | Require the method statement to show why elimination, substitution or engineering controls were rejected. |
| Emergency arrangements described in general terms and never coordinated with the host site's own plan. | ISO 45001 cl.8.2 | Confirm the contractor's arrangements interface explicitly with the site's plan, not just their own premises. |
| Sampled training or inspection records are undated or otherwise doubtful as contemporaneous evidence. | ISO 45001 cl.7.5.3 | Treat doubtful records as a failed item, not a passed one, and request originals rather than summaries. |
| Programme found inadequate but no corrective action or condition for approval is tracked to closure. | ISO 45001 cl.10.2 | Raise a CAPA with an owner and date whenever Program Adequate For The Work is answered other than yes. |
Case in point
Case in point: the manual that described someone else's site
A food manufacturer's annual review of a refrigeration contractor's safety programme found an eighty-page manual, current, signed, and clearly professionally produced. The reviewer checked the cover, confirmed every expected section was present, and recorded a full pass in under twenty minutes, because the document looked more thorough than most in-house programmes on file. A confined space entry six months later, into a chilled water tank, went ahead without a rescue plan. The investigation found the manual's confined space section described entry into fuel storage vessels, guidance copied from a different industry, with no rescue plan template at all.
The review had a field for exactly this, Rescue Plans Where Required, and it had been marked yes on the strength of the table of contents rather than its actual content. The corrective step was not a new field but a rule: a cover check only depth is not permitted to answer a content-quality question, only to confirm a document exists.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
4 sections
- Reference
- CON-005
- Archetype
- Review
- Record ID
- CSPR-2026-000
- Scoring
- Weighted percent
- Direction
- High is good
- Singleton
- No
- Basis
- ISO 45001 cl.8.1.4
- Links
- Links Vendor
- Tags
- Contractor, Assurance
- Sections
- 4
- Fields
- 43
- Follow up fields
- 3
- Repeating sections
- 0
- Links out
- 4
Header
12 fieldsReview ID*
Auto sequence. Format CSP-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Contractor*
Vendor ID*
Format VEN-0000.
Links to FDN-005 Vendor ID
Read It, Do Not Just File It
A safety manual downloaded from a template site and never opened is common. Read a sample and ask whether it describes work this contractor actually does.
Documents Reviewed*
Reviewer*
Review Depth*
- Full file review3 pts
- Sample review2 pts
- Cover check only0 pts
Content quality
9 fieldsPolicy Current And Signed*
- Yes3 pts
- Out of date1 pt
- No0 pts
Reflects Work They Actually Do*
Generic manuals mention hazards they never encounter and omit the ones they face daily.
- Yes3 pts
- Partly1 pt
- Generic template0 pts
Site Specific Content Present*
- Yes3 pts
- Some1 pt
- None0 pts
Risk Assessments Task Specific*
- Yes3 pts
- Partly1 pt
- Generic0 pts
Method Statements Practical*
- Yes3 pts
- Partly1 pt
- No0 pts
Controls Match The Hierarchy*
- Yes3 pts
- Partly1 pt
- PPE focused0 pts
Emergency Arrangements Defined*
- Yes3 pts
- Partly1 pt
- No0 pts
Rescue Plans Where Required
- Yes3 pts
- Not applicable3 pts
- No0 pts
Incident Reporting To Us Defined*
They must tell you about their incidents on your site, promptly and without prompting.
- Yes3 pts
- Vague1 pt
- No0 pts
Implementation evidence
6 fieldsSample Records Requested*
- Yes3 pts
- No0 pts
Records Show Actual Use*
- Yes3 pts
- Partly1 pt
- No0 pts
Records Contemporaneous*
- Yes3 pts
- Doubtful1 pt
- Clearly not0 pts
Training Records Sampled*
- Yes3 pts
- No0 pts
Equipment Records Sampled*
- Yes3 pts
- No0 pts
Inspection Records Sampled*
- Yes3 pts
- No0 pts
Result
16 fieldsItems Assessed*
Excludes anything marked N/A.
Items Failed*
Score Percent*
Calculated on submission. High is good. N/A items leave the denominator.
Result Band*
- Pass3 pts
- Caution1 pt
- Fail0 pts
Completeness Percent*
How much of the template was actually answered. A high score on a half completed form is not a high score.
Program Adequate For The Work*
- Yes3 pts
- With improvements1 pt
- No0 pts
Improvements Required
Conditions For Approval
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Reviewer*
Signature*
Safety Lead*
Second Signature*
CON-005 · record IDs look like CSPR-2026-000 · Links Vendor
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The document itself is the easy part to review. What fails is whether the review actually opened it, and whether a finding of inadequacy ever produced a tracked action.
Holds the review against the contractor's prior submissions, flags a downgrade in review depth across renewals, and carries a CAPA to closure.
Compares the contractor's stated hazards and controls against the site's own hazard register to catch a generic or mismatched programme.
Cross-checks sampled training records against the contractor's own competency claims rather than accepting the manual's assertion.
Flags a Cover Check Only review reported as a pass, and holds any inadequate finding open until a tracked action is raised.
This template lives in KnowContractor — contractor management. Prequalification, approval, induction, permits and performance.
Meet KnowContractor→Glossary
Contractor Safety Program Review definitions and key terms
- Cover check
- The shallowest review depth, confirming a document exists and covers the expected headings without reading its content.
- Task-specific risk assessment
- A risk assessment written for the actual method, substance and environment of a given task, not a generic assessment of the activity in the abstract.
- Contemporaneous record
- A record created at or near the time the activity it documents took place, as opposed to one reconstructed for a review.
- Program adequacy
- Whether a contractor's safety management system, as written and implemented, is sufficient for the work they will actually perform.
- Sample review
- A review depth reading a representative selection of documents rather than every one, weaker than a full file review but stronger than a cover check.
FAQ
Frequently asked questions about contractor safety program review
Is it enough that the contractor has a written safety policy?+
No. A current, signed policy establishes that a document exists, not that it describes the contractor's actual work or that anyone follows it. Content quality and implementation evidence are separate questions the template asks deliberately.
How much of the contractor's documentation should actually be read?+
Enough to judge whether it reflects their real work, usually a sample review at minimum. A cover check only confirms the document exists and should not be reported as though it answered the content questions.
What does it mean if method statements are PPE focused?+
It means the hierarchy of controls was not applied. A method statement should show elimination, substitution and engineering controls were considered and, where rejected, why, before arriving at administrative controls or PPE.
Why sample implementation records rather than trust the policy?+
Because a policy describes intent and implementation evidence describes what actually happened. Records that are contemporaneous and show real use are stronger evidence of an adequate programme than the document describing it.
What should happen when the programme is found inadequate?+
A corrective action should be raised with an owner and a date, and any condition on approval tracked to closure rather than noted and left. An inadequate finding with no follow-through is functionally the same as a pass.
Does a good program review mean the contractor is safe to use?+
It means their system and implementation, as sampled, are adequate. It says nothing about their injury or enforcement record, covered separately by the statistics review, and approval should draw on both.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Contractor Onboarding and Management
Contractor Prequalification Questionnaire
Collects a contractor's safety, insurance, training and performance information before they are approved
Contractor Safety Statistics Review
Reviews a contractor's injury rates, citations and experience modifier over recent years
Contractor Risk Classification
Classifies a contractor by the risk of the work they do, from low risk services to high risk construction
Contractor Approval Record
Records the decision to approve a contractor to work on site
Subcontractor Declaration
Records any subcontractors a contractor intends to use
Prequalification Renewal Record
Renews a contractor's prequalification before it expires
More in Prequalification
Contractor Prequalification Questionnaire
Collects a contractor's safety, insurance, training and performance information before they are approved
Contractor Safety Statistics Review
Reviews a contractor's injury rates, citations and experience modifier over recent years
Contractor Risk Classification
Classifies a contractor by the risk of the work they do, from low risk services to high risk construction
Contractor Approval Record
Records the decision to approve a contractor to work on site
Subcontractor Declaration
Records any subcontractors a contractor intends to use
Prequalification Renewal Record
Renews a contractor's prequalification before it expires
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 45001:2018 clauses 8.1.4, 8.1.2, 8.2 and 7.5
- HSE guidance on managing contractors
- Construction (Design and Management) Regulations 2015 (UK, where applicable)
- OSHA multi-employer worksite policy
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.