What this is
What is a contractor scope record?
What is a contractor scope record?
It is the record that converts a general approval into a bounded permission: named work categories, named areas, named high-risk activities, and the conditions attached to each. It sits between the approval decision and the day-to-day permit, and it is the document that answers the question a supervisor actually has, which is not whether this company is approved but whether these people may do this job here tonight.
What is the difference between approval and scope?
Approval is a judgement about the organisation: its safety performance, insurance, references and management system. Scope is a judgement about the work: this contractor may do refrigeration and mechanical work in the plant room, escorted in production areas, and may not enter a confined space or touch the ammonia system. An approved contractor with no recorded scope has been given a licence rather than a permission, and that is how unapproved work starts.
Why record what a contractor is not approved to do?
Because the absence of an approval is invisible at the point of work. A supervisor reading a scope that lists mechanical and refrigeration will not infer that hot work is prohibited; they will assume it was not relevant to list. Naming exclusions explicitly, with the reason and the evidence that would lift them, turns a silence into a decision someone can be held to.
Scope
When is a contractor scope record required?
This record defines the boundary of engagement. It is master data, not an event record, and it is the wrong instrument for anything that happens inside the boundary it draws.
Use this template when
- A contractor has been approved and the permission needs bounding before any work is authorised
- An existing contractor is being asked to take on a different category of work, a new area, or a high-risk activity
- A site is being added to an existing contractor arrangement, where the hazards and access rules differ
- An audit, incident or violation has shown that a contractor was working outside what anyone intended to approve
- The approved contractor list needs a scope entry behind each row rather than a company name alone
Do not use it for
- Deciding whether to approve the contractor at all, which is the Contractor Approval Record and rests on prequalification, statistics and insurance rather than on work content
- Authorising a specific job on a specific day, which is a permit to work and a pre-work meeting record, both of which assume the scope already exists
- Verifying that individual workers hold the tickets the scope requires, which is Contractor Competency Verification against the worker register
- Reviewing how the work will be done, which is the Contractor Method Statement Review and looks at method and task risk rather than permission
- Withdrawing a contractor after a failure, which is the Contractor Suspension Record and Access Revocation Record, not an edit to scope
Compliance mapping
Which ISO 45001 cl.8.1.4 requirements does this satisfy?
Regulation treats contractor work as a shared duty rather than a transferred one. Almost every regime makes the host responsible for the hazards it controls and for what it tells the contractor, which is why the scope record is read as evidence of control rather than as a commercial document.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001 cl.8.1.4.1 | Process to control procurement of products and services so they conform to the OH&S management system | Header |
| ISO 45001 cl.8.1.4.2 | Coordination with contractors to identify hazards and control risks arising from their activities and from yours affecting their workers, with OH&S criteria applied in selection | Approved scope |
| OSHA 29 CFR 1910.119(h) | Host employer duties for contractors on covered processes: inform them of known process hazards and evaluate their safety performance | Approved scope |
| OSHA 29 CFR 1910.146(c)(8) | Host employer duties when contractors will enter permit-required confined spaces, including informing them of the hazards and the permit programme | Approved scope |
| ISO 45001 cl.7.2 | Competence determined and evidenced for those whose work affects OH&S performance | Explicitly excluded |
| ISO 45001 cl.7.4.1 | Communication process defining what is communicated, when, to whom, including contractors and other visitors | Conditions |
| ISO 45001 cl.8.1.3 | Control of planned temporary and permanent changes affecting OH&S performance | Conditions |
| ISO 45001 cl.7.5.3 | Documented information available and suitable for use where and when it is needed, and controlled | Related records |
What it does not cover
- The approval decision itself, which lives in the Contractor Approval Record and rests on prequalification, safety statistics, insurance and references rather than on the work content.
- The permit to work, which authorises a specific task on a specific shift with specific isolations, and which the scope record only makes possible.
- Individual competence, which belongs in Contractor Competency Verification and the contractor worker register, because a company-level permission says nothing about who turned up.
- Insurance and indemnity adequacy, which is checked in the insurance certificate and indemnity records against the activities this scope actually allows.
- Subcontractor control, which needs the Subcontractor Declaration and verification audit, since scope granted to a contractor is not automatically scope granted to whoever they send.
Global
Contractor Scope Record requirements by country
No jurisdiction requires a document called a contractor scope record. Several require the host to know and to tell the contractor exactly what the boundaries are, which is the same duty arriving without a form attached.
OSH Act; 29 CFR 1910.119(h), 1910.146(c)(8) and (c)(9), 1910.147(f)(2); Multi-Employer Citation Policy CPL 02-00-124
Host and contract employers hold parallel duties, and OSHA cites controlling employers for hazards they could reasonably have prevented.
Being the host who allowed unapproved work is a citable position, and the scope record is the evidence that the boundary existed and was communicated.
CDM Regulations 2015 reg.4 and reg.8; Management of Health and Safety at Work Regulations 1999 reg.11
Clients must appoint only those with the skills, knowledge and experience for the work, and employers sharing a workplace must co-operate and co-ordinate.
The appointment duty is scoped to the work, so an unbounded appointment cannot demonstrate that the appointee was suitable for what they actually did.
Framework Directive 89/391/EEC, articles 6 and 10; Temporary or Mobile Construction Sites Directive 92/57/EEC
Employers sharing a workplace must co-operate, co-ordinate protective measures and inform each other's workers of the risks.
The information duty is mutual and specific, so generic site rules handed over at induction do not discharge it for high-risk activities.
Provincial OHS legislation and the internal responsibility system; Canada Labour Code Part II for federal workplaces
Owners, constructors and employers each carry duties, with the constructor concept concentrating responsibility on projects.
Who holds the constructor role determines who owns the scope boundary, and getting that wrong moves liability rather than removing it.
Model WHS Act s.19 and s.46
A PCBU owes a duty to workers whose activities it influences or directs, and must consult, co-operate and co-ordinate with other duty holders.
Directing a contractor into work outside their approved scope creates a duty for the person who directed it, not only for the contractor.
ISO 45001 cl.8.1.4
Procurement, contractors and outsourcing are treated as one control area with defined criteria and coordination.
Certification auditors trace a contractor from selection criteria through scope to permits, and a missing middle step breaks the chain.
How to complete it
How to complete a contractor scope record, step by step
The fields are mostly yes or no answers, which makes the record fast to complete and easy to complete meaninglessly. Four judgements decide whether it will hold up.
Confined space, ammonia, hot work, height, energy isolation, out-of-hours and lone working are each a separate yes or no, and each yes should have evidence behind it that someone could produce on request. A record with everything set to yes because the contractor might one day need it has approved the site's worst-case exposure to save a future conversation.
The excluded activities field is read at midnight by someone who wants a problem solved. Not approved for ammonia system work of any kind, including isolating valves is useful. Out of scope per approval matrix is not. Add the reason, and use the evidence field to say what would change the answer, so the contractor has a legitimate route to widen scope.
Scope communicated to the contractor prevents them offering. Scope communicated to your own supervisors prevents them asking, and the asking is what actually causes the incidents. Partly is the honest answer in most organisations, and recording partly is more useful than recording a yes that means the file was emailed to a distribution list.
Scope goes stale for a reason: the contract is renewed, the plant changes, the contractor buys a specialist division, or a category of work is quietly added to a purchase order. Tie the review to those events and let the date be the backstop, and make the scope change process something with a named owner rather than a paragraph nobody has tested.
What auditors find
Most common contractor scope record findings
Auditors rarely find this record missing where a contractor programme exists. They find it complete, signed, and unknown to everyone who needed it.
| Finding | Clause | What fixes it |
|---|---|---|
| Contractor observed doing work outside the approved categories, on the instruction of a site supervisor. | ISO 45001 cl.8.1.4.2 | Brief supervisors on the scope of every contractor they can call, and route any widening through the named scope change process. |
| High-risk activity approvals granted without the underlying competence or equipment evidence. | ISO 45001 cl.7.2 | Require the evidence before the field can be set to yes, and reference the competency verification record from the scope. |
| Scope record exists but is not visible at the gate or to the permit issuer. | ISO 45001 cl.7.5.3 | Publish scope alongside the access authorisation so the permit issuer sees the boundary at the moment of issue. |
| Confined space entry approved with no reference to the host permit programme or hazard information given. | OSHA 29 CFR 1910.146(c)(8) | Record what hazard information was provided and when, and link the entry permit programme to the approval. |
| Work on a covered process approved without the contractor being informed of the process hazards. | OSHA 29 CFR 1910.119(h) | Attach the process hazard briefing to the ammonia or covered-process approval and re-brief on renewal. |
| Exclusions blank, so the boundary rests on the absence of an approval rather than a statement. | ISO 45001 cl.7.4.1 | Name the excluded activities explicitly, with the reason, in the words a supervisor would recognise. |
| Scope not updated after the contractor took on a new work category or a new area. | ISO 45001 cl.8.1.3 | Trigger a scope review from contract change and purchase order category change, not from the annual date. |
| Subcontractors working under the main contractor's scope without their own record. | ISO 45001 cl.8.1.4.2 | Require a subcontractor declaration and grant scope to the entity whose workers are on site. |
| Unescorted production area access granted to a contractor with no hygiene or food safety induction. | ISO 45001 cl.8.1.4.2 | Set food production access to escorted until the induction evidence exists, and record who escorts. |
| Record signed by the contract owner alone, with no safety countersignature on high-risk approvals. | ISO 45001 cl.8.1.4.1 | Require the safety lead's second signature wherever any high-risk activity is approved. |
Case in point
Case in point: the scope that was right and unread
A dairy site had a well-run contractor programme. Its refrigeration contractor was approved for mechanical and refrigeration work, in the plant room, chill store and yard, escorted in production areas, approved for out-of-hours work, and explicitly not approved for confined space entry, hot work or work on the ammonia system, because the ammonia approval required a separate competence pack the contractor had never submitted. The scope record was complete, countersigned by the safety lead, and reviewed nine weeks earlier.
At half past one on a Sunday a suction valve on the chill store plant began weeping and the night shift engineer called the refrigeration contractor, who had a call-out arrangement and a gate card. Two technicians attended, isolated the section themselves, and cracked the joint. The release was small and nobody was seriously hurt, but the plant room alarmed, the store was evacuated and the site lost the load. The investigation found that neither technician nor the night engineer had ever seen the scope record. What the night engineer had was the approved contractor list, which showed the company, its tier and its expiry date, and no scope column at all.
The record was not wrong. It had simply never travelled to the place where the decision was made, and the list that did travel there read as a licence. The corrective action was not a better scope record. It was putting scope on the approved list, on the gate card and on the call-out sheet, and making the night engineer's call-out procedure require a scope check before dispatch.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
5 sections
- Reference
- CON-034
- Archetype
- Record
- Record ID
- CSR-2026-000
- Scoring
- Not scored
- Direction
- n/a
- Singleton
- No
- Basis
- ISO 45001 cl.8.1.4
- Links
- Links Vendor
- Tags
- Contractor, Master data
- Sections
- 5
- Fields
- 40
- Follow up fields
- 0
- Repeating sections
- 0
- Links out
- 4
Header
12 fieldsRecord ID*
Auto sequence. Format CSR-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Contractor*
Vendor ID*
Format VEN-0000.
Links to FDN-005 Vendor ID
Approved For What, Exactly
Approval is never blanket. A contractor approved for general mechanical work is not approved to enter a confined space or work on the ammonia plant unless this record says so.
Approval ID*
Links to CON-004 Approval ID
Risk Tier*
- Low3 pts
- Medium2 pts
- High1 pt
- Very high0 pts
Contract Owner*
Approved scope
11 fieldsWork Categories Approved*
Areas Approved*
High Risk Activities Approved
Confined Space Entry Approved*
- No3 pts
- Yes1 pt
Ammonia System Work Approved*
- No3 pts
- Yes1 pt
Hot Work Approved*
- No3 pts
- Yes1 pt
Working At Height Approved*
- No3 pts
- Yes1 pt
Energy Isolation Approved*
- No3 pts
- Yes1 pt
Food Production Area Access*
- No3 pts
- Escorted2 pts
- Unescorted0 pts
Out Of Hours Work Approved*
- No3 pts
- Yes1 pt
Lone Working Approved*
- No3 pts
- Yes0 pts
Explicitly excluded
4 fieldsExcluded Activities
Naming what they may not do is clearer than relying on the absence of approval.
Reason For Exclusion
Could Be Approved With Evidence
- Yes3 pts
- No1 pt
Evidence Required
Related records
1 fieldApproved List ID
The list entry this scope belongs to.
Links to CON-033 List ID
Conditions
12 fieldsSupervision Requirement*
- Ours at all times3 pts
- Their supervisor2 pts
- Periodic checks1 pt
Permit Requirements
Escort Required*
- Always3 pts
- In production areas2 pts
- No1 pt
Special Conditions
Scope Communicated To Contractor*
- Yes3 pts
- No0 pts
Scope Communicated To Our Supervisors*
Supervisors asking a contractor to do something outside scope is a common route to an incident.
- Yes3 pts
- Partly1 pt
- No0 pts
Scope Change Process Explained*
- Yes3 pts
- No0 pts
Review Date*
Contract Owner*
Signature*
Safety Lead*
Second Signature*
CON-034 · record IDs look like CSR-2026-000 · Links Vendor
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The record is a short form and it is rarely the problem. What fails is the distance between it and the gate, the permit desk and the night shift phone, and the change nobody routed back to it.
Holds scope against the approved list and the vendor register, so a contractor's permissions travel with their name wherever it appears operationally.
Checks the permit being issued against the approved scope, so a hot work or confined space permit cannot be raised for a contractor who does not hold that approval.
Binds work orders and call-outs to the contractor's scope, so dispatching a contractor to a job outside it surfaces before anyone travels.
Watches contract changes, violations and incidents for events that should reopen a scope record, and raises the review rather than waiting for the date.
This template lives in KnowContractor — contractor management. Prequalification, approval, induction, permits and performance.
Meet KnowContractor→Glossary
Contractor Scope Record definitions and key terms
- Approved scope
- The bounded set of work categories, areas, activities and conditions a contractor may work within, granted at company level and consumed by permits.
- Explicit exclusion
- A named activity the contractor may not perform, recorded with a reason, so the boundary does not depend on someone noticing an absence.
- Scope creep
- Work drifting beyond what was approved, usually because the contractor is already on site and the request is small, urgent and verbal.
- Risk tier
- The classification that sets how much assurance a contractor needs, from documentation checks to audits and supervision, and which drives review frequency.
- High-risk activity
- Work with its own regulatory regime, such as confined space entry, hot work, energy isolation, working at height, excavation or ammonia work, approved individually.
- Permit to work
- The task-level authorisation issued on the day, which can only be issued within an existing scope and never as a substitute for one.
- Host employer duty
- The obligation on the organisation controlling the workplace to identify hazards, inform contractors of them, and control the risks it creates for their workers.
- Escorted access
- Entry permitted only in the company of a named host employee, used where hygiene, process or emergency knowledge cannot be assumed.
FAQ
Frequently asked questions about contractor scope record
Isn't scope already in the contract?+
The commercial scope is. It describes deliverables, rates and terms, and it is written by people who are not thinking about confined spaces. The safety scope answers a different question in different language, and the two diverge as soon as a variation order is raised. Keep them linked but separate, and treat the safety scope as the one the permit issuer reads.
Who owns this record, procurement or safety?+
Procurement maintains it, safety countersigns the high-risk parts, and the contract owner is accountable for it being current. That split matters: procurement knows when the arrangement changes, safety knows what evidence a confined space approval needs, and neither on their own produces a record that is both up to date and defensible.
Can a contractor be approved for everything?+
In principle, if the evidence exists for every activity. In practice a scope with every high-risk field set to yes is almost always a record filled in to avoid future friction, and it is the first thing an investigator will read after an incident. If a contractor genuinely needs the whole set, the evidence pack should be visible from the record.
What happens when a supervisor needs work done that is out of scope?+
The work waits, or the scope changes properly. That is the whole point of the scope change process field, and if the honest answer is that the work would go ahead, the record is describing an intention rather than a control. Name a person who can widen scope out of hours, give them a decision route, and the informal path stops being the only one available.
Do we need a separate record per site?+
Yes, wherever the hazards, areas or access rules differ, which is almost always. The areas and food production access fields are site-specific by nature, and a single record spanning three plants will be correct for one of them and misleading for the other two.
How often should scope be reviewed?+
On contract renewal, on any change to the work being bought, after any violation or incident involving that contractor, and at the stated review date as a backstop. The events matter more than the date, because they are what makes the existing record wrong.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Contractor Onboarding and Management
Contractor Prequalification Questionnaire
Collects a contractor's safety, insurance, training and performance information before they are approved
Contractor Safety Statistics Review
Reviews a contractor's injury rates, citations and experience modifier over recent years
Contractor Risk Classification
Classifies a contractor by the risk of the work they do, from low risk services to high risk construction
Contractor Approval Record
Records the decision to approve a contractor to work on site
Contractor Safety Program Review
Reviews the contractor's own written safety programme against your requirements
Subcontractor Declaration
Records any subcontractors a contractor intends to use
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 45001:2018 clause 8.1.4, procurement, contractors and outsourcing
- OSHA 29 CFR 1910.119(h), contractors on covered processes (US)
- OSHA 29 CFR 1910.146(c)(8) and (c)(9), host and contractor duties for permit spaces (US)
- OSHA Multi-Employer Citation Policy, CPL 02-00-124 (US)
- Construction (Design and Management) Regulations 2015, regulations 4 and 8 (GB)
- Management of Health and Safety at Work Regulations 1999, regulation 11 (GB)
- Model WHS Act sections 19 and 46, duty to consult, co-operate and co-ordinate (Australia)
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.