What this is
What is a subcontractor verification audit?
What is a subcontractor verification audit?
A subcontractor verification audit is an independent check that a subcontractor named in a declaration has actually been prequalified, insured, competency-checked and inducted to a standard comparable to the main contractor's, rather than simply asserted to have been. It exists because a declaration is self-reported and cannot verify itself.
How is this different from a subcontractor declaration?
The declaration is what the main contractor says about the subcontractors it uses. The audit is the site's own check of whether that is true, run against evidence rather than the contractor's word, and it is where the gap between declared and actual arrangements is found.
When is a subcontractor verification audit run?
On the audit schedule for higher-risk work, and whenever a finding elsewhere, an incident, a site audit, a near miss, suggests the chain of responsibility below the main contractor may not be intact.
Scope
When is a subcontractor verification audit required?
This audit checks the subcontractor layer specifically. Running it on the main contractor's own arrangements duplicates a different audit and misses the layer it exists to see.
Use this template when
- Subcontractors are being used on work classified as higher risk
- A declaration exists but has not been independently checked against evidence
- A site audit, incident or near miss has raised a question about who is doing the work below the main contractor
- Second-tier subcontracting is suspected or has been flagged elsewhere
- The audit schedule calls for a subcontractor-layer check as part of the contractor programme
Do not use it for
- Contractor Site Safety Audit, which audits the main contractor's own work against its method statement, not the subcontractor layer beneath it.
- Contractor Documentation Audit, which checks that the main contractor's own records are complete, rather than a subcontractor's.
- Contractor Equipment Verification, which checks equipment condition and certification, not who is vetted to use it.
- Subcontractor Declaration, the self-report this audit independently checks, not a substitute for the check itself.
- Anything outside KnowContractor, which belongs in the workspace that owns that process.
Compliance mapping
Which ISO 45001 cl.8.1.4 requirements does this satisfy?
ISO 45001 clause 8.1.4 does not distinguish a contractor from its subcontractor; the obligation to control the risk runs to whoever is doing the work, which is why this audit exists as a distinct instrument from checking the main contractor.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001 cl.8.1.4.2 | Coordination with contractors, including subcontracted arrangements, to identify and control OH&S risks | Declaration and approval |
| ISO 45001 cl.8.1.4.3 | Control of outsourced functions and processes so they do not adversely affect intended OH&S outcomes | Their arrangements |
| ISO 45001 cl.5.4 | Consultation and participation of workers, including contracted workers, in matters affecting their health and safety | Observed practice |
| ISO 45001 cl.7.4 | Communication of relevant OH&S information to external providers and other interested parties | Observed practice |
| ISO 45001 cl.9.2 | Internal audit programme providing information on conformity and effective implementation of the OH&S system | Findings |
| ISO 45001 cl.9.1.1 | Monitoring, measurement, analysis and evaluation of performance, including compliance obligations | Result |
| ISO 45001 cl.10.2 | Reaction to nonconformity, evaluation of the need for corrective action, and implementation of action taken | Result |
What it does not cover
- Contractor Site Safety Audit, which audits the main contractor's own conduct against its method statement, not the subcontractor tier.
- Contractor Documentation Audit, which checks completeness of the main contractor's own records rather than a subcontractor's vetting.
- Contractor Equipment Verification, a distinct check of equipment condition and certification, not personnel vetting.
- Subcontractor Declaration, the self-report this audit exists to independently test, not a record it replaces.
- Contractor Prequalification Questionnaire, the underlying vetting process, which this audit checks was extended to the subcontractor rather than performing it itself.
Global
Subcontractor Verification Audit requirements by country
No jurisdiction names a subcontractor verification audit specifically. What differs is how directly the duty to verify, rather than merely require, contracted arrangements is attached in law and guidance.
OSHA multi-employer worksite policy (CPL 02-00-124)
A controlling employer's exposure to citation for a subcontractor's hazard depends on the reasonableness of its oversight, not the existence of a contract requiring compliance.
An audit that finds oversight was not exercised is evidence the controlling employer's duty was not discharged.
HSE guidance on managing contractors (INDG368) and MHSWR reg.3
Duty holders are expected to check, not merely require, that competence extends down the contracting chain.
A declaration accepted without verification does not satisfy the duty; the check, not the paperwork, is what the guidance expects.
ISO 45001 cl.8.1.4 and cl.9.2
Coordination with contractors must be applied and its effectiveness verified through the organisation's own audit programme.
Certification auditors look for evidence that subcontractor arrangements were tested, not just documented as required.
How to complete it
How to complete a subcontractor verification audit, step by step
Every item can pass individually while the thing this audit exists to verify, that the chain of responsibility actually reaches the subcontractor, remains broken.
Where the main contractor says it prequalified the subcontractor, ask for the evidence directly rather than relying on its own prequalification file. A subcontractor prequalified only on the main contractor's say-so has not been prequalified in any sense that survives scrutiny.
A subcontractor using the main contractor's induction, method statement and supervision has been absorbed into that system rather than holding an equivalent one of its own. Score that as weaker unless oversight of it is demonstrably continuous, not assumed.
This is the layer routinely missed by the declaration and the layer this audit exists to find. A subcontractor engaging its own subcontractor without disclosure breaks the chain of responsibility regardless of how well the tiers above otherwise perform.
A high compliance score against a half-completed audit means most of the arrangement was never examined. Report completeness alongside the result, and treat a low figure as a finding in its own right, not a footnote.
What auditors find
Most common subcontractor verification audit findings
The declaration usually exists and looks complete. The findings are almost always about what its own evidence could not show.
| Finding | Clause | What fixes it |
|---|---|---|
| Subcontractor prequalification claimed by the main contractor with no independent evidence produced to the auditor. | ISO 45001 cl.8.1.4.2 | Require the subcontractor's own prequalification documents to be sighted, not the main contractor's assertion. |
| Second-tier subcontracting found on site that was not disclosed in the declaration or previously identified. | ISO 45001 cl.8.1.4.3 | Escalate as a chain-of-responsibility failure, not a documentation gap, and re-open the declaration. |
| Subcontractor's safety standard is entirely the main contractor's, with no independent documentation of its own. | ISO 45001 cl.8.1.4.3 | Score the arrangement as weaker rather than comparable, and require evidence of independent competency management. |
| Subcontractor workers not included in toolbox talks, emergency arrangements or stop-work authority briefing. | ISO 45001 cl.7.4 | Extend site communication and emergency briefing to subcontractor workers, and verify it rather than assuming it. |
| Audit completed with a high compliance score but a low completeness percent, leaving most arrangements unexamined. | ISO 45001 cl.9.1.1 | Do not close the audit on compliance percent alone; require completeness above an agreed threshold. |
| Finding raised at audit with no corrective action tracked to closure. | ISO 45001 cl.10.2 | Raise a CAPA for every fail result and verify closure with evidence, not recollection. |
Case in point
Case in point: comparable on paper, absent in practice
A logistics site rated a refrigeration subcontractor as working to a standard comparable to the main contractor's, because its two technicians used the main contractor's induction, wore its issued PPE, and were on the worker register. The declaration had been accepted at face value for three consecutive renewals.
A verification audit, prompted by an unrelated near miss elsewhere on site, found the subcontractor held no safety documentation of its own, had never independently verified its technicians' refrigerant handling competency, and relied entirely on a supervisor frequently occupied elsewhere to notice if something was wrong. The technicians knew who to report to but had never been told they held stop-work authority. Nothing was fraudulent; it had simply never been tested, because the declaration had been treated as the answer rather than the question.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
7 sections
- Reference
- CON-028
- Archetype
- Audit
- Record ID
- AUD-2026-000
- Scoring
- Compliance percent
- Direction
- High is good
- Singleton
- No
- Basis
- ISO 45001 cl.8.1.4
- Links
- Links Vendor; feeds Finding
- Tags
- Contractor, Audit
- Sections
- 7
- Fields
- 57
- Follow up fields
- 9
- Repeating sections
- 1
- Links out
- 6
Header
12 fieldsAudit ID*
Auto sequence. Format AUD-2026-00000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Contractor*
Vendor ID*
Format VEN-0000.
Links to FDN-005 Vendor ID
Follow The Chain Down
Your controls stop at the main contractor unless you check further. Subcontractors are usually smaller, less resourced and doing the more hazardous parts of the work.
Subcontractor Name*
Work They Perform*
Auditor*
Declaration and approval
6 fieldsDeclared To Us*
- Yes3 pts
- No0 pts
Declaration ID
Links to CON-006 Declaration ID
Approved Before Starting*
- Yes3 pts
- Retrospectively1 pt
- No0 pts
Main Contractor Prequalified Them*
- Yes3 pts
- Partly1 pt
- No0 pts
Evidence Of That Process*
- Yes3 pts
- Claimed only1 pt
- None0 pts
Standard Comparable To Ours*
- Yes3 pts
- Weaker1 pt
- Much weaker0 pts
Their arrangements
9 fieldsOwn Insurance Verified*
- Yes3 pts
- Covered by main contractor2 pts
- No0 pts
Workers Compensation Clearance*
- Current3 pts
- Pending1 pt
- Not held0 pts
Own Safety Documentation*
- Yes3 pts
- Uses main contractor's2 pts
- None0 pts
Workers Inducted By Us*
- Yes3 pts
- No0 pts
On Our Worker Register*
- Yes3 pts
- No0 pts
Competency Verified*
- Yes3 pts
- Partly1 pt
- No0 pts
Covered By Main Contractor Method Statement*
- Yes3 pts
- Partly1 pt
- No0 pts
Supervised By Main Contractor*
- Yes, on site3 pts
- Remotely1 pt
- No0 pts
Second Tier Subcontracting Found*
- No3 pts
- Yes0 pts
Observed practice
6 fieldsWorking To The Same Standard*
- Yes3 pts
- Partly1 pt
- No0 pts
Included In Toolbox Talks*
- Yes3 pts
- Sometimes1 pt
- No0 pts
Included In Emergency Arrangements*
- Yes3 pts
- Partly1 pt
- No0 pts
Aware Of Stop Work Authority*
- Yes3 pts
- Unsure1 pt
- No0 pts
Know Who To Report To*
- Yes3 pts
- Unsure1 pt
- No0 pts
Treated As Part Of The Team*
- Yes3 pts
- Partly1 pt
- No0 pts
Findings
Repeats7 fieldsResult*
- Pass3 pts
- Pass with conditions2 pts
- Fail0 pts
Severity
- Minor3 pts
- Moderate1 pt
- Serious0 pts
Element Tag
Groups deficiencies by hazard type across every template.
Deficiency Detail
Photo Evidence
Fixed On The Spot
Finding ID
Raise a finding record where this needs tracking to closure.
Links to FDN-015 Finding ID
Related records
1 fieldSite Audit ID
The audit that identified the subcontractor.
Links to CON-025 Audit ID
Result
16 fieldsItems Assessed*
Excludes anything marked N/A.
Items Failed*
Score Percent*
Calculated on submission. High is good. N/A items leave the denominator.
Result Band*
- Pass3 pts
- Caution1 pt
- Fail0 pts
Completeness Percent*
How much of the template was actually answered. A high score on a half completed form is not a high score.
Chain Of Responsibility Intact*
- Yes3 pts
- Partly1 pt
- No0 pts
Main Contractor Accountable*
- Yes3 pts
- Partly1 pt
- No0 pts
Subcontractor Permitted To Continue*
- Yes3 pts
- With conditions1 pt
- No0 pts
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Auditor*
Signature*
Contract Owner*
Second Signature*
CON-028 · record IDs look like AUD-2026-000 · Links Vendor; feeds Finding
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The audit is a point-in-time check. What fails around it is the finding that never gets tracked to closure, and the arrangement that looks comparable on paper because nobody asked what it rests on.
Holds the audit against the declaration it is checking and the vendor register, and flags where an audited subcontractor has no declared entry.
Routes fail findings, especially second-tier subcontracting and missing stop-work briefing, into the site hazard register.
Checks that competency records the audit accepted as evidence actually belong to the subcontractor named, not the main contractor.
Tracks every fail and CAPA from this audit to closure, and flags a subcontractor for re-audit sooner if a related incident occurs.
This template lives in KnowContractor — contractor management. Prequalification, approval, induction, permits and performance.
Meet KnowContractor→Glossary
Subcontractor Verification Audit definitions and key terms
- Chain of responsibility
- The unbroken line of accountability from the site through the main contractor to every subcontractor tier below it, which this audit exists to test.
- Comparable standard
- A subcontractor's own safety, competency and supervision arrangements judged equivalent to the main contractor's, not borrowed wholesale from it.
- Second-tier subcontracting
- A subcontractor engaging its own subcontractor, one layer further removed from the arrangement the site originally approved.
- Completeness percent
- The proportion of the audit actually answered, distinct from the compliance score, which only measures items that were assessed.
- Stop-work authority
- The recognised right of any worker, including a subcontractor's, to halt unsafe work, meaningless if the worker was never told they hold it.
FAQ
Frequently asked questions about subcontractor verification audit
Why audit subcontractors separately from the main contractor?+
Because the main contractor's own standard says nothing about a subcontractor's. Controls that stop at the party holding the contract routinely miss the smaller, less-resourced organisation performing higher-risk parts of the work.
Is a declaration sufficient without this audit?+
For lower-risk work it may be proportionate. For higher-risk work it is not, because a declaration is self-reported and this audit exists to test whether what was declared is true against evidence, not against the contractor's assurance.
What counts as evidence of the subcontractor's own prequalification?+
Documents produced by or verified independently against the subcontractor itself, insurance certificates in its name, its own training records and safety documentation, rather than the main contractor's file about having checked them.
How should second-tier subcontracting be handled if found during the audit?+
As a finding in its own right, not a note. It means the declaration being checked was incomplete, and the corrective action should reopen the declaration as well as address the subcontractor found.
What does a low completeness percent mean for the result?+
That most of the audit was not actually attempted, which makes any compliance score reported alongside it unreliable. A pass built on a low completeness figure has verified very little.
Who should carry out this audit?+
The contract owner, working independently of whoever accepted the original declaration. An audit run by the same person who signed off the declaration tends to confirm their own prior judgement rather than test it.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Contractor Onboarding and Management
Contractor Prequalification Questionnaire
Collects a contractor's safety, insurance, training and performance information before they are approved
Contractor Safety Statistics Review
Reviews a contractor's injury rates, citations and experience modifier over recent years
Contractor Risk Classification
Classifies a contractor by the risk of the work they do, from low risk services to high risk construction
Contractor Approval Record
Records the decision to approve a contractor to work on site
Contractor Safety Program Review
Reviews the contractor's own written safety programme against your requirements
Subcontractor Declaration
Records any subcontractors a contractor intends to use
More in Contractor Audits
Contractor Site Safety Audit
Audits a contractor's work on your site against their method statement and your requirements
Contractor Documentation Audit
Audits whether the contractor's records, permits and training evidence are complete and current
Contractor Equipment Verification
Checks that contractor equipment brought on site is inspected, certified and fit for use
Contractor Audit Follow Up
Checks whether a contractor has closed the actions raised in a previous audit
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 45001:2018 clauses 8.1.4, 9.2 and 10.2
- HSE INDG368 — Managing contractors: a guide for employers
- OSHA CPL 02-00-124 — Multi-Employer Citation Policy
- Management of Health and Safety at Work Regulations 1999, regulation 3 (GB)
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.