ISO 45001 contractor management: prequalification, induction, permits and the records auditors test

Where contractor management sits in ISO 45001

ISO 45001:2018 deals with contractors in clause 8, Operation, under 8.1.4 Procurement. That clause has three parts: a general part, 8.1.4.2 Contractors and 8.1.4.3 Outsourcing. The placement makes sense: the risk is largely set when a contractor is chosen and the job specified.

The second anchor is the definition of a worker: a person performing work or work-related activities under the control of the organisation. Consultation and participation (5.4), awareness (7.3), the hierarchy of controls (8.1.2) and incident investigation (10.2) therefore reach contractor staff as well as employees.

Whether contractors and agency staff sit inside the boundary of the certificate is a scoping decision, explained in ISO 45001 scope: sites, workers, contractors and the mistakes that cost you. This guide assumes they do and deals with how you control them.

Prequalification: choosing contractors who can work safely

Prequalification is the check made before a contractor is approved for a type of work: enough evidence to judge that this firm can do this job safely. Tiers work better than one questionnaire for every supplier, and the work decides the tier, not the contract value.

Two points make prequalification credible at audit. First, someone competent reviews the answers and records the decision, including any conditions such as closer supervision for the first job. Second, the approved list has an expiry: a contractor approved years ago on documents that have since lapsed is not approved in any meaningful sense. Subcontractors face the same questions, and the contract should say so.

Induction and task briefing before work starts

Approval is about the firm; induction is about the individuals who turn up. A site induction covers site hazards, emergency arrangements, reporting routes and site rules; it is given to each person, recorded by name and repeated periodically.

The induction is also where a contractor worker should hear, plainly, that they can remove themselves from a situation they believe presents imminent and serious danger, and how to report a hazard, a near miss or a concern.

A task briefing then follows for the specific job: the method statement, the permit conditions, interfaces with your own operations, and who to call. Deliver both in a language the crew understands. An auditor who asks a contractor to explain the emergency route will soon find out whether that happened.

Permits to work and supervision of high-risk tasks

A permit to work is the written control that authorises a defined high-risk task, at a defined place and time, once named precautions are in place. Permits for high-risk tasks are among the most common pieces of ISO 45001 evidence, yet the standard does not prescribe a permit format, so the system has to fit your hazards.

A permit that works in practice has a small number of features:

• a clear list of tasks that need one, such as hot work, confined space entry, work at height above a set threshold, electrical and mechanical isolation, excavation and lifting;
• an issuer who is trained and authorised, separate from the person doing the work;
• precautions chosen in the order of the hierarchy of controls, with elimination and engineering measures before permits lean on personal protective equipment;
• checks at the workplace before signing, at set intervals and at shift change, with a handover when the job passes to a new crew;
• formal hand-back and close-out, confirming the area is safe and isolations are removed.

Supervision is the other half. Someone from your side checks that the method statement is followed, permit conditions hold and the crew is the one inducted. When the job changes in a way nobody planned, the management of change arrangements in 8.1.3 apply to contractor work as they do to your own.

Monitoring, incidents and close-out

Contractor incidents and near misses go into the same reporting system as your employees' and are investigated the same way, with the people involved taking part. Where the root cause lies in how the job was specified, prequalified or permitted, the corrective action belongs to you, not only to the contractor.

A short performance review at the end of a significant job closes the loop and updates the approved list. Repeated permit breaches mean conditional approval or removal. Contractor performance also belongs in the inputs to management review, which is covered in ISO 45001 management review: inputs, outputs and the record.

Auditors tour the workplaces during the certification audit. Contractor personnel under your control also count in the effective headcount used to set audit time, and a large temporary contractor presence is one of the factors that can add days, so expect the certification body to look for contractors on site and follow a job through its records.

A worked example: replacing a roof fan at a distribution centre

The example below follows one medium-sized job through the chain. It is illustrative, not a client case.

Where contractor controls break down

• Paper prequalification. Questionnaires collected, never assessed, never renewed.
• One questionnaire for everyone. High-risk trades pass on the same checklist as caterers.
• Inducting the supervisor, not the crew. The people on the tools never hear the site rules.
• Permits signed in the office. Nobody checks the precautions at the workplace before work starts.
• Invisible subcontractors. The approved firm sub-lets the job and nobody knows who is on the roof.
• Contractor incidents kept outside the system. Near misses go to the contractor's head office and never reach your investigation or your risk assessment.

The hazards of the task itself are assessed as described in ISO 45001 hazard identification and risk assessment; the legal duties you share with contractors belong in ISO 45001 legal register and evaluation of compliance.

ISO 45001 contractor management: questions buyers ask