ISO 45001 Clause 8.1.4: Procurement and External Work
ISO 45001:2018 clause 8.1.4 requires control of procurement, contractor interfaces and outsourced functions or processes. It recognises that OH&S decisions are often shaped before work begins, when products and services are specified and providers selected. The organisation must connect commercial arrangements with the controls needed where work occurs.
What clause 8.1.4 requires in practice
Clause 8.1.4 groups three related duties under the heading of procurement. First, a process to control purchased products and services so that they fit the OH&S management system. Second, coordination of the organisation's procurement arrangements with its contractors, so that hazards are identified and risks assessed and controlled in three directions: contractor work affecting the organisation, the organisation's work affecting contractor workers, and contractor work affecting other people at the workplace. Contractors and their workers must meet the system's requirements, and selection must use defined OH&S criteria. Third, outsourced functions and processes must be kept under control, with the type and degree of control defined in the system and consistent with legal and other requirements and the intended outcomes.
The output is a connected arrangement across buying, interfaces and outsourced work, not three separate checklists.
8.1.4.1: include OH&S requirements in procurement
Establish processes that control purchased products and services so they conform to the OH&S system. Involve relevant users and technical competence when specifying a need, especially where a purchase will change working conditions or introduce new equipment, substances or activities.
A practical specification describes the intended use and relevant workplace conditions, then identifies what information is needed to evaluate suitability. Confirm how delivery, installation, use and subsequent support will be addressed where relevant. A familiar supplier or a standard purchasing description may not answer the actual OH&S question.
Why clause 8.1.4 matters to the business
A large share of workplace risk now arrives from outside: equipment bought on specification and price, contractors who work beside your people, services run from another location. If these decisions are made without OH&S input, the organisation inherits hazards it never assessed and often remains accountable for them. Clear procurement control protects workers and visitors, reduces disputes with providers about who was responsible, and avoids costly retrofits after delivery. It also supports customers who ask how you manage the safety of the work done on their behalf. For multi-site groups, shared buying criteria with local adaptation keep standards consistent without ignoring local conditions.
How to implement clause 8.1.4
Start by mapping where outside parties influence your work, then match the level of control to the consequence. A workable sequence follows. Keep the effort proportionate: a short service with little interaction needs lighter handling than a complex outsourced process, and the reasons for each choice should be explainable to an auditor and to the workers affected.
- Identify the purchases, contractors and outsourced functions that can change hazards, and rank them by how much they could affect people.
- Add OH&S questions to the specification stage for significant purchases, with users and competent specialists involved before a supplier is chosen.
- Define selection criteria for contractors that relate to the actual work, and apply them consistently.
- Agree with each contractor who coordinates what, how changes and concerns are raised, and how the emergency interface works.
- Decide the type and degree of control for each outsourced function and write it into the way the system operates.
- Check delivered items and services against what was specified before they enter use.
- Review actual performance after the work, including worker feedback, and use it to improve the next specification.
Illustrative manufacturing example: buying equipment for a constrained area
A hypothetical manufacturer selects new equipment based on capacity and price. Before purchase is finalised, operations and competent specialists examine the intended location, interaction with workers and other activities, maintenance needs and relevant requirements. Worker input helps identify practical conditions missing from the initial specification.
The company records the reviewed requirements, provider information and authorised selection. It also plans appropriate checks before use. Evidence links the commercial decision with the operational assessment. This example does not specify machine guarding, installation methods or technical acceptance tests; those require the actual equipment and expertise.
8.1.4.2: coordinate risks in both directions
Contractor coordination addresses their activities affecting the organisation, the organisation's activities affecting contractor workers and contractor activities affecting others in the workplace. Define and apply OH&S selection criteria, and ensure contractors and their workers meet relevant system requirements.
Do not reduce coordination to a one-way induction. Both parties may hold information the other needs. Establish responsibilities for changes, supervision, concerns, incidents and emergency interfaces as relevant to the work. Competence and control evidence should suit the activity, rather than depend on a standard folder collected from every provider regardless of risk.
Illustrative IT example: a contractor in an occupied server facility
A fictional IT operator appoints a specialist contractor for maintenance in a facility used by its own staff. Selection considers relevant capability, while operational planning examines interaction with occupied areas and ongoing services. Each party explains the conditions under its control and the information the other needs.
The agreed arrangement identifies responsible contacts and a route for changes or unexpected conditions. Later review checks whether the coordination operated as planned, including feedback from people doing the work. The company's records do not become proof of the contractor's technical safety solely because they are complete; competent evaluation remains necessary.
8.1.4.3: define control of outsourced functions
Outsourced functions and processes must be controlled. Define the type and degree of control within the OH&S system, ensuring the arrangement remains consistent with legal and other requirements and intended outcomes. An outsourced function may operate away from the organisation's premises, so the control approach may differ from that used for a visiting contractor.
Consider what decisions remain with the organisation, which are made by the provider and how relevant information moves between them. If a provider changes its method or subcontracting arrangement, determine whether the original basis of control remains valid. The contract should support effective practice rather than become the only evidence examined.
Choose controls proportionate to the contribution
Different providers need different evaluation and oversight. The organisation should explain why its approach fits the hazards, interfaces and responsibilities involved. A short service with limited interaction and a complex outsourced process should not automatically receive identical scrutiny. Relevant legal and other requirements remain a necessary part of that decision.
For groups operating across countries, shared procurement criteria can establish a baseline while local owners identify requirements and conditions that differ. Ensure a central approval does not prevent a local team from raising a suitability concern. Equally, significant local learning should reach those responsible for wider provider decisions.
Evidence and mistakes to avoid
The clause does not prescribe one prequalification questionnaire or permit format. Useful evidence includes defined criteria, evaluated provider information, agreed interfaces and records of control in practice. Operational and other information requirements still apply. An auditor may follow a current job from selection through coordination and review.
Common gaps include selecting on price before assessment, collecting evidence unrelated to the task, ignoring the organisation's effect on contractor workers and leaving outsourced control undefined. Use feedback from actual work to improve future specifications and selection, rather than treating procurement as complete when the order is issued.
Explore each numbered part
8.1.4.1 · bring OH&S into purchasing decisions
Purchasing can introduce hazards or make controls easier to apply. Clause 8.1.4.1 requires procurement processes for products and services to support conformity with the OH&S system. This guide explains early requirements, suitable review and acceptance, with examples that show why a low price or supplier certificate alone cannot establish suitability for the intended work.
8.1.4.2 · coordinate contractor risks at the work interface
Contractor control depends on coordination of the actual work, not only prequalification documents. Clause 8.1.4.2 addresses risks flowing between contractor activities, the organisation and other affected parties, and requires OH&S selection criteria. This guide explains practical interfaces, communication and verification without assuming that a contract transfers all responsibility or that one employer controls every decision.
8.1.4.3 · retain control of outsourced functions
Outsourcing changes who performs a function, but does not make the function irrelevant to the OH&S system. Clause 8.1.4.3 requires control consistent with applicable requirements and intended outcomes. This guide explains how to define the type and degree of control, manage interfaces and evaluate evidence without assuming that a provider’s contract or certificate is sufficient.
Frequently asked questions
Does a contractor's ISO 45001 certificate remove our checks?
No. It may inform evaluation, but does not prove that this particular work and interface meet the organisation's needs or applicable requirements.
Are procurement and outsourcing identical?
No. Procurement is broad; outsourcing concerns a function or process performed externally. The relevant provisions can overlap, but the control responsibilities need explicit consideration.
Must every contractor receive the same induction?
Relevant information should reflect the actual activity, workplace and risks. A common introduction may help, with additional task and interface information where needed. For the contractor workflow specifically, see Sterling’s contractor management guide . Keep that task-level coordination connected with the broader procurement and outsourcing decisions explained here.
Make external-work arrangements reviewable
Discuss procurement and contractor-control support with Sterling, including documentation, employee learning and agreed Effivity ISO & GRC automation software. Independent bodies decide certification. Enrol in ISO 45001 Awareness for a common foundation; it does not replace provider evaluation or task competence.
Return to clause 8 operational control or the requirements overview; follow significant findings into incident investigation and corrective action.
Connect this topic with the wider clause 8.1 process and the complete ISO 45001 requirements guide.