A Guide to Contractor Management Compliance

A contractor arrives on site with an expired licence, an unfamiliar subcontractor and a SWMS copied from another job. If your team allows work to start without checking those details, the exposure does not sit solely with the contractor. This guide to contractor management compliance explains how Australian businesses can establish practical controls that protect people, directors and commercial relationships.

Contractor management is often treated as a procurement task or a folder of prequalification documents. That approach fails when the contractor’s work intersects with your workplace, your plant, your people or your clients. Effective compliance is a working system: it verifies capability before engagement, controls risk during delivery and records evidence that decisions were reasonable.

Why contractor compliance is a business-critical control

Under Australian WHS laws, a person conducting a business or undertaking has a primary duty of care, so far as is reasonably practicable, for workers and others affected by the work. That duty can extend to contractors and subcontractors. Officers also have due diligence duties. They need to understand the business’s risks and ensure appropriate resources and processes are in place to manage them.

This does not mean a principal contractor or client must perform every contractor’s task. It means the business must take reasonable steps to select competent providers, communicate site risks, coordinate activities and intervene when work becomes unsafe.

The commercial case is equally clear. Major clients and Tier 1 supply chains increasingly assess contractor controls during tendering, onboarding and audit. A business that can show current records, clear responsibilities and consistent monitoring is easier to approve. A business relying on informal assurances can lose work, even where its field teams perform well.

Start with a risk-based contractor framework

Not every contractor requires the same level of scrutiny. A cleaner working after hours and a contractor undertaking confined-space entry present very different risk profiles. Applying the same approval process to both can create unnecessary administration at one end and inadequate control at the other.

Classify contractors according to the work they perform, the environment they enter and the potential consequences of failure. Consider whether they work around mobile plant, hazardous chemicals, electrical systems, public areas, heights, high-pressure equipment or environmentally sensitive locations. Also consider whether they will engage subcontractors, because supply-chain visibility can quickly diminish beyond the first contract.

A simple three-tier model is often effective. Low-risk contractors require basic business and insurance checks plus site rules. Medium-risk contractors need documented competency evidence, task-specific risk controls and induction. High-risk contractors require deeper assessment, formal work planning, verification of licences and qualifications, regular supervision and defined hold points before critical work begins.

The point is not to create more paperwork. It is to direct management effort where the risk warrants it.

Prequalify contractors before the work is awarded

Prequalification should test whether the contractor can safely and reliably perform the scope, not whether it can complete a questionnaire. Documents are useful evidence, but they should be assessed against the actual work being purchased.

For most contractor categories, the review should cover business registration, relevant insurances, WHS policies and procedures, incident history, worker competency, licences, plant records and emergency arrangements. Environmental controls may also be necessary where the work can create spills, dust, noise, waste, emissions or contamination.

For higher-risk work, ask more focused questions. How will isolations be managed? Who verifies a working-at-heights rescue plan? What controls prevent interaction between forklifts and pedestrians? How are subcontractors approved and supervised? Generic answers are a warning sign. A capable contractor should be able to explain controls in terms of the proposed site and scope.

Insurance certificates and licences must be current, but current documents alone do not establish competence. A contractor may hold the right cover while lacking adequate supervision, plant maintenance or task planning. Prequalification therefore needs both document review and professional judgement.

Set approval conditions clearly

Approval should have an owner, a validity period and a defined scope. If a contractor was approved for office maintenance, that approval should not automatically extend to hot work in a production area.

Record any conditions of engagement, such as supplying a project-specific SWMS, completing an induction, providing plant inspection records or using nominated competent persons. Make it clear that work cannot commence until those conditions are met. This avoids the common situation where operations are ready to proceed but compliance evidence is still being chased by email.

Build compliance into the contract and mobilisation process

A strong contractor management system connects commercial terms with site controls. Purchase orders, service agreements and contractor agreements should define WHS responsibilities, insurance requirements, incident notification expectations, subcontracting conditions, access rules and the right to stop unsafe work.

The contract should not simply state that the contractor is responsible for safety. That wording may be commercially convenient, but it does not remove your organisation’s WHS duties. Instead, it should establish how both parties will consult, cooperate and coordinate activities.

Before mobilisation, hold a practical planning discussion for material work. Confirm the scope, work sequence, interfaces with your operations, site hazards, emergency arrangements, traffic management and escalation contacts. This is particularly important where multiple trades are working at the same time or operations must continue while work is performed.

Induction should reinforce the controls that matter at your site. A generic online module may satisfy a baseline requirement, but it cannot replace a briefing on local exclusion zones, muster points, permit systems, hazardous areas or client-specific rules. Keep attendance records, but also check comprehension where the work is high risk or workers have limited familiarity with the site.

Monitor the work, not just the paperwork

Many contractor systems are strongest at onboarding and weakest once work starts. Compliance can drift quickly when schedules tighten, supervisors change or subcontractors arrive after the original approval.

Site monitoring should be planned around risk. For low-risk, short-duration work, a supervisor may only need to confirm induction and completion. For higher-risk activities, regular inspections, permit checks, pre-start observations and verification of critical controls are appropriate.

Focus observations on the conditions that could cause serious harm. Are workers using the required controls? Is plant being operated by authorised personnel? Have traffic routes changed? Are contractors following isolation procedures? Has the task moved beyond the original scope? A tick-box inspection that ignores actual work practices provides little protection.

Document findings, actions and close-out dates. If issues recur, treat that as a management-system problem rather than an isolated behaviour issue. The contractor may need additional supervision, a corrective action plan or suspension from the approved panel. It depends on the severity of the risk, the contractor’s response and whether controls can be restored promptly.

Manage incidents, changes and subcontractors with discipline

Contractors must know how and when to report hazards, near misses, injuries, property damage and environmental incidents. Your internal process should make it possible to respond quickly, preserve evidence and determine whether the event is notifiable to the relevant regulator.

Do not wait for a serious incident to discover that contractors use a different reporting line or that after-hours contacts are unclear. Test the process during mobilisation and review it after events.

Changes also require control. A variation in scope, a new work area, changed materials or an additional subcontractor can alter risk significantly. Require contractors to seek approval before making material changes, then reassess the work plan, permits and competency requirements where necessary.

Subcontracting deserves particular attention. The contracted company may appear capable, while the people doing the work have not been inducted, verified or supervised. Require disclosure and approval of subcontractors, and make clear that the lead contractor remains accountable for managing its supply chain.

Use performance data to improve contractor management compliance

A guide to contractor management compliance should not end at approval and inspection. The system needs periodic review to establish whether it is working. Useful measures include expired documents, induction completion, audit findings, incident trends, corrective action close-out, permit non-conformances and contractor performance against agreed requirements.

Avoid measuring only injury numbers. Low injury reporting can indicate good performance, but it can also indicate under-reporting. Include leading indicators such as field verifications, quality of risk assessments, toolbox participation and closure of identified issues.

Review contractor performance at a frequency that reflects the level and volume of work. High-risk or strategic contractors may warrant formal quarterly reviews. Lower-risk providers can be reviewed at contract renewal or after significant work. Use the results to retain capable contractors, set improvement expectations or remove unsuitable providers from the panel.

For organisations working towards ISO 45001, contractor controls should integrate with consultation, operational planning, procurement, evaluation of compliance and corrective action processes. ISO 9001 and ISO 14001 may also apply where contractor work affects product quality, customer requirements or environmental aspects. One integrated process is generally more efficient than separate systems that ask the same contractor for similar evidence.

A site-ready contractor management system is not about proving that every risk has been eliminated. It is about showing that your business understands its duties, makes informed decisions and acts when controls are not effective. That discipline protects people first, while also giving directors and clients confidence that compliance will hold up when it is tested.