Many serious workplace incidents involve people who do not work for the organization that runs the site. A contractor brings new hazards to the site, and the organization’s own work can put the contractor’s workers at risk. For that reason, ISO 45001 asks organizations to control procurement, coordinate with contractors and keep control of outsourced work. An auditor looks past the contract and asks whether the arrangements work on the ground. This guide is for auditors working to ISO 45001:2018 and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 45001 Lead Auditor course.

What does ISO 45001 clause 8.1.4 require?

It requires control of procurement, coordination with contractors and control of outsourced functions.

Clause 8.1.4 of ISO 45001:2018 has three parts. The general part asks the organization to establish, implement and maintain processes to control the procurement of products and services, so that they conform to its OH&S management system. The contractor part asks it to coordinate its procurement with contractors to identify hazards and assess and control OH&S risks. The outsourcing part asks it to make sure outsourced functions and processes are controlled. Always check the exact wording in the current standard. Our guide to how an ISO 45001 audit works shows where this check sits in an audit, and our guide to the role of top management in ISO 45001 explains who is accountable.

What makes good contractor control under ISO 45001?

Good control coordinates hazards in both directions and applies safety criteria from selection to the end of the work.

The table turns the contractor requirements into audit questions. Use it to judge how one contractor arrangement is managed.

A contract that names safety is not the same as a site where contractors work safely.

How is outsourcing different from using a contractor?

Outsourcing hands a function or process to someone else, and the organization must still control it.

A contractor often works on the organization’s site, while an outsourced function might be performed elsewhere. Either way, clause 8.1.4 asks the organization to make sure outsourced functions and processes are controlled, that the arrangements are consistent with legal and other requirements and with the intended outcomes of the OH&S management system, and that the type and degree of control are defined within the system. “The supplier is responsible” is therefore not a complete answer. Our guide to auditing the hierarchy of controls explains how controls are chosen.

How do you plan an audit of contractor management and procurement?

Ask for the list of contractors, the selection records and the permits, and pick arrangements to trace.

Request the list of current contractors and outsourced functions, the procurement procedure, selection criteria, contracts, induction and permit records and any contractor incident reports. Choose arrangements of different kinds, such as a high-risk contractor, a long-term outsourced process and a short visit. Plan to visit the area where contractors work and to speak to contractor workers. Our ISO 45001 audit plan and checklist guide shows how to build this into your checklist, and our guide to the documents required for an ISO 45001 audit helps you decide what to read first.

What evidence should you collect?

Collect procurement and selection records, contracts, induction and permit records and what you see on site.

Remember that a comment is a lead, and you confirm it with a record or an observation. Our guide to how to interview workers in an ISO 45001 audit shows how to ask the questions.

How do you interview people about contractor management?

Speak to the person who buys, the person who supervises and the contractor’s own workers.

1. Ask the buyer how safety criteria are applied when contractors are selected.
2. Ask the site supervisor how hazards are shared and who checks the work.
3. Ask a contractor lead which hazards the organization told them about.
4. Ask contractor workers what induction they had and what they would do in an emergency.
5. Ask for a recent incident or near miss involving a contractor and what was done.

Our guide to worker consultation and participation in ISO 45001 explains how workers, including contractor workers, can be involved, and our guide to auditing emergency preparedness and response in ISO 45001 covers what contractors must know in an emergency.

What gaps do auditors commonly find in contractor management?

Common gaps are price-only selection, no hazard coordination, no induction and no follow-up.

• Price-only selection. Safety was not a criterion when the contractor was chosen.
• No hazard coordination. Each side works without knowing what the other is doing.
• No induction. Contractor workers start without site rules or emergency information.
• Outsourced work left alone. Nobody checks it after the contract is signed.
• No follow-up. Contractor incidents do not change how the next contractor is chosen.

Treat these as prompts, not conclusions, and confirm each one with evidence before you raise a finding. Our guide to auditing OH&S monitoring in ISO 45001 covers how performance is tracked, and our guide to auditing management review in ISO 45001 shows where contractor results should be reviewed.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for class recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. Before you book, read what you need in our eligibility guide.