Contractors do the work your own crew cannot. They also carry a large share of your risk. Most days they take on the highest-hazard tasks on your sites. Yet in most Australian businesses, contractor management means a folder of insurance certificates, a SWMS nobody read, and a handshake. When something goes wrong, that folder protects no one. It certainly does not protect the officer who approved the arrangement.
This week in the IMS Mastery Series we bring contractors properly inside your integrated management system. The people you engage then get the same discipline as the people you employ.
What the law expects when you engage contractors
Section 19 of the Work Health and Safety Act 2011 sets the primary duty of care. It applies to a person conducting a business or undertaking, for all workers. Section 7 then defines worker to include contractors, subcontractors and their employees. So engaging a contractor never transfers your duty. It creates a shared one.
Section 46 goes further. Duty holders who share a duty must consult, cooperate and coordinate with each other, so far as is reasonably practicable. On larger construction projects, Part 6.4 of the WHS Regulation adds principal contractor obligations. One of those is a written WHS management plan for the workplace. Safe Work Australia states the intent plainly. You cannot contract out of your duty. You also cannot assume the other party has it covered.
The ISO standards make the same point in management system language. ISO 45001:2018 Clause 8.1.4.2 asks you to coordinate procurement with your contractors. You then identify and control the hazards from their work, your work, and the overlap between them. Clause 8.1.4.3 extends that control to outsourced functions. ISO 9001:2015 Clause 8.4 covers externally provided processes, products and services. ISO 14001:2015 Clause 8.1 adds environmental controls across the lifecycle. One contractor process inside your IMS satisfies all of them.
Contractor management is a lifecycle, not a paperwork gate
Most contractor management fails for one reason. It happens once, at engagement, and never again. The insurances were current on the day you signed the contract. The licence was valid at induction. Twelve months later, half of it has expired. Nobody noticed, because nothing in the system was ever going to notice.
Instead, treat every contractor as a lifecycle with five stages. Prequalification screens capability, licences, insurances and safety history before you engage anyone. Engagement sets the QHSE terms in the contract. Those terms require the contractor to work to your IMS on your sites. Induction and verification confirm three things: their workers are competent, they are inducted, and they follow a SWMS or safe system of work you have reviewed. Monitoring tests the paperwork against reality through inspections, toolbox attendance and incident data. Review closes the loop. A periodic performance assessment decides whether the contractor stays on your approved list.
Each stage produces a date. Insurance expiry. Licence expiry. Induction refresher. Next performance review. Those dates decide whether the process works. That is why this week’s free template drives everything off a next-review date with an automatic status flag.
Where contractor engagement breaks down
Three failure patterns turn up in audit after audit. The first is the set-and-forget file. You collect the documents at engagement and never check them again. The business then works with uninsured or unlicensed contractors without knowing it. The second is the SWMS rubber stamp. A high-risk construction work SWMS arrives, goes in the folder, and nobody ever reads it against the actual task. That fails the WHS Regulation and common sense together. The third is the orphan contractor. A project manager engages a specialist directly, and the QHSE system never sees them. No induction, no verification, and no register entry.
Each of these is a systems failure, not a people failure. So ask four questions of your IMS. Who approves a contractor? Which person reviews their SWMS? Where do you track their expiries? And who signs off the performance review? If your IMS cannot answer, those jobs belong to nobody. And nobody does them.
Build contractor management into your IMS
Start with a single Contractor Management Register. One row per contractor. Record the services, a risk category, licence and insurance details with expiry dates, SWMS and induction status, and the next review date. The register must surface problems on its own. Entries flag Due Soon 30 days before a review date, and Overdue the day it passes. Your monthly meeting then works from exceptions instead of reading every row.
Next, connect the register to the rest of the system. Your prequalification criteria belong in the procurement procedure and tie back to ISO 9001 Clause 8.4. Link high-risk contractors to the matching entries on your risk register. Site rules and induction content should spell out contractor duties under sections 28 and 29 of the WHS Act. Contractor incidents and near misses feed your incident register and their next performance review. Review outcomes then feed Management Review as evidence that Clause 8.1.4 works.
Finally, scale the effort to the risk. A contractor mowing lawns needs less scrutiny than one erecting formwork. Set a risk category at prequalification. Apply full verification to high-risk contractors and a lighter touch to low-risk ones. That is the reasonably practicable calibration the WHS Act expects.
Practical Application
Take an Australian manufacturer with 40 staff. It engages around 20 contractors a year across electrical, mechanical, cleaning and freight services. The Operations Manager builds the register in an afternoon from the accounts payable list. That exercise alone exposes four contractors nobody in QHSE knew about.
Prequalification packs go out to all 20. Two high-risk contractors cannot produce a current electrical licence, so they stop work until they do. Every contractor gets a risk category and a next review date. From then on, the fortnightly operations meeting opens with the register filtered to Due Soon and Overdue. The team chases insurance renewals before expiry, not after. A named person reviews each SWMS before mobilisation. Then the auditor asks how contractor control meets ISO 45001 Clause 8.1.4. The answer takes thirty seconds on screen: the register, the flags, the review records and the closed loop.
Conclusion
Contractors extend your capability. They extend your duty with it. The businesses that get this right stop filing contractor paperwork. Instead they run a lifecycle inside the IMS: prequalify, engage, verify, monitor, review. One register with automatic status flags turns a legal exposure into a managed process. It also gives you audit-ready evidence without a late-night paper chase.
The MiSAFE All-in-One QHSE subscription includes configuration of your contractor management process inside your QHSE platform. That covers automated expiry alerts, contractor induction workflows, SWMS review routing and performance dashboards.
Ready to act? Contact us today or book a free 45-minute consultation.
Download the Free Template
Download the free Contractor Management Register (.xlsx). Put every contractor’s licences, insurances, SWMS and review dates in one place, with automatic Due Soon and Overdue flags.
Recent Comments