Skip to content
Noon EliteNoon Elite

ISO 45001 and contractors

Your auditor will ask how a contractor gets onto your site. Start at the door.

ISO 45001 has one clause that names contractors, and it is about co-ordination: knowing what they are here to do, what they have been told, and what you knew about them before they arrived. The first two are answered at reception, or they are not answered at all.

Book a 15 minute callWhat the clause asks for

From £150 a month plus VAT, iPad and stand included. We are not auditors or consultants.

What the standard asks

One clause about contractors, and five that lean on it

ISO 45001:2018 does not have a visitor or contractor management section. It has a clause about co-ordinating with contractors inside operational planning, and five other places where the record that clause produces turns out to be the thing you need.

Clause 8.1.4.2

Contractors

The clause that names them. You co-ordinate your procurement with your contractors so that the hazards and risks arising from their work on your site, from your activities on their workers, and from their activities on anyone else present are identified, assessed and controlled. You also set OH&S criteria for choosing contractors in the first place. An auditor reads this as: show me how a contractor gets onto your site, and what you knew about them before they did.

Clause 6.1.2.1

Hazard identification

The process has to consider the people with access to the workplace and their activities, and the standard names workers, contractors, visitors and other persons. A hazard identification that stops at your own payroll has missed the people least familiar with the site.

Clause 8.2

Emergency preparedness and response

Planned responses have to be communicated to contractors and visitors, not only to workers, and the clause asks you to take their needs into account when planning. It is the reason evacuation information belongs at the point of entry rather than on a noticeboard past it.

Clause 7.4

Communication

What you communicate, when, to whom and how, including to external interested parties. Site rules shown to a contractor at the door and acknowledged by name are a communication with a record. A laminated sheet on the counter is a communication without one.

Clause 7.5

Documented information

Evidence of the processes above has to be created, controlled and retained. The auditor is not asking whether the induction happened. They are asking you to show them it did, for this contractor, on this date.

Clause 10.2

Incident investigation

When something happens, you determine what was involved and who was present. A contractor incident investigated from a book with three illegible signatures on the relevant page is the kind of finding that ends up in a nonconformity report.

Nothing in the standard tells you to buy anything. It tells you to co-ordinate, to communicate and to keep evidence that you did. The clause numbers are stable because there is only one edition; what moves is your auditor’s view of what counts as evidence.

At the door

What a contractor meets at reception, and what it leaves behind

The same iPad that signs in visitors, asking a contractor the questions the standard cares about. A name and a time is a register. A name, a time and an acknowledged set of rules is a control with evidence.

Site rules and emergency arrangements, acknowledged by name

The contractor reads your rules and your evacuation arrangements on screen and confirms them before a badge prints. The acknowledgement is stored against the person, with the time. That is 7.4 and 8.2 with a record.

A register of who is on site, and who they are working for

Every contractor tied to a host and a company, with the time in and the time out. The list an auditor asks for when they say “show me who is on site right now”.

RAMS and permits, where the work needs them

With the permit module, the risk assessment and method statement are uploaded before arrival and the permit is authorised and signed off on screen. The co-ordination 8.1.4.2 asks for, with a name against each step.

A roll call that includes the contractors

The same register is the live list at the muster point. A contractor working on the roof is on it with everybody else, which is what 8.2 means by taking their needs into account.

The kiosk site policy screen, showing the health and safety rules a visitor must read and acknowledge before signing in
The rules screen a contractor reads and acknowledges before a badge prints. The acknowledgement is stored against their name with the time, which is the record clause 7.5 asks you to be able to produce.

Permits to work and RAMSContractors the HSG159 wayThe same door, for ISO 27001

On the day

Five things an auditor asks about contractors, and where the answers come from

None of these is difficult if the record exists. All of them are awkward if the answer starts with somebody going to look for the induction folder.

  • How does a contractor get onto your site?They sign in on the kiosk, read and acknowledge the site rules and emergency arrangements, and their host is alerted. A badge prints where the module is in use.
  • Show me the induction record for this contractor on this date.The visit, the acknowledgement and its timestamp, filtered to the name and the day.
  • How did you assess the risks from their work before they started?Under a permit, the RAMS uploaded against it and the authorising name. Otherwise this is your procurement record, and a kiosk has no part in it.
  • Who is on site right now, and who are they here for?The live list, on the auditor’s own phone if they like, with the host against each name.
  • How long do you keep these records, and can you produce last year’s?The retention period you set, applied automatically, and an export for any date range inside it.

Before you ask

The questions safety managers ask on the first call

Does ISO 45001 require a contractor sign in system?

No. Clause 8.1.4.2 requires you to co-ordinate with contractors so that the risks arising from their work are controlled, and to have criteria for selecting them. It says nothing about technology, and a paper induction register that is genuinely completed every time can satisfy it. What the auditor needs is evidence that the co-ordination happened for a given contractor on a given day, and that is where a book on a counter tends to fall down.

What does clause 8.1.4.2 actually cover?

Three directions of risk. The risk your contractors’ activities create for your organisation and its workers, the risk your activities create for the contractors’ workers, and the risk their activities create for anyone else present. It also asks you to define and apply occupational health and safety criteria when selecting contractors. The first three are about what happens on site; the last is about what happens before they are booked.

What is the difference between contractors and outsourcing in ISO 45001?

Contractors, in 8.1.4.2, are external organisations doing work at your workplace under arrangements you control. Outsourcing, in 8.1.4.3, is having an external organisation perform a function or process for you, which may not happen at your site at all. Both have to be controlled consistently with your legal requirements, but the reception process on this page is about the first, not the second.

Do visitors count under ISO 45001?

Yes. Clause 6.1.2.1 names visitors among the people whose access to the workplace hazard identification has to consider, and clause 8.2 requires emergency information to be communicated to visitors as well as contractors. A visitor is not working, so the co-ordination duties in 8.1.4.2 do not apply to them, but they are still somebody who has to know where the assembly point is.

Can a kiosk record the ISO 45001 induction?

It records the part that happens at the door: the site rules and emergency arrangements shown to the person, acknowledged by name and timestamped. If your induction includes a briefing from the host, a walk to the work area or a competence check, those still happen and the kiosk record shows that the contractor arrived and was briefed at the door, not that the rest took place. Most sites treat the kiosk acknowledgement as the first line of the induction record rather than the whole of it.

How does this relate to HSG159?

HSG159 is HSE’s guidance on managing contractors, built around five steps from planning to reviewing the work. ISO 45001 is a management system standard that a site chooses to certify against. The five steps are a good way of meeting 8.1.4.2, and an auditor familiar with UK sites will recognise them. Our contractor management page is built around HSG159; this one is built around the standard. Same door, different person asking.

Being straight with you

What this does not do

  • We are not a certification body, an ISO 45001 auditor or a health and safety consultancy. This is general information about a published standard, not certification advice.
  • Six clauses on this page, out of a whole management system. Your hazard identification, your legal register, your competence checks and your worker participation are all still yours.
  • The kiosk records that a contractor was shown your rules and confirmed them. Whether they were competent to do the job was decided when you chose them, and whether they followed the rules is supervision. No software answers either.
  • Clause 8.1.4.3, outsourcing, is about processes you have somebody else run for you. It is not addressed here, because a kiosk at reception has nothing useful to say about it.
  • If your auditor has raised a specific finding, bring their wording to the call and we will tell you honestly whether this closes it.

Sources

Check any of this yourself

General information about a published standard, not certification advice. Confirm clause wording against your own copy of ISO 45001:2018.

Also asked of sites like yours

The other things somebody may ask you to evidence

Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.

Next step

Tell us what your auditor said about contractors

Fifteen minutes on the phone. How contractors arrive today, how the induction is recorded, and what your last audit raised. We will tell you straight whether a kiosk closes any of it.

Book a 15 minute call

No site visit needed and nothing to install. If it is not a fit we will say so on the call.

Would rather email? [email protected]

Not the person who signs it off? Send them the one page business case