Industrial and commercial sites bring in contractors for maintenance, repairs and construction. Much of that includes high-risk work, such as roofing, electrical repairs and tank cleaning.
In 2015, contracted workers accounted for 57% of fatal injuries among roofers and 58% among electricians, according to the U.S. Bureau of Labor Statistics.
Hiring a contractor does not move your own safety duties to that contractor: you still answer for hazards on the site you control. Under OSHA's multi-employer citation policy, the host company that controls a worksite can be cited for a hazard a contractor created, in any industry.
Contractor safety management is the process a company uses to plan contractor work, select qualified contractors, include safety terms in the contract, prepare crews for the site, supervise the work, and review how it went.
Its goal is simple: outside work should not injure the contractor's crew or your own employees.
In this article, you'll learn the six steps of contractor safety management, who is responsible under OSHA and which rules apply.
Key Takeaways
- Under OSHA's multi-employer citation policy, the company that controls a worksite can be cited for a contractor's hazard, in any industry.
- In contractor safety management, the host company owes reasonable care: it checks the contractor's work and records each check.
- An experience modification rate (EMR) above 1.0 means higher claims costs than similar firms; read it with injury rates, not as a pass or fail test.
- A contractor's injury rate is its recordable cases multiplied by 200,000, divided by the hours its crew worked on your site.
- A contractor's work injury goes on the OSHA 300 Log of whichever company supervises that worker day to day.
- Under the Hazard Communication Standard, a host company must give other employers on site access to its safety data sheets.
What Is a Contractor Safety Management System?
A contractor safety management system (CSMS) is the written, repeatable version of contractor safety management. It sets out how your company selects, briefs, monitors, and reviews every outside crew, so each new job starts with the same rules instead of from scratch. Most companies run it as one part of their environment, health and safety (EHS) program.
In contractor safety management, a contractor is a company you hire to work on your premises with its own workers and supervisors. That includes maintenance crews, builders, cleaning firms and specialist repair teams.
Temporary workers from a staffing agency are treated differently: you usually supervise them yourself, so their injuries go on your own injury log. A vendor who only drops off goods is not a contractor in this sense.
Outside crews need their own process because they do not know your site. They have not seen your alarms, your chemical storage or your permit rules, and they answer to a different supervisor.
In 2017, data from the Bureau of Labor Statistics (BLS) showed that contracted workers were 16% of all workers killed on the job and 47% of those killed in construction and extraction jobs.
How much of the process a job needs depends on its risk. A cleaning firm that comes in weekly needs a short check, while a crew doing hot work on a live process line needs all six steps.
What Are the Steps in Contractor Safety Management?
Contractor safety management runs in six steps, from planning the job before you pick a contractor to reviewing the work after it ends. Each step checks something the others cannot, such as who actually arrives at the gate or how the crew performed.
Step 1: Plan the Job and Rank Its Risk
Plan the job before you contact any contractors. Write down the work and where it will happen, then use hazard identification to list what could go wrong. Rank the job as low, medium or high risk. The rank decides how many of the next five steps the job needs.
A job safety analysis is a practical way to do this: it breaks the task into steps and lists the hazards of each one.
These signals usually put a job in the high-risk group:
- work at height
- hot work such as welding, cutting or torch-applied roofing
- entry into confined spaces such as tanks, pits or vaults
- work on or near energized equipment
- handling or disturbing hazardous chemicals
- work near a process covered by OSHA's Process Safety Management standard
The Center for Chemical Process Safety advises that the right depth of contractor management depends on the risk of the work.
The process safety rule takes the same approach: its contractor duties cover maintenance, repair, turnaround, major renovation and specialty work, but not incidental services such as cleaning, food, laundry and deliveries.
For example, a roofing crew hired to replace part of a warehouse roof will work at height, which calls for fall protection, and will use hot-applied materials above stored stock, so the job ranks high.
Step 2: Prequalify Contractors on Their Safety Record
Prequalification means checking a contractor's safety history and programs before you invite a bid. Ask for the same documents from every contractor in the same risk group, so you compare like with like.
| Document | What it tells you | Warning sign |
|---|---|---|
| OSHA 300 logs and 300A summaries for the past 3 years | Injury and illness history | Missing years, or none provided |
| Experience modification rate (EMR), a workers' compensation score that compares a firm's claims with similar firms, where 1.0 is the average | Claims cost compared with similar firms | Above 1.0, read alongside the other rows |
| Total recordable incident rate (TRIR) | Recordable injuries per 100 full-time workers in a year | Rising over 3 years, or well above the industry average |
| Days away, restricted or transferred (DART) rate | Injuries serious enough to keep people off normal work | Rising over 3 years |
| Written safety program | How the contractor manages its own risks | A generic template with no task or site detail |
| Certificates of insurance | Coverage and limits | Expired, or below the limits your contract sets |
| OSHA citation history | Past violations | Repeat or willful citations |
| Licenses and training records for the trade | Who is qualified for the task | Expired or missing for the work planned |
As a benchmark, the private-industry TRIR in 2024 was 2.3 cases per 100 full-time workers, according to the BLS. Compare a contractor with its own industry's rate where you can, since roofing and office cleaning carry very different risks.
The EMR is one input, not a pass or fail test, so read it alongside the injury rates and the written program. In most states, the National Council on Compensation Insurance (NCCI) calculates these scores.
The U.S. Chemical Safety Board (CSB) has investigated deaths where this step failed. In a 2011 explosion during fireworks disposal that killed five workers, the contractor appeared to have been chosen for low cost and speed, and it had no disposal experience.
In a 2007 fire inside a tunnel at a hydroelectric plant, which also killed five, prequalification looked only at the contractors' finances. The contractor that scored lowest on safety still won on price.
The CSB points to the ANSI Z10 standard, which recommends safety criteria in prequalification.
Price pressure is real on every project, which is why a written scoring sheet helps. It puts the safety record on the same page as the bid, so the cheapest offer has to meet the same safety standard as every other bid.
Prequalification is only a first check. A questionnaire is a snapshot, often filled in once by someone in an office, so Step 4 checks the people who actually arrive and Step 6 checks how the crew performed on your job.
For the roof job, ask the roofer for their fall protection training records along with the standard documents.
Step 3: Write Safety Duties Into the Contract
The contract is where you and the contractor agree who does what, in writing, before work starts. OSHA's recommended practices for host companies and contractors advise putting safety specifications and qualifications into bid documents and contracts.
The contractor keeps its own safety program for its own work. Your part is to share your site rules and hazard information, not to write its program for it.
Step 4: Orient and Authorize Crews Before Work Starts
Every contractor worker gets a site-specific orientation and a work authorization before the first task. The orientation covers your site; the contractor's own training covers its trade.
Chemical information has to move both ways. Your crew needs to know what the contractor brings onto the site, just as the contractor's crew needs to know what you store.
Authorization is a short check at the gate that the people who arrive are the people you approved and that their training cards and licenses are current.
An orientation done as a signature on a sign-in sheet is easy to run on a busy morning, but it proves only that someone signed. A few questions at the end show whether the crew understood.
For the roof job, show the crew the flammable storage area below the section they will work on, and walk them through the permit to work for the hot work.
Step 5: Monitor the Work While It Happens
Monitoring means someone from your side checks the work regularly against the contract and the permits. The contractor supervises its crew; you check that the agreed controls are in place. Where a control is missing, fix the gap using the hierarchy of controls, which starts with removing the hazard before relying on PPE.
- Walk the work area with a checklist.
- Check permits at the start of each shift.
- Give contractors the same channel you use to report injuries, near misses and hazards.
- Give anyone who sees danger the authority to stop the work.
When crews from different employers share an area, plan and schedule their work together so one crew's job doesn't put another at risk. A short meeting before the job or at the start of each day can keep welding sparks away from a painting crew, for example.
As OSHA recommends, agree before work starts on how injuries and safety concerns get reported. If a contractor worker is hurt, get care first, have the contractor tell you right away and leave the scene as it is if it's safe, then get a written report within the agreed time and look into the cause together.
Match how often you check to the Step 1 risk rank. On construction work, OSHA requires frequent and regular inspections of job sites, materials and equipment by a competent person.
Keep a record of each inspection and each fix. Those records show the reasonable care OSHA expects from you as the company that controls the site.
For the roof job, a daily check confirms the guardrails or fall-arrest anchors are in place before the crew goes up.
Step 6: Track Contractor Safety KPIs and Decide Whether to Rehire
At the end of the job, check the contractor's safety key performance indicators (KPIs), then decide whether it stays on your approved list. Leading KPIs track the work that prevents harm; lagging KPIs count the harm that happened.
| Indicator | Type | What it shows |
|---|---|---|
| Orientation completed before the first shift | Leading | Whether every worker knew the site before starting |
| Inspection findings closed on time | Leading | How fast the crew fixed what you found |
| Near-miss reports from contractor crews | Leading | Whether the crew reports problems early |
| Permits checked and found complete | Leading | Whether high-risk work followed the permit |
| Contractor TRIR on your site | Lagging | Recordable injuries for the hours worked |
| Contractor lost-time cases | Lagging | Injuries serious enough to stop work |
A contractor's injury rate on your site is its recordable cases multiplied by 200,000, then divided by the hours its crew worked there. Without the hours, there is no rate, yet many large companies do not publish them.
SDS Manager's Contractor Safety Disclosure Report 2026 reviewed the public reports of 40 large mining, energy, construction and manufacturing companies. Only 26 said an injury rate included contractors, and only 7 published the hours contractors worked.
Update your approved list after each job, and requalify contractors on a set cycle or after any serious incident. A contractor approved once and never checked again can be working with lapsed insurance or expired certifications halfway through a long contract.
For the roof job, the crew closed every inspection finding within one shift, so it stays on the list for the next phase.
Who Is Responsible for Contractor Safety?
The contractor protects its own workers, and the host company that controls the site must take reasonable care to prevent and detect violations. OSHA can cite either one, and it can cite more than one company for the same hazard.
OSHA's multi-employer citation policy, in force since 1999, applies in all industries and sorts the companies on a shared site into four roles.
| Employer role | Who it is | What OSHA expects |
|---|---|---|
| Creating | The company that caused the hazardous condition | Avoid creating violations, and fix what it caused |
| Exposing | A company whose own workers are exposed to the hazard | Protect its workers, and ask the creating or controlling company to fix the hazard |
| Correcting | The company responsible for fixing the hazard, often by installing or maintaining safety equipment | Correct the hazard with reasonable care |
| Controlling | The company with general supervisory authority over the site | Take reasonable care to prevent and detect violations |
The host company is usually the controlling employer. "Reasonable care" is less than what a contractor owes its own workers: OSHA does not expect you to inspect as often as the contractor does or to know its trade as well. You still have to check, and keep a record of the checks.
Federal appeals courts have upheld citations under the policy, most recently in 2026. The main 2018 ruling in its favor relied on Chevron deference, which the Supreme Court ended in 2024, so the policy's legal footing is less settled than it was.
Hiring an expert contractor doesn't end your part. The contractor owns its workers' training, supervision and PPE, but you control the site, the hazards around the work and who gets in, so OSHA can still cite you for a hazard you should have found.
A contractor's work injury goes on the OSHA 300 Log of the company that supervises that worker day to day. If the contractor supervises its own crew, the contractor records it, so agree on this in advance and each case is recorded once.
Is a Contractor Safety Program Required by OSHA?
No single OSHA standard requires a program by that name. Several OSHA rules still place contractor duties on host companies and contractors, from the general duty to keep a workplace free of recognized serious hazards to specific standards for construction, process safety and hazard communication. A working contractor process is the practical way to meet them.
| Rule | Who it applies to | What it requires |
|---|---|---|
| General Duty Clause (OSH Act Section 5(a)(1)) | All employers | A workplace free from recognized hazards likely to cause death or serious harm to its employees |
| Construction responsibilities rule (29 CFR 1926.16) | Construction main contractors and subcontractors | The main contractor keeps overall responsibility; main contractor and subcontractor share responsibility for subcontracted work |
| Construction accident prevention programs (29 CFR 1926.20(b)) | Construction employers | Programs that include frequent and regular inspections by competent persons |
| Process Safety Management, contractor section (29 CFR 1910.119(h)) | Sites handling highly hazardous chemicals above set amounts | 6 host company duties, including checking safety records when selecting, sharing fire, explosion and toxic-release hazards, and keeping a contractor injury log; 5 contractor duties, including training workers and documenting that training |
| Hazard Communication, multi-employer sites (29 CFR 1910.1200(e)(2)) | Any site where another employer's workers may be exposed to hazardous chemicals | Give other employers access to SDSs, tell them about precautions, and explain your labeling system |
The Hazard Communication Standard requires your written program to say how other employers on site get your chemical information.
OSHA updated that standard in 2024, then pushed its deadlines back four months in January 2026. Employers now have until November 20, 2026 to update labels, written programs and training for single substances.
In the 22 states and territories that run their own OSHA-approved State Plans for private employers, the state's rules must be at least as effective as federal OSHA and can add more, as California's do. Voluntary standards such as ISO 45001 and ANSI/ASSP Z10 also expect safety criteria when you choose contractors.
Track Every Contractor's Insurance and Training Dates
Contractor approvals, insurance certificates and training cards usually arrive by email and phone photo. Each one carries an expiry date that nobody tracks, and the file stays in an inbox until an incident or an audit asks for it.
Before your next contractor arrives, check that none of its insurance certificates or training records expire before the job ends.
Start a free trial of EHS Solutions by SDS Manager and approve every contractor before they arrive, with each insurance certificate and training record verified and its expiry date in plain view.
Frequently Asked Questions
What Is a Contractor Safety Plan?
A contractor safety plan is the job-specific document a contractor prepares for one project, setting out the hazards of that job and how its crew will control them. Your company's contractor safety management process is broader and applies to every contractor you hire.
Who Records Injuries to Temporary Workers on the OSHA 300 Log?
Injuries to temporary workers go on the host company's OSHA 300 Log when the host company supervises them day to day. The staffing agency and the host company share responsibility for their safety. The agency should ask about conditions at your site, the contract should say who does what, and you give the site-specific training.
Who Should Provide PPE for Subcontractors?
Each subcontractor provides PPE for its own crew. OSHA requires every employer to pay for the protective equipment its own employees need, apart from a few listed exceptions, such as ordinary safety-toe boots that workers may also wear off the job. Your contract can require more protection than the law does.
Is There a Simpler Contractor Safety Process for Small Businesses?
A small business can run the same six steps on a one-page checklist, scaled to the risk of each job. OSHA's On-Site Consultation Program gives small and midsize businesses free, confidential safety advice. It's separate from OSHA inspections, so a visit doesn't lead to citations or fines, but you agree to fix any serious hazards it finds.
Arysha Alif Khan
Arysha Alif Khan is an EHS and chemical safety specialist with a background in biochemistry, biotechnology, and public health. She works closely with the product and regulatory teams to turn complex chemical regulations, SDS requirements, and workplace safety standards into clear, practical guidance for people.