The Contractor Management Lifecycle

Pre-qualifying Suppliers

Decide what “approved” means before anyone is engaged, then hold every contractor and supplier to it.

What this stage is for

Prequalification is the due diligence that happens before a contractor or supplier is engaged. It answers one question: is this organisation able to do this kind of work safely, legally and to the standard you need? The evidence usually includes a health and safety policy, Employer’s Liability and Public Liability insurance, accreditations such as SSIP membership and training and competency records. Some work also calls for references or proof of financial stability.

It matters because the duty doesn’t stop at your own employees. Under the Health and Safety at Work etc. Act 1974 you have responsibilities to anyone affected by your work, and choosing a competent contractor is one of the clearest ways to show you took them seriously. When something goes wrong, one of the first questions asked is how that contractor came to be approved.

The common failure is not a lack of effort. It’s that the standard lives in people’s heads. Each site or department keeps its own approved list, documents arrive by email and stay in inboxes and the spreadsheet is out of date the day it is saved. A contractor approved three years ago can still be on the list with insurance that lapsed last spring, and nobody knows until they are already on site.

How it looks in different workplaces

The principle is the same everywhere, but what you ask for changes with the risk. A window cleaner and a high-voltage electrical contractor should not face identical checks, and good prequalification is proportionate: more evidence for higher-risk work, less friction for low-risk visits. This is what risk and procurement teams call risk tiering.

In food and drink manufacturing, contractors entering production areas may need to meet hygiene and HACCP requirements on top of the usual safety evidence. In healthcare, a contractor with access to systems or patient areas may need to show they meet data protection and NHS DSPT expectations. On the railway, track safety competence is part of the baseline. Public sector buyers increasingly ask suppliers for evidence such as Modern Slavery Act statements or carbon reduction plans, and universities may ask for enhanced checks for anyone working near young people.

How Heresafe handles it

You set the standard once. A customisable HSEQ or prequalification questionnaire sits behind every new contractor and supplier, alongside document requests for whatever your organisation needs: insurance, accreditations, RAMS, training records, ESG or Modern Slavery Act statements. If you need a document type that isn’t on your list yet, it can be added. You decide how much to ask for from each contractor or type of work, so higher-risk work gets more scrutiny without slowing down everything else.

Contractors do the uploading. Through the external Self-Service Supplier Portal, contractors submit and update their own documents, so your team stops re-keying attachments from emails. Each company gets its own supplier record and each worker their own individual record, so a qualification belongs to the person who holds it, not just the firm they work for.

Your team makes the call. Heresafe doesn’t decide on your behalf whether a document is acceptable. Every submission goes through the built-in Accept, Reject or Refer workflow: a reviewer accepts it, rejects it with a reason or refers it for a second opinion. Either way, the contractor is notified automatically. That keeps a clear line between what a contractor has declared about themselves (their attestation) and what someone on your side has actually checked.

The approved list stays live. The Supplier Database gives everyone the same searchable record. A Company Matrix and a People Matrix show every requirement against every company and every worker, including when each item was requested, so gaps are visible at a glance. Automated renewal reminders go to suppliers before documents expire, and credential reporting flags anything expiring in 7, 14 or 30 days. Sub-contractors can be held to the same standard as the firms that bring them in, and a contractor banned at one site stays banned across your whole organisation.

Who it helps

H&S, SHEQ and EHS managers get one consistent standard they can stand behind in an audit. Procurement gets a documented supplier due diligence record. Compliance administrators stop chasing paperwork by email, and contractors get one clear list of what’s needed, uploaded once rather than resent to every site.

Proof

Ornua Foods moved contractor onboarding, health and safety questionnaires and insurance expiry tracking off paper, and now manages 270 approved contractors in one system. Port of Tyne replaced paper, spreadsheets and email chains across multiple access points with a single contractor approval and assurance process.

Further reading

• How to check contractor credentials and build a reliable approved contractor list
• Are you asking the right questions? The importance of contractor prequalification
• Arrive Safe: the ultimate guide to selection, prequalification, onboarding and induction
• Subcontractor management best practices for a safe and compliant supply chain
• How Heresafe keeps contractor and supplier records in one governed system

Next step: Not sure whether your current process is ready to move? Get the Heresafe Onboarding Kit.

Explore another stage ↑

Planning & Authorisation

Being approved to work for you is not the same as being authorised to do this job, in this place, on this date.

What this stage is for

Prequalification tells you a contractor is capable in general. Planning and authorisation make sure a specific job is safe before it starts. That means agreeing the scope, location and timing of the work, knowing who else will be working nearby and reviewing risk assessments and method statements (RAMS) written for this job rather than recycled from the last one.

For high-risk activities, it also means a permit to work: a formal, written system that controls hazardous work such as hot work, confined space entry, live electrical work, working at height, excavation and isolations. A permit sets out what will be done, what precautions are in place, who is responsible and when the work has to be handed back. On construction projects, CDM 2015 adds its own planning duties, including a construction phase plan.

Things go wrong here in predictable ways. Generic RAMS get approved without being read. Paper permit books go missing or are never closed out. One person requests, issues and signs off their own permit. Two teams are given permits for the same area at the same time, and nobody spots the overlap until they meet on site.

How it looks in different workplaces

The roles are the same everywhere but the names change, and using the right ones matters to the people doing the work. The person who issues a permit may be called a Permit Issuer, Authorised Person or Area Authority. The person who accepts it and leads the work may be the Permit Holder, Performing Authority or Person in Charge (PIC), a title that appears on permits, lift plans and method statements across construction and steel erection.

In NHS estates, Authorised Persons and Competent Persons carry formal permit duties under Health Technical Memoranda such as HTM 06-02 for electrical safety. On the railway, work is planned inside a safe system of work controlled by roles such as the COSS and the PICOP. In oil and gas and other high-hazard sites, all of this sits under the heading of Control of Work, with simultaneous operations (SIMOPS) planned out before anyone breaks ground. In manufacturing, the pressure point is often planned maintenance and shutdowns, when dozens of contractors need authorising in a short window.

How Heresafe handles it

Every job gets its own requirements. You create projects and jobs in Heresafe and set the credentials required for each one, so a contractor approved for general maintenance isn’t automatically cleared for roof work. The Project Calendar shows upcoming work across every location by day, week or month, and Authorisation to Work dashboards show job by job which companies, workers and sub-contractors meet the requirements and which don’t yet.

RAMS are reviewed at job level. Method statements and job-specific credentials go through the same Accept, Reject or Refer workflow as prequalification documents, so each one is checked for this site and this task before work begins.

Nobody slips through on an assumption. Project Approval Restrictions stop a company being accepted onto a project until every credential requirement is valid and approved, unless a user with explicit override permission steps in. When they do, the ‘Approved by’ audit trail records exactly who approved it, including any override of a missing credential.

Permits are digital from issue to close-out. Heresafe Permits includes nine pre-set permit types, with custom templates available. Permits are issued, sent, accepted and signed digitally across locations, with a work team register and approved RAMS attached. Permissions can be set by permit type, so only the right people can issue each kind of permit, and permit issue can be restricted to inducted workers and approved companies. Automated notifications track each permit’s issue, acceptance and return, and permit handover keeps responsibility clear when work runs across shifts. Permit mapping shows live permits on a site map so overlapping high-risk work is visible before it becomes a clash.

Who it helps

Engineering and maintenance managers, estates teams and project managers get a clear picture of what’s planned and who’s cleared for it. Permit issuers work from one controlled process instead of a paper book, and contractors know exactly what they need in place before they turn up.

Proof

Before Heresafe, UCL‘s permit to work process was inconsistent across an estate of more than 250 buildings, with authorisation routes that allowed one person to request, issue and authorise the same permit. UCL now runs defined authorisation routes, central competency records and real-time visibility of permits by location.

Further reading

• Work Safe: the ultimate guide to permits to work
• What should your permit to work system include?
• When are hot work permits required?
• What is an electrical permit to work and when is it required?
• When is an excavation work permit required?
• How to conduct a risk assessment for contractor management and site safety

Next step: See how your current permit process measures up with the Mini-Audit your Permit to Work System tool.

Explore another stage ↑

Arriving On-Site Safely

The moment the paperwork becomes a person at your gate, and the point where most organisations lose track.

What this stage is for

Everything up to now has been about companies and documents. Arrival is where it becomes about people: the individual workers who actually turn up, and whether each of them knows the hazards, rules and emergency procedures for this site. That is the job of an induction. It should cover site-specific risks, emergency arrangements, restricted areas, reporting lines and anything particular to your workplace. It should also check that people understood it rather than simply confirming they sat through it.

Check-in matters just as much. Knowing who has arrived, where they are going and whether they are the person the approval was for is basic control of your site. It also sets up everything that follows: you can’t produce an accurate fire roll call, spot a late stayer or answer an auditor’s question about who was on site last Tuesday unless arrival was recorded properly in the first place.

The traditional version works against you. A 45-minute presentation at reception on the day of arrival holds up work and tells you nothing about what was taken in. Paper sign-in books are easy to skip, hard to read and expose visitors’ details to everyone who signs after them. Queues build at the start of every shift, and the pressure to wave people through builds with them.

How it looks in different workplaces

The people arriving are rarely just contractors. Most sites manage what is increasingly called the extended workforce: contractors, sub-contractors and agency staff, alongside visitors, delivery drivers and guests. Each group needs a different level of induction and a different route in.

Events and venues can see hundreds of contractors arrive for a single build, and are now preparing for Martyn’s Law and its premises protection duties. Museums and cultural sites manage many different visitor types through the same front door. Aerospace and defence and government sites need tightly controlled access for restricted environments, while logistics hubs and ports need check-in that works across many entry points rather than one reception desk.

How Heresafe handles it

Induction happens before arrival. Induction material is shared with contractors ahead of their visit, so they complete it remotely rather than at your reception. Each induction ends with an assessment that checks understanding, and the Induction Dashboard shows your team who has passed and who hasn’t. Multiple inductions can be set up for different sites, areas or visitor types. Multilingual options and a custom animated induction video are also available.

Check-in fits the site, not the other way round. Contractors can sign in at a kiosk with a QR code, or check themselves in and out on their mobile with geo-tagging, which suits large or multi-building sites without a manned entrance. Expected On-Site reporting tells reception who is due and when, while SMS alerts let site managers know the moment someone arrives. Each worker can carry a Digital Badge instead of a paper sticker.

Arrival links back to the earlier stages. Because induction, approvals and permits live in the same system, permit issue can be restricted to workers who have completed their induction and companies that have been approved. Your team keeps the final decision on access, with the evidence in front of them rather than in a filing cabinet.

Everyone comes through the same system. Visitor management, vehicle and parking management and events management are available alongside contractor management, so visitors and contractors aren’t split across two tools with two sets of records.

Who it helps

Induction and access coordinators stop running the same presentation every morning. Reception and site security teams know who to expect and can check people in quickly. Site and premises managers get an accurate record of everyone on site, and contractors start work on time instead of queueing.

Proof

Collins Aerospace at Prestwick replaced 45-minute on-site PowerPoint inductions with remote video inductions and questionnaires, plus self-service kiosk check-in with QR codes. The National Composites Centre has managed more than 131,000 visits and 1,734 completed inductions through Heresafe, with remote inductions and verification questions completed before arrival.

Further reading

• What should be included in a contractor induction?
• The role of online inductions in ensuring contractor compliance
• How to manage contractor access and site security on multi-contractor sites
• Multi-site visitor and contractor management: achieving consistency across locations
• The rise of touchless and contactless visitor check-ins

Next step: Read how the Natural History Museum standardised pre-arrival checks across its South Kensington and Tring sites.

Explore another stage ↑

Live Compliance Monitoring

Compliance at the gate is a snapshot. Work keeps moving, and so should your view of it.

What this stage is for

Once contractors are on site, conditions change. People move between areas, work overruns, a permit is due back before the job is finished, a second team starts nearby, someone stays after everyone else has left. HSE’s guidance calls this “keeping a check”: you remain responsible for how contractors work on your premises after they have signed in, not only for letting them in.

Risk teams call this continuous monitoring. In practice it means being able to answer, at any moment, who is on site, where they are, what they are authorised to do and whether anything has changed since they arrived. It also means being ready for the moments that matter most: an alarm, an evacuation, a lone worker who hasn’t checked out.

Without a live view, supervisors have to walk back to the office to check a permit, fire marshals work from a sign-in sheet that may be hours old, and a contractor still in a plant room after hours can go unnoticed until the next morning. Dynamic risk assessment only works if the people making those judgements can see the current picture.

How it looks in different workplaces

On a single-building site this is about knowing who is where. On a university campus, a port or an NHS estate, it is about seeing many locations at once without relying on each one to report in. In energy and high-hazard operations the focus is on proactive oversight that prevents incidents, especially where high-risk activities could overlap. Ports and warehouses need location-aware check-in across large open sites, and hospitals need all of this around the clock, not just in office hours.

How Heresafe handles it

Who’s on site, right now. The On-Site Now dashboard shows everyone currently on site across every location, live. Expected On-Site reporting shows who is due, when and which permits they’ll need, and Live Project Search pulls up any job by name or location in seconds.

A badge a supervisor can check. Digital Badges double as on-site passes. A supervisor or security officer can scan one to see a worker’s documentation, permit status, induction and approved work area, without radioing the office.

High-risk work stays visible. The Permit Dashboard shows every live permit by status and type, and permit and project mapping places live permits on a site map so overlapping or conflicting work shows up before two teams meet in the same restricted area. Multi-workspace set-ups, each with their own locations, sub-locations and permissions, give a central team one view across many sites without taking control away from local teams.

Nobody is left behind. The Late-Stayer Process flags anyone still on site past their expected finish time and escalates automatically. Lone workers can sign off remotely, and if they don’t, an SMS and email go straight to an emergency contact. The live digital Fire Register can be opened on any internet-connected device, giving an accurate headcount and contact details the moment an alarm sounds.

Nothing is lost between shifts. For teams that run around the clock, the Shift Handover module keeps a live, searchable log of incidents and occurrences, with the incoming shift acknowledging what’s outstanding before they take over.

Who it helps

Site and premises managers see every location from one screen. Supervisors and security teams can check a worker’s status on the spot. Fire marshals get an accurate roll call, and the lone worker in a remote plant room has someone who will know if they don’t come back.

Proof

“Its reporting capability provides increased visibility with live information on all bookings, and control of all contractor visits across our multiple sites, ensuring contractors are working safely, with all work and visits approved and recorded.” Mark Goff, Estates Business Manager, Falmouth Exeter Universities

Further reading

• How Heresafe gives you live visibility of every site
• Fire safety regulations: enhancing compliance with visitor management software
• How to streamline on-site contractor management
• How safety management software reduces workplace incidents

Next step: Book a demo to see On-Site Now, permit mapping and the Fire Register set up around your own sites.

Explore another stage ↑

Audit, Incident & Reporting

When someone asks you to prove it, the answer should be a record, not a recollection.

What this stage is for

Sooner or later, someone will ask for evidence. It might be an internal audit, an ISO surveillance visit, a client or insurer review, an HSE inspection or a board report. It might be an incident investigation, where the questions are sharper: who was on site, which permit covered the work, whose RAMS were approved, had the worker been inducted and who signed off the contractor in the first place?

This stage is about being able to answer all of that quickly and accurately. It overlaps with, but is different from, day-to-day inspection and risk assessment, and it helps to know the difference between audits, inspections and risk assessments. Where an incident is reportable under RIDDOR, you still make the report yourself, but you’ll need accurate records behind it. For higher-risk buildings under the Building Safety Act, the same records of who did what work, and when, contribute to the golden thread of building information.

The traditional problem is scattered evidence. Permits sit in one binder, inductions in another, insurance certificates in someone’s inbox and sign-in sheets in a box in the basement. Reconstructing a single day can take a week, and any gap in the record reads as a gap in your control.

How it looks in different workplaces

What gets audited varies. Healthcare organisations are asked about data protection and DSPT alongside safety. Aerospace and defence sites face customer and security audits as well as their own quality systems. Public sector buyers expect suppliers to demonstrate ISO certification and data handling standards. Universities with hundreds of buildings need to show consistency across the whole estate, not just the main campus. The evidence needed differs; the need to produce it on demand doesn’t.

How Heresafe handles it

The whole picture on one screen. The Overview Dashboard brings together project and job volumes, method statement and risk assessment approval status, visitor bookings, completed inductions, permits by type and credential status, each with its own trend over time. The Permit Dashboard and Credentials Dashboard give dedicated drill-downs, and the Company Matrix and People Matrix show compliance status for firms and individual workers side by side.

Reports you don’t have to build. Configurable reporting covers historical visits, permits and passes, projects and inductions, and every report can be exported. Credential reporting tracks nine separate states, from awaiting response and awaiting verification through to verified, rejected, expiring in 7, 14 or 30 days and expired. A custom report format can be set up if your board pack or audit template needs one.

A permit trail an auditor can follow. The permit log is searchable and filterable by issuer, status, location, date, company and more, and permits can be searched by project reference for project-level auditing. You can record and upload your own permit audits directly into Heresafe, with Real-Time Permit Audits and Post-Completion Permit Audits available as extras.

Every decision has a name against it. The ‘Approved by’ audit trail shows who approved each company or contractor onto a project, including who overrode a missing credential and when. Every record carries a full history of what changed, when and by whom, so nothing can quietly change without a trace.

You can see whether the system is actually being used. The Usage Report summarises credentials, inductions, permits, logins and projects broken down by type. The separate Internal User Report shows which of your own users are logging in, when they last did and who has never logged in, so you can prove adoption as well as process.

Evidence ready when an incident happens. Because arrival, induction, permits and approvals are recorded in one place, the questions an investigation asks can be answered from the record. Incidents and occurrences can be logged in Shift Handover with priority, status and supporting files, and a contractor can be banned across your organisation if the outcome calls for it.

Who it helps

Compliance and audit teams get reliable evidence without chasing it. H&S managers can walk into an audit with the answers already exported. Senior leadership gets trend data across every site, and IT and information security teams can point to ISO 27001 certification and UK data hosting when they’re asked where that evidence is held.

Proof

Coca-Cola Europacific Partners at Wakefield moved from a legacy system that frequently failed, with no visibility of document expiry dates, to real-time dashboards showing compliance status and expiries.

“We now have complete oversight of daily site access permissions, ensuring compliance and safety. Our return-on-investment was just months.” Alan Theaker, Health and Safety Manager, CCEP Wakefield

Further reading

• How Heresafe turns contractor data into dashboards and exportable reports
• How robust is your permit to work system? The full audit checklist
• Streamlining RIDDOR compliance with technology
• Common compliance pitfalls in contractor management and how to avoid them

Next step: Check where your own evidence stands with the free Health and Safety Audit Checklist.

Explore another stage ↑

Reviewing & Closing the Loop

Every finished job should make the next one safer. This is the stage that turns a process into a cycle.

What this stage is for

HSE’s guidance on managing contractors ends with reviewing the work, and for good reason. How did the contractor actually perform? Were there near misses, overruns or poor housekeeping? Did anyone need a credential override to get onto the job, and should they have? The answers should shape who you use next time and how your own process works.

This is the “check” and “act” of plan, do, check, act, the continuous improvement cycle behind ISO 45001 and most modern safety management. Quality teams call the issues it surfaces non-conformances, and the point of recording them is that they lead somewhere: a conversation with the contractor, a change to your requirements or a decision not to use them again.

Without this stage, approved lists only ever grow. A contractor who performed badly at one site is booked by another. Lessons from one job stay in the head of whoever supervised it. The same problems come back every year, and the organisation has no record to show it noticed.

How it looks in different workplaces

Multi-site organisations have the most to gain, because a poor performer can otherwise move from one site to the next without anyone joining the dots. Events and venues bring the same contractors back season after season, so a record of how last year went is directly useful for next year’s build. Universities and NHS estates use large pools of term contractors where performance data informs contract renewals, and procurement teams in every sector want supplier performance evidence behind their decisions rather than anecdote.

How Heresafe handles it

Performance becomes a record. Contractor Rating lets you score a contractor on the work they have actually completed, through questions asked against the project. The score is stored against both the project and the contractor’s profile, with a full timeline of the questions asked and the answers given, so a rating can always be explained.

A rejection sticks, everywhere. Banned contractor management stops a company or worker being added back in somewhere else in your organisation. Banned and archived users see a clear banner explaining their status and what to do next, so there’s no confusion at reception.

Exceptions are visible, not buried. Project Approval Restrictions and the ‘Approved by’ audit trail mean every credential override is recorded against a named user. Reviewing those overrides is one of the quickest ways to find where your process is under strain.

Your own process gets reviewed too. The Usage Report and Internal User Report show how Heresafe is being used across your organisation, and the trends on the Overview Dashboard show whether credential gaps and late approvals are getting better or worse over time.

Everything feeds back into stage one. Ratings and non-conformance recorded here are visible the next time that contractor is considered for work, and renewal reminders keep the approved list honest between jobs. The next prequalification starts from what you have learned rather than from scratch.

Who it helps

H&S and SHEQ managers get evidence of continuous improvement, not just compliance. Procurement and finance teams can base supplier decisions on recorded performance. Senior leadership sees whether contractor risk is going down over time, and good contractors get recognition for good work.

Proof

“The Heresafe system is enabling us to work collaboratively with our contractors and ensure compliance standards.” Di Hudson, Group Head of IT, Goodwood Group

Further reading

• How Heresafe keeps contractor compliance current, job after job
• The hidden costs of poor contractor management and how to avoid them
• The business case for a contractor management system, with free download
• The return on investment of a contractor management system

Next step: See the whole lifecycle working on your own sites. Book a demo or compare packages on our pricing page.

Explore another stage ↑