A good contractor approval process answers one question before anyone sets foot on site: is this contractor competent, insured and safe to work for us? It also gives you the evidence an ISO 45001, ISO 9001 or ISO 14001 auditor will ask for when they look at how you control externally provided services. This guide sets out a simple process that works for a small business, from first contact to final approval, and how Assuraz runs it for you.
1. Send a pre-qualification questionnaire
Ask every new contractor the same questions, in proportion to the risk of the work. A good questionnaire covers:
- Company details: registered name, Companies House number, VAT number, address and contacts.
- Health and safety: a written policy (required by law if they employ five or more people), risk assessments and method statements, accident figures for the last three years and any enforcement notices or prosecutions.
- Insurance: public liability, and employers' liability of at least £5 million if they employ anyone (Employers' Liability (Compulsory Insurance) Act 1969).
- Certificates and cards: ISO certificates, SSIP membership such as CHAS or SafeContractor, trade registrations (Gas Safe, NICEIC) and operatives' CSCS or CPCS cards.
- Quality, environmental and information security arrangements, if they matter to the work.
- Right to work: how they check their workers are allowed to work in the UK.
- Anti-bribery and modern slavery: their policies, and a modern slavery statement if their turnover is £36 million or more (Modern Slavery Act 2015, section 54).
- Finance: finance contact, invoice details and, if you need them, bank details.
Let them save their answers and come back later: a thorough questionnaire takes time, and they may not have every certificate to hand.
2. Check the answers and the evidence
- Open every certificate and insurance schedule and check the name, the cover and the expiry date. An expired policy is the most common gap.
- Look again at anything that needs attention: enforcement action, a fatality, no written policy, or employers' liability below £5 million.
- Check SSIP or ISO certificates against the scheme's or certification body's online register if you have doubts.
- If something is missing, send it back with a clear request rather than approving with a gap.
3. Rate each section and decide
Score each area (for example Good, Acceptable, Needs improvement or Not acceptable) with a short note of why. Then decide: approve, approve with conditions (such as "supervised for the first job" or "send your updated insurance within 30 days"), or reject with a reason. Writing the reasons down is what makes the decision defensible later.
4. Get sign-off from the right person
For higher-value or higher-risk contractors, a second approval from a director or senior manager is good practice. It shows top management involvement, which ISO 45001 and ISO 37001 both look for, and it stops one person approving a contractor on their own.
5. Set them up with finance safely
Never send bank details by email. Mandate fraud, where criminals pose as a supplier and ask you to change their bank details, is one of the most common frauds against UK businesses. Give your finance team the details through a secure route, and have them confirm the account by phoning the contractor on a number you already hold.
Finance confirming the set-up is a sensible final step: the contractor is fully approved only when they can actually be paid.
6. Keep everything in date
- Put the contractor on your approved list with their type of work, contacts and status.
- Record every certificate, insurance policy and card with its expiry date, and chase renewals before they lapse.
- Sign contractors in and out on site, give the site induction, and use a permit to work for high-risk jobs.
- Review their performance after the job and at least once a year: incidents, quality, and whether you would use them again.
Frequently asked questions
Do I need a contractor approval process for ISO 45001 or ISO 9001?
Yes. ISO 9001 clause 8.4 and ISO 45001 clauses 8.1.4 and 8.4 require you to set criteria for selecting, evaluating and monitoring contractors and external providers, and to keep records of the results. A documented approval process is the usual way to show this.
Can I rely on a contractor's SSIP certificate instead of my own questions?
An SSIP certificate covers the core health and safety assessment, so you need not repeat those questions. You should still check insurance, cards and certificates relevant to your job, and anything specific to your site.
How often should I re-approve contractors?
Check documents whenever they expire, and review each contractor at least once a year or after any incident or poor performance. Large or high-risk contractors may warrant a full re-assessment every one to three years.
What should I do if a contractor's insurance expires during a job?
Ask for the renewed certificate straight away and record it. If they cannot provide it, consider stopping the work until they can, because an uninsured incident could fall back on you.
This guide is general information for UK businesses, not legal advice. Check the current regulations and HSE guidance at hse.gov.uk, and take professional advice for your situation.