Contractor Safety Programs: 5 Common Gaps and How to Close Them

OSHA's multi-employer citation policy (CPL 02-00-124) defines four categories of employer on a shared worksite: creating (the one who creates the hazard), exposing (whose employees are exposed to it), controlling (who has supervisory authority over the site), and correcting (who is responsible for correcting it). A single employer can fall into more than one category simultaneously.

The practical consequence for organizations that hire contractors is this: a host organization that fails to exercise reasonable care to identify and address contractor-related hazards can be cited as a controlling employer, even if none of its own employees were at risk. The 29 CFR 1926.20(b)(2) standard requires that competent persons conduct frequent and regular inspections of job sites, materials, and equipment. Contractual language assigning safety responsibility to the contractor does not eliminate citation exposure.

The following five gaps are common across contractor safety programs in construction, manufacturing, utilities, and industrial operations. Each one is addressable with process changes that do not require significant resources.

Gap 1: Document Expiration Is Not Tracked

The pattern. Documents are collected at onboarding, filed in a shared folder or a row in a spreadsheet, and not revisited. Insurance certificates expire. OSHA 30 cards lapse. EMR letters age out. A contractor continues working on-site with credentials that are several months out of date.

Why it matters. An expired COI means the coverage it described may no longer exist. An expired crane operator certification means an uncertified person may be operating lifting equipment. In either case, the host organization that was responsible for verification faces exposure it thought was managed.

According to BLS data, serious injuries in construction and manufacturing occur at rates above the all-industry average (3.1 and 3.4 per 100 full-time workers respectively, versus 2.3 for all private industry in 2024). Contractors in these sectors are doing the work that generates most of the injury exposure. A lapsed credential in that environment is not an administrative problem; it is a risk management failure.

What to do. Every document with an expiration date needs an owner and a reminder trigger. Set alerts at 60 and 30 days before expiration. Define who is responsible for requesting renewals and what happens if the contractor does not respond. Track whether each contractor is current before approving work. These steps can be done in a spreadsheet with conditional formatting and reminders, or in a dedicated contractor management system, but they need to be someone's explicit responsibility.

Gap 2: Work Starts Before the Authorization Process Is Complete

The pattern. Work was needed quickly. The contractor was known from a prior job. A manager approved them verbally because "the paperwork was coming." The contractor was on-site for two weeks before anything was formally verified. An incident occurred in week three.

Why it matters. Work authorization is the control that confirms all pre-start requirements are met. When it is skipped, there is no documented record that the host verified anything before work started. That matters for OSHA compliance, for incident investigation, and for any resulting insurance claim or litigation.

OSHA's multi-employer citation framework does not provide an exemption for situations where operational urgency caused the authorization step to be bypassed. The question OSHA asks is whether the controlling employer exercised reasonable care. Verbal approvals with no documentation make that case difficult to make.

What to do. Define a specific authorization checklist: documents verified and current, orientation completed and signed, required training documented as complete. Make the authorization a written or system-recorded step. The person who authorizes work to begin should be identifiable by name and have confirmed in writing that each required step is done. The process needs to be simple enough that it does not become the step that people are incentivized to bypass under schedule pressure.

Gap 3: Contractor Incident Data Is Not Tracked

The pattern. The host organization tracks its own employee injuries for OSHA 300 purposes. Contractor incidents are handled by the contractors themselves. From the host's perspective, contractor incident rates are unknown unless an incident rises to the level of a formal claim or OSHA involvement.

Why it matters. On sites where contractors perform higher-hazard work (confined space, demolition, heavy lifting, process line maintenance), the contractor workforce often represents the majority of the actual injury risk. Managing safety without visibility into contractor incident data means managing by exception rather than by data.

There is also a regulatory dimension. OSHA requires recording of fatalities and severe injuries involving contractors in certain circumstances, particularly where the host employer directed or controlled the work. The BLS definition of a recordable incident applies to the work environment, not just the employment relationship.

What to do. Require contractors to report all recordable incidents to the host's site contact within a defined timeframe (24 to 48 hours is typical). Track these incidents by contractor and by worksite. Review each contractor's TRIR at each prequalification renewal, and track it over time. A three-year increasing TRIR trend tells you more about a contractor's trajectory than any single-year number.

Gap 4: Site Orientation Is Generic and Undifferentiated

The pattern. New contractors watch a general safety video or attend a short orientation that covers company-wide rules. They sign a form indicating completion. The content does not address the specific hazards of the worksite, the current permit programs in effect, or the emergency procedures specific to the facility.

Why it matters. OSHA's hazard communication standard (29 CFR 1910.1200) and the general duty clause both require that workers be informed of the hazards they are actually exposed to. A general orientation that does not reflect actual site conditions satisfies the paperwork requirement but not the intent of the regulation.

More practically: a contractor who has been generically oriented to "follow all safety rules" but has not been told about a confined space entry permit program, an active overhead crane hazard, or the location of the nearest AED is not meaningfully prepared to work safely on that site.

What to do. Orientation content should be site-specific and should reflect current conditions. When site conditions change (new permit requirements, new hazards, significant construction activity), orientation content should be updated and affected contractors should receive updated information. Records should identify what content was covered, not just that an orientation occurred. Keep a signed acknowledgment that includes the date, the location, and the specific content areas covered.

Gap 5: Approval Decisions Lack Documented Criteria

The pattern. A prospective contractor expresses interest in working with the organization. The decision about whether to approve them is made informally, based on prior relationships, referrals, or whoever was available to make the call. No consistent criteria are applied. Two years later, a different contractor is approved through a different informal process. When an incident involving one of these contractors is investigated, there is no record of what standard was applied when they were approved.

Why it matters. Inconsistency in approval creates both legal risk and compliance risk. It also makes it impossible to hold contractors accountable over time to the standard they were approved against, because no standard was documented. If the same criteria were not applied to all contractors, any dispute about whether one was appropriately qualified becomes difficult to resolve.

What to do. Write down the qualification criteria and apply them consistently. The criteria should define minimum insurance requirements, an acceptable EMR threshold, an acceptable TRIR range, required licenses for specific work types, and any conditions under which conditional approval can be granted. Document each approval decision, who made it, and on what basis. When a contractor does not meet a threshold but is approved anyway (a waiver), the waiver should be documented and authorized by an appropriate level of management.

The regulatory requirements that apply to a contractor safety program depend on the industry, the work being performed, and the specific OSHA standards that apply. The gaps described above are common across sectors and work types. Addressing them requires consistent processes, records that are specific enough to be usable in an investigation, and clear ownership of each step.