How to manage subcontractor OSHA compliance on a job site

Last updated 2026-07-10

Who is legally responsible when a subcontractor violates OSHA?

Short answer: probably you, even if you never picked up the tool.

OSHA's Multi-Employer Citation Policy, laid out in Directive CPL 02-00-124 (effective December 10, 1999), sorts job site employers into four roles: creating employer, exposing employer, correcting employer, and controlling employer ^[1]. A general contractor almost always lands in the controlling employer bucket, which means OSHA expects you to take reasonable steps to make sure your subs comply with the standards that apply to their work, even standards you never touch yourself.

The controlling employer standard does not require perfection. The directive says the controlling employer must exercise reasonable care based on the scale of the project, the nature of the hazard, and how much authority you have over the work. But "I didn't know" falls apart fast when OSHA can show you were on site every day with contractual authority to stop the work.

Citations against GCs for a sub's violations are common in construction (29 CFR 1926), and they show up more and more in general industry when a host employer brings in outside contractors ^[2]. OSHA can cite multiple employers for the same violation, so the sub and the GC can both get penalized for one incident. As of 2024, the maximum penalty for a serious violation is $16,550, adjusted annually for inflation ^[3].

Here's the whole thing in one line. If a sub's worker gets hurt on your site, OSHA will ask what you did and what you failed to do. Build your system so the answer is a good one.

What is OSHA's Multi-Employer Citation Policy and how does it apply to GCs?

OSHA's Multi-Employer Citation Policy (CPL 02-00-124) is the one document to read before you let a sub set foot on your site ^[1]. On multi-employer worksites, it lets OSHA cite any employer whose workers are exposed to a hazard, and any employer who created, controlled, or could have corrected the hazard, no matter whose payroll the injured worker was on.

Here is how the four employer types break down in plain terms:

Role	Who this usually is	What triggers liability
Creating employer	Sub who introduces the hazard	Created the hazardous condition
Exposing employer	Sub whose workers face the hazard	Employees exposed, even if the sub didn't create it
Correcting employer	Entity responsible for fixing the hazard	Failed to correct a known hazard in their control
Controlling employer	GC or site owner with authority to direct work	Failed to exercise reasonable care to detect and correct

For a controlling employer, OSHA measures reasonable care with three questions. Could you correct or stop the work? Did you have a real system to detect violations? Did you actually inspect often enough given how bad the hazard was? A GC who does weekly walk-throughs and writes them down is in far better shape than one who trusts the sub's safety officer and hopes for the best.

The policy does cut GCs some slack. OSHA generally holds a controlling employer to a lesser standard than the employer who created the hazard. That lesser standard still requires a working system, not a sign on the gate and a handshake.

How should you pre-qualify subcontractors on safety before they start?

Pre-qualification is the cheapest safety money you'll spend. Screening a sub before the contract is signed beats managing a bad actor on a live site every single time.

The core data points to pull from any sub before you award the work:

1. OSHA 300 logs for the past three years (required under 29 CFR 1904 for employers with more than 10 employees) ^[4]. Calculate their DART rate (Days Away, Restricted, or Transferred). BLS reports the average DART rate across all private industry was 1.7 cases per 100 full-time workers in 2022, and construction runs a bit higher ^[5]. A sub running well above their trade average should raise a flag.

2. Their written safety program. A sub with no written program for the work they're bidding (fall protection, hazard communication, lockout tagout where it applies) is telling you exactly how seriously they take this.

3. Citation history. OSHA's establishment search tool at osha.gov lets you look up inspection history by company name or location. Use it ^[2].

4. Proof of current training. Ask for records that workers finished task-specific OSHA training. If the sub's operators run forklifts, check forklift certification documentation. If supervisors run hazardous work, OSHA 30 completion is a fair ask.

5. Insurance certificates. Workers' comp and general liability don't prove OSHA compliance directly. But a sub who can't get or keep insurance is almost certainly cutting corners somewhere you can't see.

Document everything you collect. The act of asking builds a paper trail showing you did your due diligence as a controlling employer. Store it with the contract.

What belongs in the contract with your subcontractor to protect you under OSHA?

Your subcontract is a compliance tool that happens to include a payment schedule. OSHA doesn't read your contract, but it cares intensely about what authority you had and whether you used it. Good contract language proves the authority and sets the expectation of compliance before anyone lifts a hammer.

At minimum, your subcontract should include:

A clear statement that the sub complies with all applicable OSHA standards for their work (29 CFR 1926 for construction, 29 CFR 1910 for general industry), and that failure to comply is grounds for removal from the site.

A site safety plan attachment. Require the sub to read, sign, and follow your site-specific safety plan. OSHA can ask whether subs were made aware of site hazards, and this is how you answer yes.

A work stoppage clause. The GC should have written authority to stop any sub's work that creates an imminent danger, with no penalty or delay claim attached. Without this clause on paper, a sub can argue you had no right to stop them.

An incident reporting obligation. Require the sub to report all injuries, near misses, and OSHA recordable events to you within 24 hours (same day for fatalities and hospitalizations, since your own reporting clock may already be running). OSHA requires employers to report work-related fatalities within 8 hours and in-patient hospitalizations within 24 hours under 29 CFR 1904.39 ^[4].

An indemnification clause tied to safety violations. Talk to your attorney about the specifics, because anti-indemnity statutes vary by state. The point is to make the sub financially responsible for fines or damages caused by their own non-compliance.

None of this moves your OSHA liability off your shoulders. OSHA is not a party to your contract. But these terms make your safety expectations legally enforceable and document that you took the controlling employer role seriously.

What should a subcontractor site orientation cover?

Every worker who steps onto your site, sub or your own crew, gets a site-specific orientation before they start. This is not their employer's general OSHA training. It's the specific hazards and rules for this job, on this site, today.

A solid orientation covers:

Site layout and emergency procedures. Where are the exits, the first aid station, the muster point, and the nearest hospital? Who calls 911? Every worker needs this on day one.

Site-specific hazards. Underground utilities, adjacent traffic, crane swing zones, confined spaces, stored materials. These change on every site, and no sub can know them until you say so.

Personal protective equipment requirements. If your site requires hard hats, high-vis vests, and safety glasses in all work areas, say it out loud. Don't assume the sub passed it down.

Substance abuse and cell phone policies. Your house, your rules. Put them in the orientation.

Incident and near-miss reporting procedure. Who does a sub worker call if someone gets hurt? Make it concrete, not vague.

Hazardous materials present on site. This is a hazard communication obligation under 29 CFR 1910.1200 ^[6]. If your crew or other subs are using chemicals that these workers might be exposed to, you have to tell them.

Document attendance. Have every worker sign a sheet confirming they attended and understood the orientation. That signature won't stop an accident, but it proves your due diligence as a controlling employer. If a sub refuses to send workers through orientation, stop work right there. That refusal tells you how the whole job is going to go.

For supervisors running complex or high-hazard work, OSHA 30 training is worth requiring, since it covers 30 hours of construction or general industry hazard recognition.

How often should you inspect subcontractor work, and what should you look for?

Match your inspection frequency to the hazard. OSHA's controlling employer directive calls for "appropriate inspections" and says the controlling employer should inspect more often when the hazard is serious ^[1]. Here's what that looks like in practice:

High-hazard tasks (work at height, trenching, energized electrical, confined space entry): inspect daily, or before each shift when conditions change.

Moderate-hazard tasks (general carpentry, mechanical work, equipment operation): two to three times a week is defensible.

Low-hazard tasks (administrative staging, material delivery): a weekly walk-through usually covers it.

What you're looking for:

Fall protection. Falls are the leading cause of death in construction, accounting for 395 of 1,069 construction fatalities in 2022 according to BLS ^[5]. Check that any worker at 6 feet or above has a guardrail, safety net, or personal fall arrest system in place, per 29 CFR 1926.501 ^[12].

PPE compliance. Hard hats, eye protection, gloves, and footwear that fit the task. Walk the site and look. Don't ask the foreman whether everyone's wearing their PPE.

Housekeeping and access routes. Blocked exits, unsecured materials, and trip hazards are fast citations and real injuries.

Equipment operation. Are operators certified for what they're running? This matters for forklift certification under 29 CFR 1910.178(l) and for crane operators under 29 CFR 1926.1427 ^[8][11].

Write down what you find, including what was compliant. A dated inspection log with findings and corrective actions is your best evidence of reasonable care when OSHA shows up. Find a violation, skip documenting the fix, and you're almost worse off than if you'd never inspected at all.

What do you do when a subcontractor refuses to fix a safety violation?

This is where your contract and your nerve both get tested.

Start with a direct conversation. Most sub foremen fix an obvious hazard on the spot when you point it out. Don't jump straight to paperwork. Most compliance happens through plain human talk.

If the foreman agrees but the hazard isn't fixed in a reasonable window (define it in your contract, something like 24 hours for serious hazards, end of shift for imminent danger), escalate to the sub's owner or project manager in writing. Email is fine. It creates a timestamp.

If leadership refuses or stalls, invoke your work stoppage clause. Stop that sub's scope until the hazard is corrected. Document the stop-work order in writing with the date, time, the specific hazard, and who you talked to.

Real imminent danger leaves no time for escalation. Stop the work. OSHA defines imminent danger as conditions that could cause death or serious physical harm before normal enforcement can act. You have the authority and the obligation to act now.

If a sub keeps failing after documented warnings and stop-work orders, remove them from the site. That's a hard call on a tight schedule. The alternative is a fatality or a serious citation you share. Keep every document: the safety plan, the contract clause, the inspection records, the written warnings, the stop-work orders. If OSHA investigates, that paper trail is the line between a citation and a finding of reasonable care.

How do you handle OSHA recordkeeping when a subcontractor's employee gets hurt?

This one confuses people, and the rules don't work the way most assume.

Under 29 CFR 1904.31, you record injuries and illnesses for the workers you supervise day to day ^[4]. For subcontractors, the sub records their own workers' injuries on the sub's OSHA 300 log. You generally do not put the sub's employees on your 300 log.

Recording and reporting are two different obligations. Reporting means notifying OSHA of a serious incident. If a sub's employee suffers a work-related fatality, in-patient hospitalization, amputation, or loss of an eye on your site, you may have your own duty to report it, even when the sub is also reporting ^[4]. Your clock starts when you learn about the incident, not when the sub gets around to telling you. Fatality: 8 hours. Hospitalization, amputation, eye loss: 24 hours. The fastest route is the OSHA 24-hour hotline at 1-800-321-OSHA (6742) or the online reporting portal.

For your own incident report records, capture the sub's incident details in your project file no matter whose 300 log it lands on. You need the facts for your own investigation, your insurer, and your defense if OSHA looks at the site.

Some large GCs make subs forward their 300 log entries for project-site workers every quarter. That's a reasonable habit, and it turns next year's pre-qualification data into something you can actually trust.

Does the GC need a written safety program that covers subcontractors?

Yes, and OSHA expects it.

There is no single OSHA standard that says in those exact words "GCs must have a written program covering subs." But several standards require written programs for specific hazards (fall protection, lockout tagout, hazard communication, confined space entry), and the controlling employer doctrine requires a system for detecting and correcting violations ^[1][6][12].

A written Injury and Illness Prevention Program (IIPP) or Safety and Health Program that spells out subcontractor management gives you two things: a framework your own supervisors can follow, and proof of a system if OSHA investigates.

Your written program for subcontractor management should cover, at a minimum, the pre-qualification criteria you use to pick subs, the safety requirements subs must follow (by contract), the orientation process, the inspection frequency and how you document it, and the process for correcting and escalating violations.

Building this from scratch takes time, but it doesn't take a consultant. Tools like SafetyFolio's safety program generator let you build a site-specific written program in a fraction of the time a blank document takes, which matters when you're running several subs across several projects.

Got a written program that never mentions subcontractors? Add a section today. A program that only covers your own employees skips right past the most common source of GC liability on a multi-employer site.

Are state-plan states different for subcontractor OSHA compliance?

Yes, in ways that matter.

Twenty-nine states and territories run their own OSHA-approved state plans instead of working under federal OSHA directly ^[9]. California (Cal/OSHA), Washington (L&I), and Michigan (MIOSHA) all administer their own standards, which must be at least as effective as federal OSHA but can be stricter.

For subcontractor management, that plays out three ways:

Some state plans have more explicit multi-employer citation policies than the federal version. California's Injury and Illness Prevention Program standard, for one, requires all California employers, including GCs coordinating multi-employer worksites, to keep a written IIPP that addresses the specific hazards workers face ^[10]. That's a mandatory written program requirement that goes past most federal standards.

Penalty structures differ. State plan penalties can run higher or lower than federal OSHA's maximums, and some states use their own adjustment schedules.

Reporting timelines differ. Some state plans set different thresholds for what has to be reported and when.

If you work in a state-plan state, look up your state plan's own guidance on multi-employer worksites. Federal CPL 02-00-124 is a starting point, but your state plan's equivalent policy is what the inspector at your gate will actually apply.

What does a practical subcontractor safety management system look like week to week?

Theory is fine. A weekly checklist is what keeps workers alive.

Before work starts on any new sub scope: run your pre-qualification check, sign the contract with the safety clauses in place, and do the site orientation. With a template, none of this takes more than a few hours.

Week one and every week after: walk the site at least twice a week when high-hazard subs are active. Use a standard inspection form so you check the same items each time (fall protection, PPE, housekeeping, equipment condition, OSHA signage). Sign and date every form.

Once a month: review the incident and near-miss reports your subs turned in. Look for patterns. A sub with three near-misses in a month is about to have a real one.

At milestones or when scope changes: re-orient workers to new hazards. A sub who spent three weeks on exterior framing faces different hazards the day they move inside near the electrical rough-in.

At project close: roll your sub's safety numbers (DART rate, citations, near-misses, stop-work orders) into your vendor file. Use it in the next pre-qualification. The good subs earn more work. The problem ones get screened out before they're on your next job.

This system doesn't need a full-time safety director. It needs steady habits and honest documentation. The OSHA training your supervisors complete pays off here, because a super who spots a fall hazard on sight beats any checklist.

What are the biggest OSHA compliance mistakes GCs make with subcontractors?

Read enough OSHA enforcement records and the same mistakes keep surfacing.

Mistake one: treating the sub's safety program as your own. "Our sub handles their safety" is not a defense under the controlling employer doctrine. It might describe your daily supervision accurately, but you still have to verify the sub's system works.

Mistake two: no documentation of inspections. Walking the site does nothing for your legal defense if you can't prove you walked it. A three-line notebook entry with a date and a signature is enough. A blank inspection log is worse than no log, because it says the form existed and nobody used it.

Mistake three: sitting on stop-work authority. GCs worried about the schedule or the relationship let a visible hazard slide. That hazard turns into an incident, and your documented failure to act becomes part of the OSHA file.

Mistake four: generic contracts. A subcontract that never mentions OSHA compliance, never requires the sub to follow your safety plan, and never gives you stop-work authority is missing the exact evidence OSHA hunts for when it sizes up your role as a controlling employer.

Mistake five: no emergency contact protocol. When a sub's worker is badly hurt, confusion about who calls whom, who notifies OSHA, and who holds the incident documentation can blow the 8-hour fatality reporting window under 29 CFR 1904.39 ^[4]. Write the protocol down before you need it.

Frequently asked questions

Can OSHA fine a general contractor for a subcontractor's safety violation?

Yes. Under OSHA's Multi-Employer Citation Policy (CPL 02-00-124), a general contractor qualifies as a controlling employer and can be cited for violations created by or affecting subcontractor employees, even if the GC had no workers exposed to the hazard. The test is whether the GC exercised reasonable care to detect and correct violations. As of 2024, the maximum penalty for a serious violation is $16,550.

What is the Multi-Employer Citation Policy?

It's OSHA Directive CPL 02-00-124, effective December 10, 1999. It lets OSHA cite multiple employers on one job site for the same violation, based on each employer's role: creating, exposing, correcting, or controlling. A general contractor is almost always a controlling employer and can be cited for failing to exercise reasonable care over subcontractor safety, even for standards only the sub directly violated.

Does a subcontractor have to follow the GC's safety program?

Not automatically by law, but your contract can and should require it. OSHA holds the sub responsible for the standards that apply to their own scope. Your subcontract should make following your site safety plan a contractual obligation, backed by a stop-work clause. Without that language, you have limited legal authority to enforce your safety rules on a sub's employees.

Who records a subcontractor's workplace injury on the OSHA 300 log?

Under 29 CFR 1904.31, the employer who supervises the injured worker day to day records the injury on their OSHA 300 log. That's usually the subcontractor, not the GC. But both the GC and the sub may have independent duties to report serious incidents (fatalities, hospitalizations) to OSHA within the required window, so GCs should set up a clear incident notification protocol with every sub.

What OSHA training should subcontractors have before working on my site?

At minimum, sub workers need task-specific OSHA training for the hazards in their scope: fall protection, hazard communication, lockout/tagout, equipment operation, or confined space entry, depending on the work. Supervisors running high-hazard construction should ideally hold OSHA 30. You should also run a site-specific orientation covering your site's unique hazards, emergency procedures, and PPE rules before any sub worker starts.

How do you check a subcontractor's OSHA history before hiring them?

Use OSHA's establishment search tool at osha.gov to look up a sub's inspection and citation history by company name or state. Ask for their OSHA 300 logs from the past three years and calculate the DART rate (days away, restricted, or transferred per 100 full-time workers). BLS reports a 2022 private-industry average DART rate of 1.7; rates well above the sub's trade average warrant a closer look.

Can you make a subcontractor use your PPE standards even if they differ from the sub's own policy?

Yes, through your contract and site rules. OSHA lets a GC set site-wide PPE requirements that exceed the minimum standard, and a sub's employees on your site are subject to those rules as a condition of being there. Put the specific PPE requirements in writing in the subcontract and cover them in the site orientation. If a sub refuses, that's a contractual violation you can enforce through your stop-work clause.

What should you do if OSHA shows up to inspect and a subcontractor is working on site?

Cooperate with the inspection. Name one point of contact, usually your safety director or project manager, to accompany the compliance officer. Notify each sub's foreman right away so they can join the walkaround for their scope. Pull your inspection logs, orientation records, and subcontract safety requirements and have them ready. Do not tell sub employees to leave or stop talking to the inspector; that can be treated as obstruction.

Is the GC responsible for subcontractor OSHA compliance in states with their own OSHA plans?

Yes, and sometimes to a higher standard. State-plan states like California, Washington, and Michigan run their own OSHA programs, which must be at least as effective as federal OSHA but can be stricter. California, for example, requires all employers on multi-employer sites to keep a written Injury and Illness Prevention Program covering the specific hazards workers face. Check your state plan's version of the multi-employer citation policy for the exact rules.

How do you document subcontractor safety inspections to protect yourself?

Use a consistent written form with the date, inspector name, areas and tasks observed, violations found, corrective action required, and a deadline. Document both problems and compliant conditions. Sign and date every entry. Store completed forms with the project file. OSHA's controlling employer standard evaluates whether you had a system to detect violations; a dated inspection log with corrective actions is your primary evidence of that system.

What is a stop-work clause and why does it matter for subcontractor safety?

A stop-work clause is a contract provision giving the GC authority to halt a sub's operations when a safety violation or imminent danger exists, without triggering a delay claim or penalty. Without it, a sub can argue you had no contractual right to stop their work. OSHA's controlling employer standard evaluates whether you actually had the authority and ability to correct hazards; a stop-work clause is direct evidence that you did.

Do you need to report a subcontractor's fatality to OSHA if the sub is also reporting it?

Possibly, yes. Under 29 CFR 1904.39, reporting obligations tie to when you, as an employer, learned of the incident. If a subcontractor's worker dies on your site and you know about it, your duty to report to OSHA within 8 hours may run independently of the sub's. The safest move is to coordinate with the sub, confirm they're reporting, and report yourself if there's any doubt. Duplicate reports are fine; missed reports are not.

How is a controlling employer different from a creating or exposing employer under OSHA?

A creating employer introduced the hazardous condition. An exposing employer has workers who face the hazard, even if they didn't create it. A controlling employer has authority over the worksite or the activity, even without workers directly exposed. A GC can be a controlling employer without a single employee near the hazard. OSHA holds controlling employers to a reasonable care standard: did you have a realistic system to detect and fix violations in your area of authority?

What OSHA standards apply most often in subcontractor citation cases?

In construction, the standards most often at issue on multi-employer sites are 29 CFR 1926.501 (fall protection), 29 CFR 1926.651 and 652 (excavation), 29 CFR 1926.1053 (ladders), and 29 CFR 1926.404 (electrical wiring). In general industry, 29 CFR 1910.147 (lockout/tagout) and 29 CFR 1910.1200 (hazard communication) turn up in host-employer situations. Prioritize these areas in your subcontractor inspection checklist.

Sources

1. OSHA, CPL 02-00-124 Multi-Employer Citation Policy: OSHA's Multi-Employer Citation Policy establishes four employer roles (creating, exposing, correcting, controlling) and holds controlling employers to a reasonable care standard for subcontractor compliance
2. OSHA, Establishment Search Tool: OSHA's establishment search tool allows anyone to look up a company's inspection and citation history by name and state
3. OSHA, Penalties: Maximum OSHA penalty for a serious violation is $16,550 per violation as of 2024, adjusted annually for inflation
4. OSHA, 29 CFR Part 1904 Recordkeeping and Reporting: 29 CFR 1904.39 requires reporting of work-related fatalities within 8 hours and in-patient hospitalizations, amputations, or eye loss within 24 hours; 29 CFR 1904.31 defines which employees' injuries must be recorded
5. Bureau of Labor Statistics, Injuries, Illnesses, and Fatalities: Falls accounted for 395 of 1,069 construction fatalities in 2022; BLS reports a 2022 private-industry average DART rate of 1.7 cases per 100 full-time workers
6. OSHA, Hazard Communication (29 CFR 1910.1200): 29 CFR 1910.1200 requires employers to inform workers about hazardous chemicals they may be exposed to, including on multi-employer worksites where another employer's chemicals are present
7. OSHA, Powered Industrial Trucks (29 CFR 1910.178): 29 CFR 1910.178(l) requires that operators of powered industrial trucks be trained and certified before operating the equipment
8. OSHA, State Plans: Twenty-nine states and territories operate OSHA-approved state plans that must be at least as effective as federal OSHA but may be stricter
9. California Department of Industrial Relations, Cal/OSHA: California requires all employers, including GCs on multi-employer worksites, to have a written Injury and Illness Prevention Program covering the specific hazards workers face
10. OSHA, Cranes and Derricks in Construction (29 CFR 1926.1427): 29 CFR 1926.1427 requires crane operators in construction to be certified by an accredited certifying organization, employer-qualified, or licensed by a government entity
11. OSHA, Commonly Used Statistics and Top 10 Cited Standards: Fall protection (1926.501), hazard communication (1910.1200), and ladders (1926.1053) are consistently among the most frequently cited OSHA standards in construction and general industry