Contractor safety program: what it must include and how to build one

Last updated 2026-07-09

What is a contractor safety program and do you legally need one?

A contractor safety program is a documented system for how you pick contractors, what they must prove before they set foot on your property, how you coordinate hazards between their crew and yours, and how you handle incidents. It's not one form. It's a set of policies backed by records that prove you ran them.

OSHA has no regulation titled "contractor safety program." What it has is the multi-employer citation policy, formalized in the 1999 compliance directive CPL 02-00-124, which says more than one employer can be cited for the same hazard at a shared worksite ^[1]. Under that policy you can be a "controlling employer" even when none of the injured workers are on your payroll. That's the legal hook.

Do you need a written program? If outside contractors ever perform work at your facility or jobsite, yes. Your headcount doesn't change that. The type of work doesn't either. A restaurant that hires an outside hood-cleaning crew becomes a controlling employer the moment that crew clocks in.

A handful of OSHA standards demand written contractor coordination outright. If your facility has permit-required confined spaces, 29 CFR 1910.146(c)(8) requires you to coordinate entry operations with contractor employers and debrief them afterward ^[2]. If you run lockout/tagout, 29 CFR 1910.147(f)(2) requires outside contractors to follow your energy control program or their own program that gives equal protection, and both employers must tell each other their procedures ^[3]. Process Safety Management facilities face tougher contractor rules under 29 CFR 1910.119(h), including pre-hire safety performance evaluation and training records ^[4].

The legal need is real, it comes from several standards at once, and a written program is the only defensible evidence that you actually ran a system.

What are the four roles OSHA assigns at multi-employer worksites?

OSHA's multi-employer citation policy sorts every employer at a shared site into four roles, and your company can hold more than one at the same time. Learn these four and the rest of a contractor program makes sense.

The creating employer makes the hazard. The exposing employer has employees exposed to it. The correcting employer holds the contractual authority to fix it. The controlling employer has overall responsibility for site safety, the ability to spot hazards, and the authority to get them corrected ^[1].

Hire an outside electrical contractor into your manufacturing plant and you're almost certainly the controlling employer. You own the space, you set access rules, you have authority over the site. OSHA can cite you for a hazard the electrician created, even if none of your own people were in danger, as long as you had or should have had actual knowledge of the hazard and didn't act.

The standard of care for controlling employers is reasonable care, not perfection. OSHA's directive says a controlling employer "must exercise reasonable care to prevent and detect violations on the site," weighing the scale of the project, the nature of the hazard, and the employer's expertise ^[1]. In practice, reasonable care means you have a program, you enforce it, and you document that enforcement.

What should a contractor pre-qualification process include?

Pre-qualification is how you decide whether a contractor gets hired at all, judged on their safety record before their price. It's the highest-leverage part of the whole program. Rejecting a bad contractor up front is cheap. Managing their unsafe crew on your site is not.

At minimum, a pre-qualification process collects:

• OSHA 300 logs for the past three years (or an explanation if they're small enough to be exempt)
• Their EMR (experience modification rate) from their workers' comp carrier. An EMR above 1.0 means their losses beat the industry average, in the wrong direction. Many large operators won't hire above 1.25 ^[5].
• Written safety programs for the specific work they'll do at your site
• Proof of workers' comp and general liability insurance, with your company named as additional insured
• OSHA citation history, searchable free on OSHA's public inspection database at osha.gov
• References from previous host employers, asked specifically about safety

You don't need a software platform for this. A checklist and a shared drive do the job for most small businesses. What you do need is a written minimum threshold that says what disqualifies a contractor. An EMR of 1.5, a willful OSHA citation in the last three years, or no written program for the hazardous work involved are all defensible disqualifiers.

Keep pre-qualification records for as long as the contractor works for you, plus three to five years. If OSHA opens an inspection tied to a contractor incident, those records are what show you exercised reasonable care before you hired.

What goes into a contractor site safety orientation?

Every contractor employee who steps onto your site gets a site-specific orientation before starting work. Not a general safety video. Not a verbal briefing you forget to write down. A structured, documented orientation tied to the actual hazards at your location.

A working orientation covers:

• Site emergency procedures: evacuation routes, muster points, emergency contacts, where first aid lives
• Your site's specific hazards: chemicals (which your Safety Data Sheets must cover under 29 CFR 1910.1200, the Hazard Communication Standard) ^[6], traffic patterns, overhead hazards, fall exposures, and any PSM-covered processes nearby
• Your permit systems: who issues confined space permits, hot work permits, and lockout authorizations
• PPE requirements for specific areas, on top of what the contractor's own program requires
• Incident and near-miss reporting: exactly who to call, within what timeframe, and how your recordkeeping intersects with theirs
• Your right to remove anyone from the site for safety violations

The orientation needs a sign-in sheet. Every person. Every visit if the hazards changed. Store those sheets with the contractor's pre-qualification record.

Some companies run orientation through an online portal and have contractors finish it before arrival, which saves time on mobilization day. That works, as long as there's a verification step and the site-specific content isn't generic filler.

For building the training piece into a broader written program, the SafetyFolio guide on workplace safety training covers adult learning design and documentation that apply equally to contractor orientation.

How do you coordinate hazards between your workers and contractors?

Hazard coordination is where most contractor safety failures actually happen. Pre-qual looks great on paper. The orientation gets done. Then a contractor crew starts cutting into a pipe while your maintenance team works two feet away, and nobody told either crew the other was there.

Formal hazard coordination means:

Daily or task-specific coordination meetings. On complex projects, a pre-task meeting (a tailgate or toolbox talk) at the start of each shift or task is standard. Document it.

Integrated permit systems. Your lockout/tagout, hot work, and confined space permits should spell out how contractor employees interact with each system. Under 29 CFR 1910.147(f)(2), if a contractor uses their own lockout procedures, you need documented confirmation those procedures protect equal to yours ^[3]. Don't assume. Verify and write it down.

Shared hazard communication. Under 29 CFR 1910.1200(e)(2), employers at a multi-employer worksite must make SDSs available to other employers' employees who may be exposed ^[6]. If your facility uses chemicals, the contractor's crew has a right to see that information. See our summary of hazardous communication requirements if this is a gap in your program.

Clear lines of authority. Who can stop work? Who does a contractor call after finding an unplanned hazard? Your program answers those in writing, and your site supervisors know the answers cold.

Coordination runs both ways. Contractors should be telling you about hazards they bring in. Welding fumes, solvents, noise above 85 dBA, and confined spaces created mid-project all reach your workers. Your program should require contractors to notify you before introducing new hazards.

Which OSHA standards directly reference contractor safety requirements?

Here's a practical table of the standards that name contractor or multi-employer duties directly. This isn't every standard that touches contractor work. It's the ones that call out the relationship on purpose.

Standard	CFR Reference	What it requires
Multi-employer citation policy	CPL 02-00-124 (directive)	Defines 4 employer roles; controlling employers can be cited for contractor hazards [1]
Permit-required confined spaces	29 CFR 1910.146(c)(8)	Coordinate entry, debrief contractors, exchange hazard info [2]
Lockout/tagout	29 CFR 1910.147(f)(2)	Contractor LOTO must equal host protection; procedures must be shared [3]
Process Safety Management	29 CFR 1910.119(h)	Pre-hire safety evaluation, training verification, incident notification [4]
Hazard Communication	29 CFR 1910.1200(e)(2)	SDSs and hazard info must be available to other employers' workers on site [6]
Construction (general)	29 CFR 1926.16	Prime contractors retain safety responsibility; subcontractors responsible for their work [7]
Respiratory protection	29 CFR 1910.134	Program requirements apply if contractors work in your IDLH or respirator-required areas [8]

For construction sites, 29 CFR 1926.16 is the key reference. It says prime contractors keep overall responsibility and subcontractors assume responsibility for their specific scope ^[7]. That's why general contractors in construction almost always run formal contractor safety programs as a condition of doing business with owners.

PSM is the strictest of the bunch. Under 29 CFR 1910.119(h)(2), PSM-covered employers must evaluate the safety performance and programs of contractors they use on or near covered processes before hiring them, and must periodically evaluate performance while they're working ^[4]. That's an explicit legal requirement for pre-qualification, more than a best practice.

What does contractor-related injury data actually show?

The data on contractor injuries is real, and it's bad enough to take seriously. Construction, which runs heavily on subcontracted labor, accounts for roughly 20% of all worker fatalities while employing around 6% of the workforce, per the BLS Census of Fatal Occupational Injuries ^[9].

The problem isn't limited to construction. A study published in the American Journal of Industrial Medicine on the US petrochemical industry found that contract workers had higher fatality rates than direct employees at the same sites, tied partly to gaps in safety program coverage and oversight ^[10].

OSHA's own multi-employer enforcement shows a meaningful share of citations on construction sites land on controlling employers, more than the subcontractor whose employee got hurt ^[1]. The enforcement reality matches the policy on paper.

For a small business, the practical risk isn't only an OSHA fine. If a contractor employee is injured at your facility and you're found to have run poor oversight, the workers' comp and general liability exposure can dwarf any regulatory penalty. OSHA fines for serious violations run up to $16,550 per violation as of 2024 ^[11]. Civil liability has no cap.

How do you handle contractor incidents and near-misses?

When a contractor gets hurt at your site, the response can't be "that's their employer's problem." As a controlling employer you have a stake in the investigation and specific notification duties.

First, medical attention, site security, and notification. If the injury is serious, call 911, then call OSHA. Under 29 CFR 1904.39, employers must report any work-related fatality within 8 hours and any in-patient hospitalization, amputation, or loss of an eye within 24 hours ^[12]. The employer who reports is the one whose employees were involved, so a contractor employee's injury is the contractor's report to make. But if you're the controlling employer and you believe the contractor won't report, OSHA's guidance says you can and should.

Second, run your own investigation parallel to the contractor's. Yours focuses on what hazards existed on your site, whether your program required controls that weren't in place, and what you need to change. Don't lean on the contractor's report, and don't assume it'll be complete or candid.

Third, near-miss reporting. Your program must require contractors to report near-misses to your site supervisor, more than up their own chain. Near-misses are the leading indicator that a serious injury is coming. A contractor crew with three close calls in a week is a program failure waiting to become a fatality.

Keep every incident and near-miss record. Under 29 CFR 1904.1 and 1904.2, establishments with 10 or fewer employees are partially exempt from routine recordkeeping, but serious injuries still must be reported ^[12]. Whether a contractor incident at your site belongs on your own 300 log depends on how OSHA reads the employment relationship. When in doubt, record it.

For how incident investigation fits the larger picture, our piece on what a safety and health program should be built around covers the foundational elements.

How should you evaluate contractor safety performance over time?

Pre-qualification is a snapshot. Ongoing evaluation is the movie. A contractor who looked great at pre-qual can develop real safety problems once they get comfortable at your site, especially on long projects.

At minimum, ongoing evaluation includes:

Regular safety observations. Someone from your team walks the site and writes down what they see. You don't need a safety professional, though one helps. A site supervisor with a standard observation form works fine. Look for PPE compliance, permit adherence, housekeeping, and whether the crew follows the procedures they said they would.

Incident and near-miss rate tracking. If a contractor generates more near-misses per hour worked than at pre-qual, that's a signal. No statistician needed. A simple count per 100 work hours is enough and comparable across contractors.

Periodic review meetings. On longer projects, a monthly safety meeting with the contractor's supervisor reviews observations, near-misses, and upcoming hazardous tasks. It creates a documented record of engagement and surfaces problems before they become injuries.

End-of-contract evaluation. Rate every contractor's safety performance when they leave and keep the rating in your pre-qual file. Next time they bid, you have a record. That also builds an incentive: contractors learn poor performance follows them.

For the research on what makes contractor incentives work, the SafetyFolio piece on principles of effective safety incentive programs covers the behavioral evidence on sustained safe behavior, which applies straight to contractor relationships.

Building this from scratch without weeks to spend on drafting? A generator like SafetyFolio can produce a pre-qualified, site-specific contractor safety program in about 15 minutes. The value isn't only speed. The output is organized around the actual regulatory requirements instead of a generic template someone downloaded a decade ago.

What does a contractor safety program actually look like as a document?

A contractor safety program is usually one document that references or folds in several others. The core runs 6 to 15 pages depending on site complexity. A realistic outline:

1. Purpose and scope. Who this applies to (all contractors, specific categories, a specific site). 2. Roles and responsibilities. Who owns contractor safety, who runs orientations, who has authority to remove a contractor from site. 3. Pre-qualification requirements. The exact documents you require, the thresholds that disqualify, and how long pre-qual stays valid. 4. Site safety rules. The non-negotiables that apply to every contractor regardless of their own program. PPE minimums, speed limits, no-go zones. 5. Orientation process. What it covers, how it's documented, and what triggers a re-orientation (extended absence, change in scope, big site hazard change). 6. Permit and coordination procedures. How contractors interface with your lockout, confined space, hot work, and other permit systems. 7. Hazard communication. How SDSs get shared, how contractors notify you of new hazards they introduce. 8. Incident and near-miss reporting. What contractors report, to whom, within what timeframe. 9. Performance evaluation. How you monitor ongoing performance and record end-of-contract ratings. 10. Enforcement. What happens when a contractor breaks a rule: warning, removal from site, contract termination.

Appendices usually hold your site safety rules as a standalone handout, the orientation sign-in form, the pre-qualification checklist, and any site-specific permit forms.

The document is only as good as its implementation. A 40-page program nobody enforces is weaker, legally and practically, than a 10-page program that generates consistent records.

What are common contractor safety program mistakes that get employers cited?

Read enough OSHA inspection data and published enforcement cases and the patterns come clear. These are the failures that actually drive citations.

Treating pre-qualification as a one-time checkbox. A contractor's EMR from three years ago tells you about three years ago. Pre-qual needs a validity period (one year is standard) and re-evaluation when scope changes.

No documentation of orientation. "We showed them around" doesn't hold up. No dated sign-in sheet, and the orientation legally didn't happen.

Assuming the contractor's program covers your hazards. A generic lockout program may miss the specific energy sources at your facility. Under 29 CFR 1910.147(f)(2), equivalent protection is required, and verifying that equivalence is your job ^[3].

Failing to coordinate on shared permits. Confined space entry with multiple employers is a frequent citation scenario. The permit has to reflect every employer working in or near the space, more than yours.

No enforcement mechanism. A program that says "contractors must follow all safety rules" with no documented consequence gives almost no legal protection. OSHA's reasonable care standard requires controlling employers to actually exercise that control.

Not requiring contractor injury reports. Learn about a contractor employee's injury two weeks late from their attorney and you've lost your chance to investigate and your record of oversight.

The most expensive mistake is usually the simplest: hiring a contractor with a known bad safety history because they were the low bid. That's the opposite of reasonable care, and it's exactly what OSHA's multi-employer policy was built to catch.

Frequently asked questions

Can OSHA cite me for a contractor's safety violations at my facility?

Yes. Under OSHA's multi-employer citation policy (CPL 02-00-124), you can be cited as a controlling employer for hazards a contractor created if you had authority over the site and knew or should have known about the hazard. The standard of care is reasonable care, meaning documented oversight and a written program. A contract that makes the contractor responsible for safety is not a defense.

Do I need a contractor safety program if I'm a small business with only occasional outside contractors?

Size doesn't change your legal exposure as a controlling employer. If a contractor is injured at your site over a hazard you knew about and didn't fix, you face the same citation risk as a large facility. A lightweight program (a one-page site rules sheet, a sign-in sheet, basic pre-qualification records) beats nothing and gives you a defensible record of good faith.

What is an EMR and what number is considered acceptable for contractor pre-qualification?

EMR stands for experience modification rate, a workers' comp metric comparing a contractor's actual injury losses to what's expected for their industry. An EMR of 1.0 is industry average. Many host employers set 1.0 to 1.25 as their maximum acceptable threshold. Above 1.25, the contractor's injury history is meaningfully worse than peers. EMRs above 1.5 are a serious red flag, and most safety-conscious operators won't hire at that level.

What OSHA standard covers contractors in confined spaces?

29 CFR 1910.146(c)(8) is the specific requirement. If you permit a contractor to perform permit-required confined space entry, you must inform the contractor of the hazards, confirm the contractor has and follows a permit program, coordinate entry operations to prevent unauthorized entry, and debrief the contractor when the entry ends. All of it must be documented.

Does OSHA require me to evaluate a contractor's safety record before hiring them?

For most employers, formal pre-hire evaluation is a best practice strongly implied by the reasonable care standard, not an explicit rule. The exception is Process Safety Management: 29 CFR 1910.119(h) explicitly requires PSM-covered facilities to evaluate the safety performance and programs of contractors before using them on or near covered processes. For everyone else, the absence of pre-qualification is evidence against reasonable care if something goes wrong.

How long should I keep contractor safety records like orientation sign-in sheets?

OSHA doesn't set a retention period for contractor orientation records the way it does for some other documents (respiratory protection medical evaluations, for instance, must be kept for the duration of employment plus 30 years). A practical standard is to keep contractor records for the duration of the relationship plus five years. If a serious injury happens, records from earlier in the project will matter. State statutes of limitation for personal injury vary, so five years covers most.

What is the difference between an independent contractor and an employee for OSHA purposes?

OSHA follows economic reality and control tests, not what a contract says, similar to IRS and DOL approaches. If you control the means and methods of the work, set the schedule, and provide the tools, OSHA may treat the worker as an employee regardless of 1099 status. Misclassifying employees as independent contractors to dodge safety obligations is specifically on OSHA's radar. When in doubt, treat the workers as covered by your safety requirements.

Do contractors need to follow my lockout/tagout program or can they use their own?

Either is allowed under 29 CFR 1910.147(f)(2), with a catch. If the contractor uses their own lockout program, it must protect equal to yours, the two programs must not create hazards when used together, and both employers must inform each other of their procedures. In practice it's often simpler to require contractors to follow your program for the energy sources at your facility, especially if your equipment is complex or unusual.

Who reports a contractor employee injury to OSHA, the contractor or the host employer?

The primary reporting duty under 29 CFR 1904.39 falls on the employer whose employee was injured, meaning the contractor's company. But controlling employers aren't off the hook. If you're a controlling employer and you believe the contractor isn't reporting a reportable event (fatality within 8 hours; hospitalization, amputation, or eye loss within 24 hours), OSHA's guidance is that you may report it yourself, and doing so protects you in any later enforcement action.

Can I include safety performance requirements in the actual contract with a contractor?

Yes, and you should. Contractual safety requirements create a legal obligation between you and the contractor separate from OSHA enforcement. Common provisions include maintaining minimum insurance limits, complying with all applicable OSHA standards, following your site safety program, reporting incidents within a defined period, and allowing your team to conduct site safety observations. These also support your reasonable care defense if an incident leads to litigation.

What should I do if a contractor refuses to follow my site safety rules?

Stop the work. Your program should state plainly that you have the right to halt any activity you believe is unsafe and to remove any contractor employee who violates site safety rules. This authority is what makes you a controlling employer in fact, more than on paper. Document the violation, the conversation, and the outcome. If the contractor stays uncooperative, terminating the contract is a legitimate and sometimes necessary response.

Are there industry-specific contractor safety program requirements beyond OSHA's general standards?

Yes. Several industries add their own frameworks. Construction has 29 CFR 1926 Subpart C, which addresses safety programs and prime contractor responsibility. The petrochemical and refining sector often follows the OSHA PSM standard and voluntary frameworks from the Center for Chemical Process Safety. Utilities may follow NERC reliability standards that include contractor oversight. Large purchasers like oil majors, automakers, and defense contractors often impose their own contractor prequalification requirements beyond OSHA minimums.

Sources

1. OSHA, CPL 02-00-124 Multi-Employer Citation Policy: OSHA's multi-employer citation policy defines four employer roles (creating, exposing, correcting, controlling) and holds controlling employers responsible for contractor hazards they knew or should have known about.
2. OSHA, 29 CFR 1910.146 Permit-required confined spaces: 29 CFR 1910.146(c)(8) requires host employers to coordinate confined space entry operations with contractors and debrief them upon completion.
3. OSHA, 29 CFR 1910.147 The control of hazardous energy (lockout/tagout): 29 CFR 1910.147(f)(2) requires that when contractors use their own lockout program, it must provide equivalent protection and both employers must inform each other of their procedures.
4. OSHA, 29 CFR 1910.119 Process safety management of highly hazardous chemicals: 29 CFR 1910.119(h)(2) explicitly requires PSM-covered employers to evaluate contractor safety performance and programs before using them on or near covered processes.
5. NCCI Holdings, Experience Rating Plan Manual: An EMR above 1.0 indicates injury losses exceed the industry average; many host employers use 1.0 to 1.25 as the maximum acceptable threshold for contractor pre-qualification.
6. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: 29 CFR 1910.1200(e)(2) requires employers at multi-employer worksites to make SDSs available to other employers' workers who may be exposed.
7. OSHA, 29 CFR 1926.16 Rules of construction: 29 CFR 1926.16 states that prime contractors retain overall safety responsibility and subcontractors assume responsibility for their specific scope of work.
8. OSHA, 29 CFR 1910.134 Respiratory protection: 29 CFR 1910.134 respiratory protection program requirements apply when contractor employees work in areas requiring respiratory protection at the host employer's facility.
9. Bureau of Labor Statistics, Census of Fatal Occupational Injuries (CFOI): Construction accounts for roughly 20% of all worker fatalities while employing approximately 6% of the U.S. workforce.
10. American Journal of Industrial Medicine, study of contract workers in the US petrochemical industry: Research in petrochemical facilities found that contract workers had higher fatality rates than direct employees at the same sites, partly due to gaps in safety program coverage.
11. OSHA, Penalties page: OSHA maximum penalties for serious violations are $16,550 per violation as of 2024, with repeat or willful violations up to $165,514.
12. OSHA, 29 CFR 1904 Recording and Reporting Occupational Injuries and Illnesses: Under 29 CFR 1904.39, employers must report work-related fatalities within 8 hours and in-patient hospitalizations, amputations, or eye loss within 24 hours.