How to write a contractor safety management program

Last updated 2026-07-11

What is a contractor safety management program and do you actually need one?

A contractor safety management program (sometimes called a contractor safety program or CSP) is a written document that defines how your company selects, onboards, monitors, and evaluates outside workers and vendors operating on your property or job site. It spells out who is responsible for what, which hazards contractors must be told about before they start work, and what happens when something goes wrong.

You need one if contractors are regularly on your site. That covers most manufacturers, distributors, construction general contractors, property managers, and really any small business that hires electricians, HVAC techs, cleaning crews, or delivery drivers with site access. The size of the program scales with the risk. The obligation to have something written does not scale away for small employers.

OSHA has no single standard titled 'contractor safety management.' The requirement comes from a patchwork of rules. The General Duty Clause (Section 5(a)(1) of the Occupational Safety and Health Act) requires employers to provide a workplace free from recognized hazards, and OSHA has consistently extended that duty to hazards created by or for contractors ^[1]. On top of that, specific standards such as 29 CFR 1910.119 (Process Safety Management), 29 CFR 1926.16 (Construction prime contractor responsibilities), and 29 CFR 1910.147 (Lockout/Tagout) name contractor coordination as a host-employer duty ^[2].

The business case beyond compliance is real. The Bureau of Labor Statistics reported 5,283 fatal work injuries in 2023, and contract workers are consistently overrepresented in that number relative to their share of hours worked ^[3]. A written program gives you a defensible record that you took the hazard seriously. That record matters in an OSHA inspection and again in civil litigation.

What are the core elements every contractor safety program must include?

There is no universal OSHA template, but inspection history and industry consensus (including OSHA's PSM standard and multi-employer worksite policy) point to six elements auditors look for and that actually prevent injuries.

1. Scope and purpose statement This is one paragraph. It names which contractor types the program covers (service contractors, construction subcontractors, temporary staffing agency workers, etc.), who in your organization owns the program, and what the goal is. Keep it plain.

2. Contractor prequalification Before anyone sets foot on site, you screen them. At minimum, collect their OSHA 300 log (or 300A summary) for the past three years, their Experience Modification Rate (EMR) from their workers' comp insurer, proof of liability and workers' comp insurance, and any required licenses. Many mid-size manufacturers set an EMR threshold of 1.0 or below, meaning they will not hire contractors whose injury cost history exceeds the industry average. That is a defensible, quantifiable standard.

Ask for their written safety program covering the specific tasks they will perform. An electrical subcontractor should have a lockout/tagout program. A roofing crew should have a fall protection plan. If they cannot produce those documents, that tells you something important before the contract is signed.

3. Site-specific orientation Every contractor employee gets a safety orientation before starting work, documented with a sign-in sheet. The orientation covers the site emergency action plan, evacuation routes and muster points, location of first aid, site-specific chemical hazards (your hazard communication program applies to contractors too under 29 CFR 1910.1200(b)(1)), permit-to-work procedures, and contact information for the site safety coordinator ^[4].

This does not need to be a two-hour seminar. A 15-minute walkthrough with a one-page checklist that both parties sign is fine for low-risk contractors. Higher-risk work (confined space, hot work, energized systems) warrants a longer session and a task-specific permit.

4. Hazard communication and information exchange Under the PSM standard (29 CFR 1910.119(h)), host employers must inform contractors of known process hazards, explain applicable safety rules, and document that communication ^[2]. Even if you are not subject to PSM, the General Duty Clause creates a similar expectation. Give contractors your Safety Data Sheets for chemicals they may encounter. Tell them about overhead crane swing zones, forklift traffic patterns, and any other recognized hazards in the work area.

5. Supervision and permit systems Name a specific person, by job title, responsible for contractor oversight during each job. That person is more than a paperwork signer. They need to actually walk the site. Hot work permits, confined space entry permits, and energy control authorizations under lockout tagout procedures must be coordinated between your people and the contractor's supervisor before work begins ^[2].

6. Incident reporting and close-out Contractors must report any injury, near-miss, or property damage to your designated contact within a defined time window (24 hours is common; immediately for serious injuries). Your program should state whether contractor injuries are recorded on your OSHA 300 log. Under 29 CFR 1904.31, you record injuries of workers who are supervised day-to-day by your establishment, which can include temp workers and some on-site contractors depending on the supervision arrangement ^[5]. Get legal or HR guidance if the line is unclear in your operation.

After the job ends, document contractor performance. Did they follow site rules? Were there near-misses? This feeds back into prequalification for the next contract.

How do multi-employer worksite rules affect who is responsible for contractor safety?

OSHA's multi-employer worksite policy is one of the most misunderstood areas in occupational safety, and it directly shapes how you write your program. The policy says that on a worksite with multiple employers, OSHA can cite any employer whose workers are exposed to a hazard, beyond the one who created it. It defines four roles: the creating employer, the exposing employer, the correcting employer, and the controlling employer ^[6].

As a host business, you are almost always the controlling employer. OSHA defines a controlling employer as one who has general supervisory authority over the worksite, including the power to correct safety violations or require others to do so. You do not need to be the one doing the dangerous work to get cited. If a contractor's employees are working unsafely in your facility and you saw it and did nothing, you can face an OSHA citation even though none of your own employees were at risk ^[6].

Here is the practical implication for your written program: you need a documented process for identifying and correcting contractor violations. That does not mean micromanaging every task. It means your site supervisor has authority and written instruction to stop work when they observe an imminent hazard, and that stopping work gets documented. Include a stop-work authority clause in your contractor agreements and reference it in your program.

For construction, 29 CFR 1926.16 assigns specific duties to the prime contractor, including ensuring all subcontractors comply with applicable OSHA standards ^[7]. If you are a general contractor, your written program needs to address subcontractor compliance monitoring, beyond orienting them and hoping for the best.

What should contractor prequalification look like for a small business?

Small businesses often skip prequalification because it feels like a big-company process. That is a mistake, but the fix does not need to be complicated.

A one-page prequalification form sent to every contractor before you approve them for site access is enough for most small operations. It asks for:

• Copy of their OSHA 300A summary for the prior year (or a statement that they had zero recordable incidents)
• Current certificate of insurance (general liability and workers' comp, with your business listed as an additional insured)
• Relevant licenses or certifications for the work being performed
• Name of their on-site safety representative
• Confirmation they have a written safety program for the specific tasks they will perform

For higher-hazard work, add the past three years of OSHA 300 logs and their EMR. An EMR above 1.25 is a red flag. Above 1.5 is a serious concern. Some large purchasers and general contractors require EMRs below 0.85, though that threshold is more common in refining and heavy chemical industries than in general industry small business settings.

You keep this paperwork on file. If OSHA shows up after a contractor incident, the first thing they will ask for is documentation that you verified the contractor's safety qualifications. No paperwork means no defense.

One honest caveat. For very small, low-risk contractors (the plumber who comes once a year to replace a water heater), a full prequalification packet is probably overkill. Use judgment. The program should match your risk profile, not create paperwork for zero safety benefit.

How do you write a contractor orientation that actually works?

Most contractor orientations fail for one of two reasons. They are a 45-minute lecture nobody remembers, or a signature on a form nobody read. Effective orientation is short, site-specific, and verified.

Here is a structure that works for most small business sites:

Before the job starts (coordination phase) Contact the contractor supervisor, not the workers, to walk the scope of work. Identify the specific areas of the facility they will access, any energy sources they will work near, chemicals in the area, and emergency exits. This is when you exchange permit requirements and agree on communication protocols.

Day-of walkthrough (15-30 minutes) Walk the actual work area with the crew. Point out the emergency exit, the first aid kit, the muster point, any overhead hazards, and any active equipment nearby. Show them where forklifts travel. If forklift certification is required of your own operators, note that to the contractor so they know traffic patterns.

Hand them a one-page site rules sheet. It should cover PPE requirements for the area, no-go zones, smoking policy, tool storage, waste disposal, and who to call for an emergency. Get a signature.

Verification For any permit-required work (confined space, hot work, lockout/tagout), do not issue the permit until you have confirmed the contractor's employees are trained for that specific task. Ask to see training records. Under 29 CFR 1910.146(c)(8)(iii), the host employer must inform contractors of confined space hazards and the precautions and procedures to be followed ^[8]. That is a legal requirement, not optional.

The signed orientation sheet stays in a job file. Keep it for at least three years, longer if a recordable incident occurred during the job.

What OSHA standards specifically apply to contractor safety?

Here is the honest answer. There is no single OSHA standard called 'contractor safety management.' The obligations come from multiple sources, and which ones apply depends on your industry and the type of work being performed.

Standard	CFR Citation	Who it applies to	Contractor-specific requirement
General Duty Clause	OSH Act Section 5(a)(1)	All employers	Protect workers (including contractors) from recognized hazards
Process Safety Management	29 CFR 1910.119(h)	Facilities with highly hazardous chemicals above threshold quantities	Host must inform contractors of hazards, document training, evaluate contractor safety performance
Permit-Required Confined Space	29 CFR 1910.146(c)(8)	All general industry with permit spaces	Inform and coordinate with contractor before entry
Lockout/Tagout	29 CFR 1910.147(f)(2)	All general industry with energized equipment	Coordinate energy control procedures with contractors
Construction prime/subcontractor	29 CFR 1926.16	Construction	Prime contractor responsible for subcontractor OSHA compliance
Recordkeeping	29 CFR 1904.31	Establishments with 10+ employees	Record injuries of workers supervised by establishment

For facilities with highly hazardous chemicals above PSM threshold quantities, 29 CFR 1910.119(h) is the most detailed contractor safety standard OSHA has written. It requires written procedures for contractor selection, contractor hazard training documentation, periodic evaluation of contractor safety performance, and a log of contractor injuries and illnesses ^[2]. Even if you are not a PSM facility, this section is worth reading as a model for what a thorough program looks like.

If your employees or contractors interact with osha training requirements like osha 30 hour courses, note that OSHA 30 is a general industry or construction awareness credential, not a substitute for task-specific training. Contractors trained to OSHA 30 level are not automatically qualified for confined space entry or energized electrical work.

How do you handle incident reporting for contractor workers?

This is an area where small businesses make expensive mistakes, often because they assume contractor injuries are entirely the contractor's problem. They are not.

First, the OSHA recordkeeping question. Under 29 CFR 1904.31, you must record work-related injuries and illnesses of employees you supervise on a day-to-day basis, even if they are employed by a staffing agency or subcontractor ^[5]. If a temp worker follows your daily direction on your site, their recordable injuries likely go on your OSHA 300 log, not the staffing agency's. The contractor's own company records injuries of workers they supervise day-to-day. When the lines are blurry, the general rule is simple: whoever directs the work records the injury.

For fatalities and catastrophic injuries, 29 CFR 1904.39 requires you to report to OSHA within 8 hours of a fatality or within 24 hours of an in-patient hospitalization, amputation, or loss of an eye ^[5]. That reporting obligation applies whether the injured person is your direct employee or a contractor supervised by someone else, if the incident occurred at your establishment. Do not assume the contractor's employer will handle the OSHA notification.

Your program should require contractors to notify your designated contact immediately (verbally) for any serious injury, and in writing within 24 hours for any recordable incident. Preserve the scene for any incident that might be OSHA-reportable. Do not move equipment or clean up until you have documented the scene with photos and a written incident report.

Document near-misses too. They carry no OSHA reporting requirement, but they are the leading indicator of future injuries. A contractor who has had three near-misses on your site in a year should not be prequalified for the next contract.

How do you write contractor safety into contracts and purchase orders?

The contract is where your safety program gets teeth. A written safety program that lives only in a binder has limited effect. When contractors sign a contract that references the program, they have a legal obligation to comply, more than a moral one.

At minimum, include a safety exhibit or addendum to your standard contractor agreement that does four things:

1. States that the contractor has received a copy of your contractor safety requirements and agrees to comply. 2. Requires the contractor to maintain specific insurance limits (your insurance carrier can advise on minimums; for most small business construction or maintenance work, $1M per occurrence general liability and statutory workers' comp is a starting floor). 3. Includes a stop-work authority clause giving your site representative the right to halt work for any imminent safety hazard without penalty to the contractor's timeline. 4. Requires the contractor to report all injuries and near-misses to your designated contact within the timeframes in your program.

Some attorneys recommend indemnification language where the contractor agrees to defend and hold you harmless from claims arising from their own acts. That is worth discussing with your business attorney. The enforceability of indemnification clauses varies by state, and some states limit how broadly a contractor can be required to indemnify a host employer for the host's own negligence.

The contract does not replace the written safety program. It enforces it. Both have to exist.

How do you monitor and audit contractor safety performance?

Writing the program is step one. Making it work over time requires a feedback loop.

For ongoing jobs, the site supervisor should do informal daily checks. Are contractors wearing required PPE? Are they following the permit system? Are tools and materials stored safely? These do not need to be formal audits. A supervisor who is present and paying attention catches problems before they become incidents.

For longer projects (construction jobs, multi-week maintenance shutdowns), schedule formal weekly or biweekly safety walkthroughs with the contractor's site supervisor. Document findings, track corrections, and keep those records in the job file.

At project close-out, complete a contractor performance evaluation. Score them on adherence to site safety rules, incident rate during the project, permit compliance, quality of their own safety documentation, and responsiveness to any safety concerns raised. Feed that score into your prequalification decision the next time they bid.

Annually, review the contractor safety program itself. Did any incidents occur? Were there near-misses that revealed a gap? Did OSHA change any relevant standards? Update the program and re-date it. A written program with a five-year-old revision date looks abandoned in an inspection, because it probably was.

If you want a starting point that saves time, SafetyFolio's safety program generator can build a contractor safety management program specific to your industry and hazard profile in about 15 minutes, giving you a compliant starting draft you then customize with your site-specific details.

What does a realistic contractor safety program look like for a small business?

A small manufacturer with 20 employees who hires outside maintenance contractors twice a month does not need a 50-page manual. Here is what a realistic, defensible program looks like at that scale:

Document length: 6-10 pages.

Sections:

• Purpose and scope (half a page)
• Responsibilities (who owns the program, who conducts orientations, who approves permits)
• Prequalification checklist (the one-page form with required insurance and safety documentation)
• Site orientation procedure (who conducts it, what is covered, sign-in sheet template)
• Hazard information exchange (list of site-specific hazards, reference to SDS library location)
• Permit-to-work procedures (reference to your existing confined space, hot work, and LOTO permits)
• Incident reporting requirements (contractor obligations, host obligations, timelines)
• Contractor performance evaluation form
• Appendices: blank prequalification form, blank orientation sign-in sheet, blank performance evaluation

What it does not need: a separate section for every OSHA standard, legal disclaimers on every page, or signatures from people who will never read it. Conciseness is a feature. A short program a real supervisor will actually use beats a thick document that sits in a filing cabinet.

Keep the program in a shared drive folder along with completed prequalification forms and orientation records for each contractor. If OSHA walks in after an incident, you pull the folder and show the documentation. That is the whole point.

How do you train your own employees to manage contractors safely?

Your written program is only as good as the people who implement it. The site supervisors and operations managers who interact with contractors every day need to understand their role clearly.

At minimum, train your supervisor-level employees on:

• What the prequalification process is and why it exists
• How to conduct (or assist with) a contractor orientation
• What permits are required for what work, and how to issue them
• What stop-work authority means and that they have it
• How to document a contractor incident or near-miss

This training does not need to be lengthy. A 30-minute toolbox talk, a copy of the program, and a conversation about real scenarios they will encounter is usually enough for supervisors who already have general industry safety knowledge. For newer supervisors, an osha 30 training course gives broader context for why contractor oversight matters from a regulatory standpoint.

Document the training with a sign-in sheet and a note on what was covered. This is the same documentation discipline that applies to everything else in your safety program.

Frequently asked questions

Is a contractor safety management program required by OSHA?

OSHA has no single standard requiring every employer to keep a contractor safety management program by that name. The General Duty Clause requires employers to protect all workers from recognized hazards, and specific standards including 29 CFR 1910.119(h) for PSM facilities require written contractor safety procedures. For facilities with highly hazardous chemicals, a written program is a direct OSHA requirement. For everyone else, it is a strong practical and legal necessity.

Who is responsible for contractor safety on a multi-employer worksite?

OSHA's multi-employer worksite policy lets the agency cite any employer whose workers are exposed to a hazard, plus employers who created the hazard or had authority to correct it. As a host or controlling employer, you can be cited for contractor violations even if none of your own workers were exposed. OSHA defines the controlling employer as one with general supervisory authority over the worksite and the power to require safety corrections.

Do contractor injuries go on my OSHA 300 log?

It depends on supervision. Under 29 CFR 1904.31, you record injuries of workers your establishment supervises on a day-to-day basis, even if they are employed by a staffing agency or subcontractor. If you direct the daily work of a contractor's employee, their recordable injuries likely belong on your log. If the contractor's own supervisor controls day-to-day work, the contractor records it. Temp worker injuries are commonly the host employer's recordkeeping responsibility.

What is an Experience Modification Rate (EMR) and how should I use it for contractor prequalification?

An EMR is a workers' compensation insurance metric comparing a contractor's actual injury costs to the expected costs for their industry. A score of 1.0 is average. Scores above 1.0 mean higher-than-average injury costs; below 1.0 means fewer. Many employers set prequalification thresholds between 0.85 and 1.25 depending on the hazard level of the work. An EMR above 1.5 is a serious red flag. Ask contractors for their current EMR from their insurer.

What insurance should I require from contractors before allowing site access?

At minimum, require a current certificate of insurance showing general liability (typically at least $1 million per occurrence) and workers' compensation coverage at statutory limits. For higher-risk work, require higher limits and consider an umbrella policy. Ask to be listed as an additional insured on their general liability policy. Review the certificate annually and verify it has not lapsed. Your own insurance broker or business attorney can recommend limits for your industry and contract values.

How detailed does a contractor safety orientation need to be?

It depends on the hazard level. For a low-risk contractor (office pest control, copier repair), a brief walkthrough and a signed one-page site rules sheet is generally adequate. For contractors working near energized equipment, in confined spaces, or with hazardous materials, a fuller orientation covering emergency procedures, permit requirements, and site-specific chemical hazards is needed, along with verification of task-specific training. Document every orientation with a dated, signed record.

Can I hold contractors responsible for OSHA compliance on my site?

Yes, and you should, both in your written safety program and in your contract. Include a clause requiring contractors to comply with all applicable OSHA standards and your site safety rules. Include stop-work authority language. You can also add language requiring contractors to reimburse you for OSHA fines resulting from their violations, though enforceability varies by state. Contractual language does not eliminate your own OSHA exposure as a controlling employer; it supplements your program.

What records should I keep for contractor safety, and for how long?

Keep prequalification documentation (insurance certificates, OSHA 300 logs, EMR letters) for the duration of the contractor relationship plus at least three years. Keep signed orientation records for at least three years. Keep incident reports and near-miss records for at least five years, matching OSHA's retention period for injury logs under 29 CFR 1904.33. For any incident that results in litigation, retain all related records until the case is resolved, however long that takes.

Do temporary workers from a staffing agency count as contractors for this program?

Temporary workers sit in a shared-employer model. The staffing agency is the employer of record, but the host employer controls day-to-day work conditions. OSHA's guidance on temporary workers, published in 2014 and updated since, states that the host employer is responsible for site-specific safety training and day-to-day hazard protection. Your contractor safety program should include temp workers in its scope, particularly for orientation, PPE, and incident reporting requirements.

What is stop-work authority and should it be in my contractor safety program?

Stop-work authority is the explicitly stated right of any employee or supervisor to halt work when they observe an imminent safety hazard, without fear of retaliation or penalty. It belongs in your contractor safety program and in your contractor agreements. It should name who can exercise it (ideally anyone on site), describe how work resumes (after the hazard is corrected and documented), and confirm that stopping work does not give the contractor grounds to claim delay damages unless you wrongfully invoked it.

How often should I review and update my contractor safety program?

Review the program at least annually. Also review it after any serious contractor incident, after any OSHA inspection that touched on contractor safety, when OSHA updates a relevant standard, or when your operations change in a way that brings in new types of contractors or hazards. Update the revision date each time you review it, even if nothing changed. A program without a current review date looks neglected to an OSHA compliance officer.

Does a contractor safety program apply to one-time or very infrequent contractors?

Yes, with proportionate effort. You would not run a full prequalification review on a plumber who comes once every two years for a routine repair, but you should still give them a brief orientation and a site rules sheet, and they should sign it. The key question is whether they could encounter site-specific hazards that would not be obvious to an outside worker. If yes, document that you told them. The documentation requirement does not scale down to zero regardless of frequency.

Sources

1. OSHA, General Duty Clause overview (OSH Act Section 5(a)(1)): OSHA's General Duty Clause requires employers to provide a workplace free from recognized hazards, applicable to hazards involving contractor workers
2. OSHA, 29 CFR 1910.119(h) Process Safety Management standard, contractor requirements: PSM standard requires written procedures for contractor selection, hazard communication to contractors, documentation of contractor safety training, and periodic evaluation of contractor safety performance
3. Bureau of Labor Statistics, National Census of Fatal Occupational Injuries in 2023: BLS reported 5,283 fatal work injuries in 2023; contract workers are overrepresented in fatality counts relative to hours worked
4. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: Hazard communication requirements under 29 CFR 1910.1200(b)(1) apply to contractor employees who may be exposed to hazardous chemicals in the workplace
5. OSHA, 29 CFR 1904 Recordkeeping Rules including 1904.31 and 1904.39: 29 CFR 1904.31 requires recording injuries of employees supervised day-to-day by the establishment; 29 CFR 1904.39 requires reporting fatalities within 8 hours and hospitalizations within 24 hours
6. OSHA, Multi-Employer Citation Policy (CPL 02-00-124): OSHA's multi-employer citation policy defines four employer roles (creating, exposing, correcting, controlling) and permits citation of any employer whose employees are exposed to a hazard or who had authority to correct it
7. OSHA, 29 CFR 1926.16 Rules of construction, prime contractor and subcontractor responsibilities: 29 CFR 1926.16 assigns prime contractor responsibility for ensuring subcontractors comply with applicable OSHA standards on construction worksites
8. OSHA, 29 CFR 1910.146 Permit-Required Confined Spaces standard: 29 CFR 1910.146(c)(8)(iii) requires host employers to inform contractors of confined space hazards and the precautions and procedures to be followed before contractor entry
9. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): 29 CFR 1910.147(f)(2) requires host and outside employers to coordinate energy control procedures when contractor employees perform lockout/tagout on host equipment
10. OSHA, Temporary Worker Initiative guidance page: OSHA guidance states host employers are responsible for site-specific safety training and day-to-day hazard protection for temporary workers placed by staffing agencies
11. OSHA, 29 CFR 1904.33 Recordkeeping retention requirements: OSHA requires employers to retain injury and illness records (OSHA 300, 300A, 301 forms) for five years following the end of the calendar year that the records cover