Contractor safety management: the gap between what UK businesses think they have done and what HSE expects

Under Section 20 of the Health and Safety at Work Act 1974, an HSE inspector can enter any workplace without advance notice and speak with any employee or contractor without a manager present. They can also require the immediate production of records. There is no requirement to announce the visit in advance, nor is there a window between notification and arrival in which to compose a response. Most businesses navigate the opening part of an unannounced visit with reasonable composure. The filing is accessible, a senior person materialises, and the documentation is in some form of order. The difficulty tends to arrive roughly twenty minutes in, when the questions stop being about documents and start being about what those documents can actually demonstrate.

What happened the last time a contractor was on site? Who was responsible for overseeing the work, and what records exist of that oversight? Can the review of the method statement be demonstrated rather than asserted? Were toolbox talks conducted and signed off? These are predictable questions, and for a significant number of UK businesses, they produce an uncomfortable silence, not because the business failed to complete the administrative steps, but because those steps and the operational control they were supposed to represent are two different things.

This gap, between having a contractor safety management system and having one that holds up under scrutiny, is where HSE enforcement typically begins.

How an unannounced HSE inspection actually unfolds

The scope of what an inspector can do under Section 20 powers goes considerably beyond reviewing a filing cabinet. They can photograph, sample, observe work in progress, and interview employees and contractors independently, without a supervisor standing nearby. If they identify a material breach during the visit, they can issue an improvement notice or a prohibition notice before leaving. And under the Fee for Intervention scheme, the time HSE spends resolving any material breach is charged to the dutyholder at £183 per hour.

That last point is worth pausing on, because it reframes how businesses should think about the risk of an unannounced inspection. The Intervention fee is not triggered solely by incidents. It is triggered by the identification of any material breach, which the HSE defines as a contravention significant enough to require written notification to the dutyholder. A business that holds RAMS but cannot show where they were reviewed and applied, or cannot produce evidence of active contractor oversight, may be facing FFI liability without any accident having occurred at all. The inspection becomes the triggering event.

So the question that matters during any unannounced visit is not whether the administration was completed. It is whether the records tell the story of a business that exercised genuine operational control over the contractors working on its behalf.

Having RAMS on file is not the same as managing the risk

Before any contractor starts work, a business must obtain a Risk Assessment and Method Statement. The legal basis for this requirement is the Management of Health and Safety at Work Regulations 1999, and its purpose is clear enough: the RAMS should document the identified hazards, the sequence of work, the protective measures in place, and the competencies required to carry out the job safely. Collecting this document before commencement is the step most businesses complete reliably. It is also, in isolation, the least informative thing an inspector can find.

Regulation 3 of the MHSWR 1999 requires more than collection. It imposes a duty to implement appropriate arrangements for the planning, organisation, control, monitoring, and review of the preventive and protective measures arising from risk assessments. Which means reviewing a method statement and filing it is not where the legal obligation ends. It is closer to where it begins.

An HSE inspector understands this distinction precisely. A folder of method statements is evidence that the administrative step was completed. There is no evidence that the work was carried out in accordance with those statements, or that the hazards identified in the risk assessment were controlled on the day. The document proves that the document exists.

This is the structural weakness in how many UK businesses approach contractor safety management. Effort concentrates on the front end: collecting the paperwork before the job starts. Once the contractor is on site and working, active oversight tends to diminish. When the job concludes without incident, this is treated as confirmation that the system worked. But a job completed without incident is not the same as a job where the controls were operating effectively throughout, and that distinction carries considerable weight when an inspector is standing in front of you with twenty minutes already spent on your documentation.

What HSE is actually asking when it reviews your contractor records

HSG159, the Health and Safety Executive's guidance on managing contractors, describes contractor management as a five-stage process. Selecting the right contractor and planning the work receive the most attention in practice. Active oversight once the contractor is on site, and the formal review of performance at completion, are where the evidence trail typically runs thin.

The monitoring stage is where the gap between paper compliance and operational control becomes most visible. HSG159 makes it clear that oversight of contractor activity during the work is a substantive duty, not a mere formality. Someone with appropriate competence needs to check, during the job, whether the work is proceeding in accordance with the method statement and whether the protective measures described in the risk assessment are actually functioning on site. Any deviation from the agreed approach needs to be identified and formally reviewed, rather than resolved through an undocumented conversation and then absorbed as an assumption that things are on track.

Most contractor safety systems in UK SMEs produce no record of this stage whatsoever. They have a pre-commencement checklist and a completion sign-off. The period in between, when the actual work happens, is left blank in the documentation. That blank is what HSE inspections and investigations routinely surface. The business completed its preparation and has documentation of completion. What it cannot produce is any evidence of what was happening during the work itself, which is precisely the period when the protective measures were either functioning or not.

The active monitoring gap businesses miss

The MHSWR 1999 framework distinguishes between active monitoring and reactive monitoring. Reactive monitoring is what most businesses do reasonably well: investigating incidents when they occur, documenting near-misses when they are raised, and responding to concerns when they are raised. Active monitoring is the structured check that happens while the work is in progress, to verify that controls are functioning as intended before anything goes wrong.

For contractors specifically, active monitoring means periodic site presence during the work itself. It means a competent person checking whether the actual on-site practice matches the method statement and recording their findings. For longer jobs, it means a structured midpoint review, rather than an assumption that the conditions established at the start still hold three weeks into a six-week programme. And it means a documented process for raising concerns when practice diverges from what was agreed, so that any deviation creates a written record rather than disappearing into an exchange no one noted down.

What most businesses discover when they examine their contractor management records honestly is that active monitoring records are either sparse or entirely absent. The pre-commencement documentation is complete. The post-completion sign-off exists. Between those two points, there is often nothing.

That absence matters on two counts. The business cannot demonstrate to an inspector that controls were operating during the work, only that the paperwork intended to support those controls was produced beforehand. And, more fundamentally, the absence of active monitoring is itself evidence of a gap in the management system rather than merely a gap in the records. If no one is checking during the work, there is no mechanism to identify divergences that pose risk before they cause harm.

The competent person requirement: what the law actually expects

The term "competent person" appears throughout UK health and safety legislation and is routinely applied more loosely in practice than the law intends. Under Regulation 7 of the MHSWR 1999, employers must appoint one or more competent persons to assist in implementing health and safety measures. In the context of contractor management, HSG159 makes clear that someone must be designated to coordinate and oversee contractor activities, and that person must have sufficient knowledge, experience, and authority to do the job effectively.

Competence here is not a job title. It is a question of whether the designated person has the technical knowledge to identify shortcomings in a method statement before work starts, and the on-the-ground experience to recognise when actual practice is diverging from what was agreed. The authority to stop work when that happens is a further element, and one that is often absent even where knowledge and experience are present.

For many SMEs without full-time health and safety capability, the person nominally responsible for contractor oversight may not meet that threshold, not because of any failure of intent, but because overseeing contractor safety is a technical function requiring specific knowledge of the relevant hazards and the legal framework governing them. An operations coordinator or facilities manager whose background is primarily administrative may be a capable and conscientious professional without the competence, in the legal sense, required for contractor oversight. An honest assessment of whether the designated person genuinely meets that standard is part of a well-designed contractor safety management system.

You can read more on the responsibilities UK employers carry when using contractors, including the baseline legal duties that apply before the competence question even arises.

Where the paper system breaks down under scrutiny

There is a recognisable pattern in HSE enforcement cases involving contractor management. The businesses under investigation are often not those that took no precautions. They collected documentation, had procedures in place, and the people responsible genuinely believed the system was functioning. The investigation reveals that the system was designed to produce administrative records rather than generate evidence of control, and when HSE asked for the latter, there was nothing to show.

The distinction can be tested directly. After any given contractor job, can the business demonstrate that the RAMS were genuinely reviewed rather than merely received? Is there a record of what oversight occurred during the work itself, and by whom? And if concerns were raised or the work deviated from the agreed approach, is there documentation of how those were addressed and what decision was made? These are the questions HSE asks when reconstructing the history of contractor management, whether in an inspection context or following an incident.

If the honest answer to most of those questions is no, or that this is not how the business currently operates, the system is functioning as a pre-commencement checklist rather than a control mechanism. The work that follows is uncontrolled from a documented oversight perspective. And that gap becomes legally significant the moment HSE arrives, regardless of whether anything went wrong on site.

Building contractor management that holds up under scrutiny

A system that performs under inspection does not require substantially more paperwork. It requires paperwork that records decisions rather than paperwork that records process completion.

In practice, this means RAMS reviews should produce a documented outcome, whether accepted, accepted with specific conditions, or returned for amendment before work proceeds. Inductions should record not just attendance but what was covered and who conducted them. Permits to work should include a monitoring element that documents whether the permit conditions were observed during the job, not only at the point of issue. And any substantive contractor engagement should produce at least one record of active oversight during the work, whether that is a brief site observation note or a documented check against the agreed method.

None of this is disproportionately burdensome if designed proportionately to the risk and complexity of the work involved. A brief note from a site visit, logged against the job reference and signed by the person who made it, shifts the documented position considerably compared to no active monitoring record at all. Small habitual records of real decisions create the evidence base that a folder of pre-commencement documents cannot.

For businesses that regularly use contractors but lack internal health and safety capability at the level required to oversee this function effectively, the practical route is external competent person support, whether retained or on a project basis. The legal obligation is not to employ a full-time internal specialist. It is to ensure the function is carried out by someone competent to perform it. If you want to understand what workable contractor oversight looks like in practice for an SME, contractor safety support for UK businesses sets out how Progressa approaches this across different sectors and scales of contractor engagement.

The question worth contemplating before the next contractor starts work

If an HSE inspector walked in tomorrow, the relevant question is not whether the documentation folder is in good order. It is whether the records inside it would tell the story of a business that was actively managing its contractors, or a business that completed the required steps before work started and then relied on nothing going wrong.

For businesses that use contractors with any regularity, the honest answer lies somewhere between those two positions. The real question is where exactly, and what the exposure looks like in the distance between them.

FAQ

What can an HSE inspector do during an unannounced visit?

Under Section 20 of the Health and Safety at Work Act 1974, an HSE inspector can enter any workplace without advance notice, speak with any employee or contractor independently, observe work in progress, and require the immediate production of records. If they identify a material breach, they can issue an improvement or prohibition notice and charge for their time under the Fee for Intervention scheme at the current rate of 183 pounds per hour.

What does contractor safety management actually involve for UK employers?

UK employers must do more than collect RAMS before a contractor starts work. The Management of Health and Safety at Work Regulations 1999 require employers to implement appropriate arrangements to plan, control, monitor, and review the protective measures arising from risk assessments. In practice, this means overseeing contractor activity during the job itself, not only at the start and at completion.

Who qualifies as a competent person for overseeing contractor work in the UK?

Under Regulation 7 of the Management of Health and Safety at Work Regulations 1999 and HSE guidance document HSG159, the person designated to oversee contractor activities must have sufficient technical knowledge, practical experience, and authority to critically review method statements, identify on-site shortcomings, and stop work when necessary. A job title or a management role does not, on its own, satisfy this requirement.