Procurement and Supplier Safety Controls Under ISO 45001

ISO 45001 Clause 8.1.4

If you bring a contractor on site, you bring their hazards too. This clause is about controlling that.

ISO 45001 Clause 8.1.4 - Procurement, Contractors and Outsourcing

ISO 45001 Clause 8.1.4 covers control of procurement, contractors and outsourced functions so they all stay aligned with the OH&S management system. It has three parts: 8.1.4.1 General procurement, 8.1.4.2 Contractors, and 8.1.4.3 Outsourcing.

The clause recognises that work brought into the organisation - whether it is a chemical product, a piece of equipment, a maintenance contractor, or an outsourced cleaning service - introduces hazards that the organisation must manage even though it does not directly employ everyone involved. UK organisations also have specific contractor and procurement duties under HASAWA Section 3 and CDM 2015 for construction work.

What Clause 8.1.4 Asks For

8.1.4.1 General procurement - establish, implement and maintain a process to control the procurement of products and services so they conform to the OH&S management system. This applies to anything you buy in that could affect health and safety, from machinery to chemicals to professional services.

8.1.4.2 Contractors - coordinate procurement processes with contractors to identify hazards and assess and control the risks arising from contractors' activities affecting the organisation, the organisation's activities affecting the contractor's workers, and contractors' activities affecting interested parties in the workplace. The standard requires that contractors and their workers meet the OH&S management system requirements, and that occupational health and safety criteria are defined and applied for contractor selection.

8.1.4.3 Outsourcing - control outsourced functions and processes so they are consistent with legal and other requirements and with achieving intended outcomes of the OH&S management system. Outsourcing does not transfer accountability - the organisation remains responsible.

Practical Compliance Guidance

The following alphaZ documents support compliance with ISO 45001:2018 Clause 8.1.4. The IMS1 Manual itself is included within the toolkit listed below.

alphaZ document	How to use it
ISO 45001 Toolkit	Complete document set for an ISO 45001 management system, including the contractor appraisal form and supplier appraisal procedure listed below.
F-HS16 Contractor OH&S Appraisal Form	Used to assess a contractor's health and safety competence before engagement. Captures their policy, risk assessments, training records, accident history, insurance and method statement approach.
PP-1-09 Supplier Appraisal Policy Procedure	The procedure for appraising suppliers and contractors - selection criteria, ongoing review, and what triggers re-appraisal. Apply alongside the contractor appraisal form.
F-Q9 Supplier Contractor Appraisal	The wider supplier and contractor register that ties OH&S appraisals into the overall supplier evaluation process.

For more on these documents see the ISO 45001 Toolkit.

Contractor appraisal forms are gold for this clause. We use them before any new contractor sets foot on site - it tells us whether they have the policies, training and insurance to do the work safely. The completed forms feed into the supplier register, so we can see at a glance who is approved and when they were last reviewed.

A contractor register helps a lot here. One central list, every contractor in use, criteria they were selected against, and when they were last appraised. It also makes the management review section easier - you can see which contractors have caused problems and which have not.

I look for two things on 8.1.4. Are the OH&S criteria for contractor selection actually written down somewhere? And can you show me how those criteria were applied to a real contractor on a real job? If the answer is that you go on reputation, that is a finding. Outsourced functions get the same treatment - the cleaners, the security firm, the IT helpdesk all need OH&S oversight if their work affects the workplace.

Procurement of Equipment and Substances

Procurement is not just about contractors. New equipment, new substances and new services introduce new hazards - and Clause 8.1.4.1 expects the OH&S implications to be considered before purchase, not after delivery. UK regulations like PUWER, COSHH and the Supply of Machinery Regulations all reinforce this. Practical evidence includes pre-purchase checks for CE/UKCA marking on machinery, safety data sheets reviewed before chemicals are ordered, and OH&S criteria written into purchase specifications.

Outsourcing Does Not Transfer Accountability

Clause 8.1.4.3 makes clear that outsourcing does not move the OH&S accountability to the third party. If you outsource your facilities management, the cleaning crew that works for that provider is still working in your workplace, and the standard expects you to control how that work is done. The same applies to outsourced waste collection, contracted-out maintenance, agency staff, and any function where another organisation delivers work that affects health and safety in your workplace.

Frequently Asked Questions

Do we need to appraise every contractor?

The depth of appraisal should match the risk. A high-risk contractor doing structural work needs a full pre-qualification including method statements, insurance, training records and accident history. A low-risk contractor coming in to service a photocopier needs less, but should still be checked against your OH&S criteria.

What about agency staff and self-employed workers?

Agency workers integrated into the workforce are usually treated as workers under Clause 5.1, with the same induction and consultation as employees. Self-employed contractors are normally handled through the contractor route in 8.1.4.2 - appraised before engagement and managed through the supplier register.

Does Clause 8.1.4.2 require a written contractor procedure?

The clause requires the process to be coordinated and the criteria to be applied. Most organisations meet this through a written contractor management procedure plus a contractor appraisal form. The standard does not mandate a specific document, but auditors will expect to see consistent evidence of how contractors are selected, briefed and reviewed.

Are CDM 2015 duties separate from this clause?

CDM 2015 is UK construction-specific law and applies regardless of whether the organisation is certified to ISO 45001. For construction work, CDM duties on clients, principal designers, principal contractors and contractors run alongside the management system requirements. CDM provides a strong foundation for meeting 8.1.4.2 on construction projects.

UK Legislation

UK organisations have specific procurement and contractor duties under statute that sit alongside the standard.

Further Resources