Contractor Management Plan & Procedure: What to Include (With a Template)

Search for a contractor management plan and some of what comes back is not about safety at all: contract and construction management plans are documents about delivering a project to price and schedule. This guide is about the other kind, the document a business writes to control the safety and legal side of the people who work on its sites.

It is written for WHS managers and the facilities, operations and procurement colleagues who share the job, in businesses with a property portfolio, a depot or a warehouse. It explains what a plan and a procedure are, what the law does and does not require you to write down, and then gives you a template you can copy: the headings, and what goes under each. Download the Word template (.docx) to start from a file instead of a web page.

What Is the Difference Between a Contractor Management Plan & a Procedure?

They are different documents with different jobs, and the confusion between them is why many businesses end up with one document that does neither well. A policy is the short statement of commitment: we manage contractors, this is who is accountable. A procedure is the standing set of rules for the whole business: who does what, when, tier by tier, and what evidence is kept. A plan is the procedure applied to one engagement: this contractor, on this site, doing this work, with these controls.

Some businesses call the procedure a framework or a program, and some write a single "contractor management plan" that is really a procedure. The name matters less than whether the document does its job. The test is whether a person who has never seen it can use it: a procedure tells the site contact what to check before a contractor comes in, and a plan tells the contractor's supervisor what is expected on this job.

In our view most businesses need the procedure first, and a plan for the engagements where the risk or the length justifies one. The University of Southern Queensland's public Contractor Management Procedure, effective 30 March 2026, works that way. It is one procedure for the whole university, with five contractor categories, and a safety management plan is named as a required control for the highest category, principal contractors on construction projects.¹

Does the Law Require a Written Procedure or a Plan?

We found no provision in the model WHS laws that requires a document called a contractor management procedure. What the law requires is the outcome, so far as is reasonably practicable: the primary duty of care to workers the business engages or causes to be engaged, and to workers whose work it influences or directs (section 19(1)), consultation, co-operation and co-ordination with every other duty holder on the same matter (section 46), and, for a business that manages or controls the workplace, as the owner of a building or the operator of a depot often will, keeping the workplace, the ways in and out of it and anything arising from it without risks to anyone (section 20(2)).² The duties themselves are set out in PCBU responsibilities for property owners and FM companies.

A written procedure that is actually followed is one of the clearest ways to show you did that, and it serves the people above you. An officer must exercise due diligence to ensure the business complies, and that includes taking reasonable steps to ensure the business has available for use, and uses, appropriate resources and processes to eliminate or minimise risks, and to verify that it does (section 27(1) and (5)(c) and (f)).² A process that is written down is far easier for an officer to verify, though the Act does not say it must be written.

A few documents are written into the Regulations for particular work: a safe work method statement before high risk construction work starts (regulation 299), and a written WHS management plan from the principal contractor on a construction project before work starts (regulation 309(1)).³ When a building owner becomes the principal contractor, and the asbestos register and management plan, are covered in PCBU responsibilities for property owners and FM companies. Those are the model Regulations' numbers, so check your own state's before you cite one.

What a Good Contractor Management Procedure Covers.

Large public procedures converge on one shape: before work, during work and after it, with records and review at the end. The University of Southern Queensland's follows pre-engagement (selection and prequalification), prior to work (engagement and onboarding), during work (management and monitoring), review and assurance, and record keeping.¹ That is the structure of the template below, with the parts that individual businesses most often leave out written in.

Before work, the procedure has to say how a contractor is tiered, what each tier must provide, and who decides. Comcare's guidance for Commonwealth PCBUs describes the reasoning: where a PCBU relies on a specialist, it is required to verify that the specialist has the expertise for the work, has its own systems for working safely, and is in fact working safely in line with its stated procedures.⁴ Those are three questions a prequalification section can answer in writing, and the tier decides how hard the business presses on each.

During work, the procedure has to separate the company from its people. Approving the company does not clear the person at the gate. The procedure needs a worker verification section, a site access section and a permits section, and they need to be connected, so that a lapsed licence found at the gate has somewhere to go.

After work, it needs the part most procedures skip: close-out. Comcare's guidance does not address ending an engagement at all, so there is no regulator checklist to copy. The University of Southern Queensland's procedure spells it out, requiring the area to be made safe, a formal handover, and the contractor's site access, including passes and access cards, to be removed.¹

The Procedure Template: Headings & What Goes Under Each.

Copy the headings, replace the square brackets, and delete what does not apply. Each row is a heading in the document; the second column is what goes under it. Keep the finished procedure short enough that a site contact will read it: if a section runs past a page, it is probably two sections. The same headings are in the Word template, ready to fill in.

Heading	What goes under it
1. Document control	Title, owner (a role, not a name), approver (an officer or senior manager), version, effective date, next review date, and the state or territory law the document is written under.
2. Purpose & scope	One paragraph on why the business manages contractors, then who and where it applies: sites, contractors, subcontractors, sole traders and labour hire, and any exclusions with the reason. Example: This procedure applies to every person or business that carries out work at [Company] sites under a contract, including subcontractors, couriers and deliveries. Deliveries that stay at the loading dock are tier 1: sign-in and a short briefing on site rules.
3. Definitions & legal basis	PCBU, worker, contractor, subcontractor, site contact and tier, in the words your state's Act uses, and the Act and Regulation by name. One line on each duty you rely on. Do not paste the Act in.
4. Roles & responsibilities	For each role, what it decides and what it keeps: the engager, the approver, the site contact, the safety manager, procurement, the officer who reviews performance, and the contractor's own responsibilities.
5. Contractor tiers	The tier definitions, how a tier is assigned, and who may change one (the table in the next section).
6. Before engagement	Define the scope of work, assign the tier, then list the evidence each tier must give: insurances, licences, safety management system, safety record. State who decides and what the decision record holds.
7. Onboarding	What each contractor receives and agrees to before its first visit: site rules, hazard information (such as the asbestos register for older buildings), emergency arrangements, induction, the named contact, and the contract clauses on incident reporting and on telling you when they are on site.
8. Worker verification	Per-person evidence: identity, licences with written evidence for high risk work, training, induction dates and expiry dates. Say how subcontractors are disclosed and what happens when the company sends someone new.
9. Site access	Sign-in and sign-out, who may admit a contractor, escorts, after-hours access, what happens when a record has lapsed, and how keys, cards and codes are issued and returned.
10. Permits & high-risk work	Which jobs need a permit, who approves, which method statements are reviewed before work starts, and how a permit is closed out.
11. Supervision & consultation	The supervision level for each tier, the pre-start meeting, and how you consult, co-operate and co-ordinate with the contractor and any other duty holder on the site.
12. Incidents & emergencies	The contractor tells the site contact immediately. Name who notifies the regulator and how fast, under your state's Act, who preserves the site, and how the incident reaches the contractor's own record as well as the site's.
13. Monitoring & review of contractors	Inspections and audits, what a non-conformance triggers (including stopping work), and the performance review at the end of the job or each year.
14. Close-out	Area made safe, handover, permits closed, every worker's access removed, open actions closed, and the date and reason the engagement ended.
15. Records	What is kept for each contractor, where, for how long under your state's rules, and who can produce it.
16. Review of this procedure	The interval, and the triggers that bring a review forward: a serious incident, a change in the law, a change in the work.

On rows 12 and 15, the rules differ by state. Under the model Act, a PCBU must ensure notice of a notifiable incident is given to the regulator immediately after becoming aware of it, and must keep a record of it for at least 5 years from the day notice is given (section 38(1) and (7)).² Write your own state's rule, not the model Act's, because the notification categories and the timing differ between jurisdictions.

How to Tier Contractors: A Table You Can Copy.

Row 5 of the template is the one that does the most work, because every later row says "for each tier". The table below is an example set from property and facilities management and from transport and logistics. It is not law. It adapts the five-category structure of the University of Southern Queensland's risk matrix, with examples from these two industries, and you should write yours from the risks of your own work.

Tier	Typical work	Minimum before work	Supervision
1. Low	A courier or delivery that stays at the dock; a consultant in an office	Identity, sign-in, a short briefing on site rules	Sign-in only
2. Medium	Cleaning, landscaping, pest control, an IT technician	Insurance certificates read, a summary of the company's safety system, each worker inducted	Periodic spot checks
3. High	Electrical work, lift or escalator repair, racking or dock leveller repair, work on a plant roof	Tier 2, plus the method statement reviewed before start, written evidence of each worker's licence where one is required, and a permit	Close: a named supervisor and a pre-start meeting each visit
4. Specialist	Asbestos removal, hazardous substances	A licensed removalist for asbestos removal, which the model Regulations require; work under the exception for 10 square metres or less of non-friable asbestos must still be done by a competent, trained person	Managed by a named owner for the specialty
5. Principal contractor	A construction project of AU$250,000 or more under the model Regulations (AU$350,000 in Victoria)8	A written WHS management plan from the principal contractor before work starts (in Victoria, a health and safety co-ordination plan, regulation 335)	Run by the principal contractor, with your coordination

The asbestos requirement in tier 4 is law: a business that commissions asbestos removal must ensure it is carried out by a licensed removalist licensed for the work (regulation 458(1)). A licence is not needed for 10 square metres or less of non-friable asbestos, but that work must still be done by a competent person trained under regulation 445 (regulation 458(2) and (3)).³ Tier 3 can also trigger a second legal check: a business at the workplace must not direct or allow a worker to carry out high risk work that needs a high risk work licence, such as forklift work, operating certain cranes and hoists, scaffolding or rigging, unless it sees written evidence, provided by the worker, that the worker holds the licence for that work, and it must keep a record of that evidence for at least 1 year after the work is carried out (regulation 85(1) and (4)(a)). What contractor management is gives the wording.³ Electrical and other trade licences come from separate state laws. The rest of the table is practice, and that is fine. Practice is what you are allowed to adjust to your own risk.

The Plan Template for One Engagement: Headings & What Goes Under Each.

A plan is the shortest document in the set. For a tier 2 contractor, one page is plenty; for a tier 3 job that runs for months, expect three or four. The same rule applies as for the procedure: the headings are fixed, and the content under them is specific to the job. The plan headings are in the Word template too.

Heading	What goes under it
1. Engagement summary	Contractor, ABN, site or sites, start and end dates, tier, a one-paragraph scope, and every subcontractor named.
2. People & contacts	The contractor's supervisor, your site contact, the safety contact, and the after-hours and emergency numbers.
3. Before the first visit	The evidence required for the tier, the method statements to be reviewed, the licences and inductions needed, who confirms each item, and by when.
4. Site hazards & controls	What is specific to this site: the asbestos register where it applies, live plant and energy sources, traffic and pedestrians, other contractors and tenants working nearby, the controls agreed and who is responsible for each.
5. Access & hours	Entry points, working hours, escort rules, key and code arrangements, parking and storage.
6. Permits	Which permits this job will need and who approves each.
7. Supervision & communication	The supervision level, pre-start meetings, how a change in scope is approved, and how you consult and co-ordinate with the other duty holders on the site.
8. Incidents & emergencies	Who to call, first aid, evacuation, how an incident is reported and who notifies the regulator.
9. Checks during the work	Who inspects, how often, what they look for, and what triggers stopping work.
10. Completion	Handover, permits closed, access removed, the review meeting and the performance record.

Two Plans, Filled In.

The examples below are illustrative, not real customers. They show how much the content under the same headings changes with the work.

Dock leveller repair at a distribution centre. A transport and logistics business has a dock leveller that will not lower, and a repair crew is coming for two days. It is tier 3, because the work is beside live forklift movements and needs the leveller isolated. Under "site hazards", the plan records the traffic management for the bay, the isolation of the leveller's power, and the other dock doors that stay in use. Under "permits", it records an isolation permit approved by the shift manager, to be closed at the end of each day. Under "supervision", it names the warehouse supervisor and sets a pre-start meeting each morning. Under "completion", it requires a test of the leveller before the permit is closed and the crew's access is removed.

Grounds maintenance across a mixed-use precinct. A property manager engages a landscaping company to maintain the grounds of a precinct with offices, shops and apartments. It is tier 2: mowers, hedge cutters and chemicals, in a place the public uses. Under "people", the plan names the landscaping supervisor and the precinct manager. Under "site hazards", it records the paths shared with pedestrians, the irrigation and electrical pits, the hours when tenants are most present, and where chemicals are stored. Under "checks", the precinct manager inspects monthly and keeps a note against the contractor's record. The plan is one page, and the file behind it matters more than the page: a current list of who has worked on the precinct, with each person's induction date.

Mistakes That Make a Procedure Useless.

Five mistakes recur. The first is writing for the auditor instead of the person at the gate: a procedure that cannot be followed by a security officer at 6am is a procedure that will not be followed. The second is one tier for everybody, which either overwhelms the low-risk visitor or under-checks the electrician. The third is checking the company and never the worker, so the approval says nothing about who turns up.

The fourth is copying another organisation's procedure and keeping its law. The University of Southern Queensland's procedure cites the Work Health and Safety Act 2011 (Qld) and the Queensland Regulation.¹ A business in another state that borrows its wording carries the wrong Act with it, and a procedure that cites the wrong law is the first thing a regulator or an auditor reads. The fifth is stopping at approval: no close-out, so nothing removes a contractor's access when the work ends. Six common contractor management mistakes covers more of the same ground.

Where Does Software Fit in a Procedure?

A procedure is the rules, and software is how the rules run. Read down the template and you can see which rows a tool can carry and which it cannot. It can hold the evidence each tier needs (rows 6 to 8), connect sign-in to the current record (row 9), keep permits and incidents against the contractor (rows 10 and 12), and run the close-out (row 14). It cannot assign a tier, judge whether a safety system is adequate, consult the other duty holders, or supervise the work (rows 5, 6, 11 and 13), and it cannot sign the document off. Those need a person.

ComplyFlow runs the first group. Requirements for suppliers and workers are set once, as bundles of documents, trainings and forms, and the chasing and renewing follows.⁵ At the gate, a worker who is not cleared for the location is stopped unless the site has chosen to allow Sign in Anyway, which notifies the client; each site makes that choice.⁶ At close-out, deactivating a company marks all its workers inactive and ends the reminders.⁷ The contractor management software page shows the whole picture, and digital permits and site access cover rows 10 and 9.

What to Do This Week.

Take headings 1 to 5 of the procedure template and fill them in for one tier, the one you engage most often. Write each heading in your own words, using your state's Act. Then put one real contractor through it: can you show the evidence, name each worker with their expiry dates, and say what happens at the gate if a licence has lapsed? Wherever the answer is "it depends who is on shift", you have found the next section to write. If you want the stages written as a walk-through before you write the document, what contractor management is and the contractor management process, stage by stage cover them, and if you would like to see the procedure running, book a demo and bring one contractor's file.