The Contractor Management Process, Stage by Stage

Most descriptions of the contractor management process stop at the moment the contractor is approved. That is roughly the halfway point. The approval is the easy decision; what goes wrong in a building happens afterwards, when the approved company sends a person nobody checked, a licence lapses mid-contract, or a contractor who finished in March still has a working access card in June.

This guide takes the process in the order a contractor actually moves through it, and for each stage says what you check, who usually checks it, and the record it should leave behind. It is written for property and facilities management, where one contractor typically works across many buildings, and where the building owner, the managing agent, the tenants, and the contractor all hold duties at the same time. If you want the definition and the duty first, what contractor management is covers them.

What Is the Contractor Management Process?

The contractor management process is the sequence of checks and controls that takes a contractor from first contact to the end of the engagement. It has seven stages, each with an owner and a record, and each answers one question. The lines between the stages are hand-offs, and the hand-offs are where the process breaks.

1. 1PrequalifyMay this company work for us at all?
2. 2OnboardWhich buildings, and under what rules?
3. 3Verify each workerIs this person cleared, not just their employer?
4. 4Control site accessIs this person cleared for this site, today?
5. 5Permit and supervise the workWho approved the job, and was it closed out?
6. 6Report incidentsIs it on the contractor's record, as well as the building's?
7. 7Review and offboardShould they come back, and has their access gone?

The duty behind it is plain. In NSW, the Work Health and Safety Act 2011 (NSW) requires a business to ensure, so far as is reasonably practicable, the health and safety of the workers it engages or causes to be engaged, and of workers whose work it influences or directs,¹ and requires the person with management or control of a workplace to ensure, so far as is reasonably practicable, that the workplace, the ways in and out of it, and anything arising from it are without risks to anyone.¹ In a managed building that second duty usually sits with your organisation. Every state and territory except Victoria has implemented the same model laws, some with variations,² so the sections below read much the same outside NSW; Victoria runs its own Act.

To make it concrete, follow one contractor through all seven stages: a fire services company engaged to maintain the fire safety measures across a portfolio of commercial office buildings in Sydney. It is an ordinary engagement, and it touches every stage.

Stage 1: Prequalify the Company Before It Is Engaged.

Start by classifying the work, not the company. A fire services contractor, a high-voltage electrician, a rope access crew for the facade and a courier dropping off parts do not need the same checks, and a single questionnaire for all of them either buries the low-risk visitor in paperwork or waves the high-risk trade through. A common approach is three or four tiers by type of work, and set the requirements for each tier once.

Then prequalify against the tier. Prequalification answers one question: may this company work for us at all? It is a company-level check, done once before engagement and then kept current. The usual evidence is public liability and workers compensation insurance, the company's safety management system, its licences, its incident history, and often its answers on modern slavery.

The mistake is treating prequalification as a questionnaire to be filed. A prequalification is a set of requirements, and each requirement has an expiry date. An insurance certificate that was current on the day of approval tells you nothing about the day the technician turns up 11 months later. The case for keeping this as a live record rather than a template is made in why use software instead of manual prequalification templates, and prequalification is where most portfolios start.

For the fire services company, prequalification is where you confirm the insurances and the safety system, and where you record the scope of work it is approved for. That scope matters later. A company approved for fire services maintenance has not been approved for the roof works it offers to quote on while it is on site.

The record this stage leaves: the decision, who made it, the date, the evidence it rested on, and the scope.

Stage 2: Onboard the Contractor to Your Sites and Your Rules.

Onboarding is not the same as approval. It ties an approved company to the specific buildings it will work in, and to each building's rules: the site requirements, the induction, the emergency procedures, the after-hours access arrangements, the plant room keys, and the person on site who is its contact.

In a portfolio, onboarding is where the variation lives. The requirements for a basement plant room in a heritage building are not the requirements for a new A-grade tower, and a building with a childcare tenant may need checks the others do not. The workable approach is one set of requirements per work tier across the portfolio and a short list of site additions, not a separate process per building.

Onboarding is also where the contractor is given what the building knows. In NSW the person with management or control of a workplace must ensure an asbestos register is prepared, kept at the workplace and kept up to date, must make it readily accessible to a business that carries out or intends to carry out work there, and must give a copy to a business whose work involves a risk of exposure to airborne asbestos.³ The duty does not apply to a building constructed after 31 December 2003 where no asbestos has been identified and none is likely to be present.³ Most older office stock is covered, and a fire technician running cable through a riser is exactly the person the register is for.

For the fire services company, this is the point to confirm which buildings it covers, who its site contact is at each, where each building's asbestos register is, and how its technicians will get into the plant rooms at 6am before the tenants arrive.

The record this stage leaves: which sites the company is onboarded to, the requirements set for each, what it was given, and the named contact.

Stage 3: Verify Each Worker, Because Approving the Company Does Not.

This is the stage most processes skip. The company was approved; the person standing at the fire panel was not. Companies send whoever is available, staff turn over, and subcontractors appear without anyone deciding they should.

The Act is specific about this. Where the regulations require work to be done by, or on behalf of, an authorised person, a business must not direct or allow a worker to carry it out unless the person doing it, or the business it is done for, holds that authorisation.¹ Some authorisations sit with the business. Many sit with the individual: a high risk work licence, for example, is valid for 5 years, and nobody may do high risk work while their licence is expired.⁵ So both records need checking, and the individual's is the one that changes most often.

The fire services example makes the point sharply. In NSW the building owner must ensure an annual fire safety statement is issued each year, with a copy to the council and to Fire and Rescue NSW, and in doing so declares that an accredited practitioner (fire safety) has assessed each fire safety measure in the building.⁴ The planning department's own guidance says the owner is not expected to have that technical expertise: "That is the role of the accredited fire safety practitioner."⁴ So the owner is relying on one named individual's accreditation, who may not be the technician doing the routine servicing. If the person who did the assessment is not the accredited person, the declaration is only as good as nobody asking.

Worker verification means each person has their own record: identity, licences and tickets with their expiry dates, inductions, and the sites they are cleared for. That is the job of workforce compliance, and it is a different record from the company's.

The record this stage leaves: per worker, every credential with its expiry date, and which sites that person is cleared for.

Stage 4: Control Who Gets Through the Gate.

Site access is where every earlier stage is either enforced or ignored. The approvals, the onboarding and the worker checks are all paperwork until the moment a person asks to come in, and the gate is the only point in the process that meets every contractor in person.

In an office building the gate is rarely a gate. It is a loading dock, a security desk, a plant room door on a keypad, or a technician let in by the building manager because they recognised the van. Each of those is an access decision, and most of them are made by someone who cannot see the contractor's record.

For the fire services company, the test is the 6am visit. A technician the company hired last week arrives at a building nobody on your team is in yet, with a plant room code the company has shared with all its staff. A useful test for any portfolio: if that worker's licence expired yesterday, what happens when they arrive today? If the answer is that someone would have to notice, the access stage is not connected to the verification stage. Site access earns its place when the answer is that the sign-in itself knows.

The record this stage leaves: who signed in, where, when, and whether they were cleared for that site at that moment.

Stage 5: Permit and Do the Work.

Some work needs more than access. Hot work that needs the detectors in its zone isolated, isolating a fire system for maintenance, working at height on a plant deck, entering a confined space: these need a permit that names the work, the controls, the person responsible and the time it expires, and someone who approves it before it starts.

For the fire services company, the permit that matters most is often the isolation. While a system is isolated for maintenance, the building is running without part of its protection, so the permit has to record who isolated it, when, what alternative arrangements were in place, and who confirmed it was restored. The work that follows can be recorded against the same assets, which is how inspection records across a portfolio stay comparable, covered in how inspections work across a property portfolio.

Most permit failures are not at the start, when everyone is paying attention. They are at the close-out, when a permit is left open because the technician left without signing off, and nobody can say whether the system was restored. Digital permits make the open ones visible.

The record this stage leaves: every permit, its approvals, the people who worked under it, and its close-out.

Stage 6: Report Incidents Against the Contractor's Record.

When something goes wrong, the incident belongs on two records: the building's and the contractor's. Filed only against the building, a contractor's third near miss across three different sites looks like three unrelated events.

In NSW, the business whose work a notifiable incident arises from must ensure SafeWork NSW is notified immediately after becoming aware of it, and must keep a record of it for at least 5 years from the day notice is given.¹ The person with management or control of the workplace must ensure, so far as is reasonably practicable, that the site is not disturbed until an inspector arrives or directs otherwise.¹ Safe Work Australia's December 2025 model Bill goes further with a new section 39A: those two duty holders must notify each other immediately, so far as is reasonably practicable.⁶ NSW's Act, read on 1 October 2026, does not carry it yet, but the direction is clear. The contractor and the building manager are expected to tell each other straight away, not find out from each other's reports.

For the fire services company, picture a technician who opens the wrong drain valve during a sprinkler test and floods a tenancy's corridor. Nobody is hurt, but it is exactly the kind of incident you want on the contractor's record and on the building's, with the action that follows. That means agreeing in advance how a contractor reports an incident on your sites, and making sure the report reaches you rather than staying in the contractor's own system. What makes a report hold up afterwards is covered in how to write an incident report that holds up, and incident management is where it lives.

The record this stage leaves: the incident, the actions raised, who owns each one, and whether they closed.

Stage 7: Review the Contractor, Then Offboard It Properly.

The last stage is the one with the least written about it. The regulator guidance we read on managing contractors, from SafeWork NSW and Comcare, covers engagement, induction and monitoring but says nothing about ending an engagement.⁷⁸ So what follows is practice, not law.

Review comes first. Before a contract is renewed or allowed to lapse, look at what the record says: incidents, open actions, permits that were never closed, documents that kept expiring, and sites where workers were turned away. That review is the only evidence-based answer to whether the contractor should be engaged again.

Offboarding is then three separate jobs. Stop the company being engaged for new work. Remove access for every one of its workers, not just the ones you remember, including the building's own cards, keys and codes, which live in the building's access system. And close out what is still open: permits, actions and any documents you are still chasing.

Say the fire services contract goes to a competitor at renewal. The outgoing technicians still know the plant room codes and one still holds a key. An isolation permit from the last month was never signed off. And next year's annual fire safety statement will rest on the new contractor's accredited practitioner, whose record does not exist yet. Each of those is an offboarding job, and each is invisible if the contractor simply stops turning up.

In ComplyFlow, deactivating a company sets every worker in its account to inactive and stops the document reminders and requests, and the company is hidden from the contractor list.⁹ A site that closes can be given an end date, which marks it inactive while keeping its records.¹⁰

The record this stage leaves: the review, the date and reason the engagement ended, and proof that access was removed.

Who Is Responsible at Each Stage?

Everyone, at once, which is the part that confuses people. More than one person can hold the same duty at the same time, each must comply with it, and each discharges it to the extent of their capacity to influence and control the matter, or the capacity they would have had but for an agreement that limits it.¹ A duty cannot be transferred to another person,¹ and a contract term that tries to transfer one is void.¹ In NSW a business also cannot, without reasonable excuse, insure or be indemnified against a WHS fine.¹ So a contract that says the fire contractor is responsible for fire safety does not move the duty, and an indemnity clause does not move the penalty. Each duty holder must, so far as is reasonably practicable, consult, co-operate and co-ordinate with the others.¹

Safe Work Australia's code of practice on consultation uses an example that could have been written for a facilities team: a multi-tenanted office building where a lift is malfunctioning. The building owner and property manager have duties as persons with management or control of the building; the tenants, the cleaning contractor and the lift contractor each have their own. Before the lift work starts, the property manager consults the lift contractor, the tenants and the cleaners, so each knows what the others will do.¹¹ In NSW, codes of practice also carry a duty from 1 July 2026: a business must comply with an approved code of practice, or manage hazards and risks to a standard that is equivalent to or higher than the standard the code requires.¹⁴

Above all of this sit the officers. An officer, such as a director, must exercise due diligence to ensure the business complies, which includes taking reasonable steps to verify that the resources and processes for safety are provided and used.¹ A facilities manager is an officer only if the role meets the Corporations Act definition, which turns on making or taking part in decisions that affect the whole or a substantial part of the business. The stakes are not abstract: NSW's industrial manslaughter offence, in force since 16 September 2024, carries a maximum of AU$20 million for a body corporate and, for an individual, a prison term of up to 25 years.¹⁵ Verifying is a records question. An officer cannot verify a process that leaves no trace.

Where the Process Breaks Between Stages.

Look back at the seven stages and the pattern is plain. Each stage is usually run by a different person: procurement prequalifies, the facilities team onboards, the contractor manages its own workers, security or the building manager runs access, the site supervisor approves permits, and incidents go to safety. Each stage works on its own. The failures happen in the hand-offs, when the next stage cannot see what the last one found.

A licence expires in the worker record, and the gate does not know. A company is dropped in procurement's spreadsheet, and its workers still sign in. An incident is logged against a building, and the renewal review never sees it. None of these is a failure of the stage. Each is a gap between two systems.

That is the problem ComplyFlow is built around: every stage on one record. Requirements are set once for suppliers and workers, and the invitations, reminders, renewals and status run from there.¹² When a worker is not cleared for a location they cannot sign in until it is resolved, unless a site has been set to allow a 'Sign in Anyway' override, which notifies the client.¹³ Whether a site blocks or warns is a setting you choose per site, not a promise the system makes for you.

A Stage-by-Stage Checklist, and the Record Each Stage Leaves.

Use this against your own portfolio. For each row, ask whether you could produce the record for one named contractor today, and how long it would take. The rules behind each row can be written down with the contractor management plan and procedure template.

Stage	What you check	The record it should leave
1. Prequalify	Work tier, insurances, safety system, licences, history, scope	The decision, who made it, the date, the evidence, and the scope
2. Onboard	Which sites, each site's requirements, the asbestos register, the contact	Sites per contractor, the requirements for each, what was handed over
3. Verify workers	Identity, licences and tickets with expiry dates, inductions	Every credential per worker, and the sites each is cleared for
4. Control access	Whether this person is cleared for this site, today	Who signed in, where, when, and their status at that moment
5. Permit the work	The work, the controls, the approver, the expiry	Every permit, its approvals, its workers, and its close-out
6. Report incidents	What happened, notification, the site preserved	The incident, the actions, the owner of each, and whether they closed
7. Review and offboard	Incidents, open items, recurring expiries, then access	The review, the end date and reason, and proof access was removed

Take one contractor, pick the row you are least sure of, and try to produce that record before the end of the week. The row that takes longest is the gap in your process, and it is usually one of the last three. For a facilities manager, that is the test that matters: not whether each stage exists, but whether one contractor can be followed through all seven without asking anyone. If you would like to run that test on your own portfolio, book a demo and bring one contractor's file.