Contractor Safety Management System: What It Must Do & How to Judge One

A contractor safety management system is only as good as the link between the approval and the person at the door this morning. A company can be approved, inducted and filed, and still have nothing that says whether the technician in front of you is cleared for this job. This guide sets out what a system has to do in an Australian workplace, which of its checks are law and which are practice, and eight questions for judging one.

The readers in mind are WHS managers and the facilities, operations and procurement people they depend on; the examples come from property and facilities management, and from transport and logistics. The contractor management process, stage by stage tells the stages in order, so this does not. What contractor management is, the plan and procedure template and PCBU responsibilities cover the definition, the documents and who owes what in a building.

What Is a Contractor Safety Management System?

It is three things working together: rules, records and tools. The rules say what is checked, by whom and for which type of work. The records hold the evidence: the decision to engage a company, the checks on each person, the permits and the incidents. The tools keep the records current, from a shared drive to software. Without the records, the rules are a policy nobody can prove; without the rules, the records are a database nobody trusts.

What the Law Expects From the System, So Far as Is Reasonably Practicable.

The law asks for a result, not a system. The primary duty in section 19 of the model WHS Act reaches a contractor's people as well as your own, so far as is reasonably practicable, because a worker includes a contractor, a subcontractor and an employee of either.¹ We found no provision in the model WHS laws that requires a contractor safety management system by name. A system is how a business shows it did what the law does require, for the people it did not hire.

Three further rules in the model Act decide what the system has to be able to show. No contract hands the duty to the contractor: a duty cannot be transferred (section 14), and a term that purports to transfer it is void (section 272).¹ Where several businesses have a duty over the same matter, each must, so far as is reasonably practicable, consult, co-operate and co-ordinate with the others (section 46), which is why the system records who agreed what.¹ And what is reasonably practicable is weighed, not assumed: all relevant matters, including the likelihood and degree of harm, what the business knows or ought reasonably to know, the availability and suitability of ways to eliminate or minimise the risk and, after assessing those, the cost, including whether it is grossly disproportionate to the risk (section 18).¹

Section numbers are the model Act's, and how each state has adopted it varies.² Victoria runs its own Act. An employer's duties to its employees extend to the independent contractors it engages and their employees for matters it controls, or would control but for an agreement limiting or removing that control (section 21(3)), and its duty to ensure, so far as is reasonably practicable, that people other than its employees are not exposed to risks from its undertaking applies as well (section 23).³ PCBU responsibilities for property owners and FM companies sets out the duties in full.

Step 1: Decide Which Contractors May Be Engaged for Which Work.

Before anyone is booked, the system has to decide whether this company can do this work safely, and keep the evidence the decision rested on. The evidence follows the risk of the work, not the size of the company. Safe Work Australia's own example is a building manager that consults its cleaning contractor to satisfy itself the cleaner has adequate systems in place to protect workers' health and safety.⁴ That is practice: the Act sets the outcome, not the questionnaire.

Insurance is not a WHS requirement either. No provision in the model WHS Act, the model Regulations or Victoria's Act and Regulations requires a business to check a contractor's insurance.⁵ A current certificate says nothing about how the work will be done, and an accreditation scheme shows only that a company met its criteria on a date. What to check on a certificate of currency covers the document most files lean on, and prequalification is where most businesses start.

Step 2: Agree the Controls for the Job Before It Starts.

Approving a company says it is capable, not how this job will be done on this site. Before work starts, the system should hold an agreement on the scope, the controls, who supervises and who else is affected. Safe Work Australia says it is good practice to record consultation, and that PCBUs at the top of a contractual chain can lead the coordination of WHS down it.⁴

For some work the law makes part of that agreement a document. The model Regulations require a PCBU whose work includes high risk construction work to ensure, before it starts, that a safe work method statement (SWMS) for the work is prepared, or has already been prepared by another person (regulation 299).⁵ High risk construction work includes work with a risk of a fall of more than 2 metres, and work where powered mobile plant moves.⁵ That duty sits with the business doing the work, usually the contractor. Under the model Regulations, a business that commissions a construction project of AU$250,000 or more (regulation 292) is the principal contractor unless it engages another business as principal contractor and authorises it to manage or control the workplace and to discharge the principal contractor's duties (regulation 293), and the principal contractor must take all reasonable steps to obtain the SWMS before the work starts (regulation 312).⁵ In Victoria the threshold is AU$350,000 (OHS Regulations 2017, regulation 332), and the owner is the principal contractor unless it appoints a principal contractor and authorises it to manage or control the workplace to the extent needed to discharge a principal contractor's duties (regulation 333(1)); there the SWMS duty sits with the employer or self-employed person doing high risk construction work where there is a risk to anyone's health or safety (regulation 327).⁶ Either way, the system has to check that the SWMS exists and fits this site, not the last one.

Step 3: Clear Each Person, Not Just the Company.

Approving a company clears nobody. The firm approved in March rarely sends the same people in June, so the record that matters is each individual's: identity, the licences the work needs with their expiry dates, and the induction for the site.

Two of those checks can be law. For high risk work, seeing written evidence of the worker's licence before they start, and keeping a record of it for at least 1 year after the work is carried out, is a requirement of regulation 85 of the model Regulations;⁵ what contractor management is has the wording. For construction work, a business must not direct or allow a worker to start unless they have completed general construction induction training and, if that was more than 2 years ago, have done construction work in the past 2 years (regulation 317(1) of the model Regulations).⁵ The site-specific induction, and a check that the person at the gate is the person on the record, are practice, and that is where most files are thin. Workforce compliance holds individual licences and expiries, and training and induction delivers the site-specific part.

Step 4: Make Access and Supervision Follow the Clearance.

The clearance only matters if it reaches the gate, and the gate is usually a dock, a desk or a keypad where nobody can see the record. A system earns its name when the sign-in itself can say whether this person is cleared for this site today.

How much supervision a contractor needs is a decision about the work, not a default. Comcare, the regulator under the Commonwealth WHS Act for the Commonwealth, public authorities and non-Commonwealth licensees, says in its guidance that relying on another business to meet its duties does not automatically result in compliance, that you need to verify it is doing what it said it would, and that familiarity is no excuse for neglecting to check performance or credentials.⁷ If Comcare is not your regulator, read your own state or territory regulator's guidance. A permit is the working form of that check: someone approves the work, its controls and its expiry before it starts. Site access and digital permits make both the gate and the open permits visible.

Step 5: Treat an Incident as Two Records and Two Duty Holders.

When a contractor's worker is hurt on your site, two businesses may have something to do next. A December 2025 amendment to the model Act (section 39A) adds a duty on the business that must notify the regulator (section 38) and the business that manages or controls the workplace (section 39) to make sure the other is notified immediately after becoming aware, so far as is reasonably practicable, and it applies in your state only once your state enacts it.¹ PCBU responsibilities covers notifying the regulator.

The rest is practice: agree in advance how a contractor reports to you and how fast, and record the incident against the contractor as well as the site, so a third near miss across three sites does not read as three unrelated events. Incident management keeps the record in one place.

Step 6: Review the Contractor, Then Close the Engagement.

The check has to keep running after the first visit, because documents lapse on their own dates. A year of visits should add up to a view on whether the contractor comes back: permits closed on time, near misses it reported itself, how often someone arrived uncleared. Closing out is practice, not a rule. Whoever ends the contract also ends the access: the company's engagement status, every pass, key and code, anything still open, and a dated reason on the file. Some records must outlive the engagement: under the model Regulations, licence evidence for at least 1 year after the work (regulation 85), and the SWMS until the work is completed, or at least 2 years after a notifiable incident in connection with the high risk construction work (regulation 303); and under the December 2025 model Act, a record of each notifiable incident, notifiable extended absence or notifiable suicide for at least 5 years from the day the regulator was notified (section 38(7)), though your state's Act may cover notifiable incidents only.⁵¹ Where it breaks: the contract ends and the access cards do not.

Two Systems Under Test: A Shopping Centre and a Distribution Centre.

Both examples are illustrative, not real customers.

A tenant's fit-out crew in a shopping centre. An FM company runs a shopping centre for its owner. A tenant engages a shopfitter for a weekend fit-out, so the FM company has no contract with the crew, yet they will use its service corridors overnight. Safe Work Australia lists the owner, the manager, each shop and the cleaning and security businesses at a multi-tenanted shopping centre as separate PCBUs.⁸ To the extent it manages or controls the workplace, the FM company has a duty of its own to ensure, so far as is reasonably practicable, that the workplace, the means of entering and exiting it and anything arising from it are without risks to the health and safety of any person (section 20(2)).¹ So the requirement lives in the tenancy, in writing: the shopfitter's people are cleared before they get a service pass. The weak point is the second shift, when the shopfitter sends a crew nobody cleared.

A canopy repair over a live loading apron. A transport and logistics operator has a damaged canopy over the apron of its distribution centre, where trucks reverse in all shift. Repair of a structure is construction work under the model Regulations, unless it is repair work of a minor nature.⁵ This repair is not minor, and with a fall of more than 2 metres possible and trucks moving beneath, it is high risk construction work. The roofer's SWMS covers the fall and says nothing about the trucks underneath, so the operations manager sends it back and the two agree an exclusion zone and a time window told to the carriers. The operator keeps the approved SWMS and its date, the agreement, the permit and the sign-in record.

How to Evaluate a Contractor Safety Management System: Eight Questions.

Judge a system, built from documents or bought, on one live contractor, not a demonstration contractor, and score each question as shown live, described only, or cannot do. The 10 questions to ask a software vendor go further on the buying side.

1. Does it hold different requirements for different work? A cleaner and a crane crew should not face the same checks.
2. Does it clear people, not only companies? Each worker's licences, expiry dates and induction should sit on a record of their own.
3. Does a person read the evidence, and is the decision recorded? A document that was uploaded is not a document that was checked.
4. Does a clearance reach the gate? Ask what happens when an uncleared person arrives, and whether the site chooses to block them or warn.
5. Does it join the other records? Permits, inductions and incidents should sit on the same contractor record.
6. Can you produce one contractor's whole file in minutes? The decision, the evidence, who has been on site, what was approved and what went wrong.
7. Will the contractors actually use it? Ask how little a contractor has to do the second time round.
8. Does it leave the decisions with you? No system can choose a tier, judge whether a safety management system is adequate, consult the other duty holders or supervise the work, and buying a tool does not change who holds the duty.

Two or more answers of "cannot do" among questions 2, 4 and 6 is our test for a document store rather than a safety system. It is a rule of thumb, not a standard. On the buying side, the 2026 Australian comparison lines the platforms up.

Where ComplyFlow Fits in a System Like This.

ComplyFlow's contractor management software runs the records layer for steps 1, 3 and 4: a business sets requirements once for suppliers and workers, and invitations, reminders and renewals follow.⁹ A site can allow Sign in Anyway, which lets an uncleared worker through and notifies the client; whether a site blocks or warns is a setting each site chooses.¹⁰

For step 2, AI SWMS Review can be set on a work permit or SWMS form.¹¹ Each criterion comes back Pass, Partial or Fail, and the AI provides guidance while the person using it stays responsible for accuracy.¹² It reviews method statements and does not write them. It does not choose a tier or supervise the work; those stay with people.

Run Your Own Test This Week.

Pick one contractor working on one of your sites this week and answer the six steps from records, not from memory. The step you cannot answer in a few minutes is the next thing to fix. To see the six steps run on your own sites, book a demo and bring one contractor's file.