What Is Contractor Management: The Duty, the Stages & Where Software Fits

Search for contractor management and the results disagree about what it is. Some pages are about contracts, some are about paying freelancers, and some are about the thing a safety manager means: deciding which companies, and which of their people, may work on your sites, and being able to prove it afterwards. This guide is about the third.

It is written for WHS managers and the colleagues who share the job, in Australian businesses that run on contractors. The worked examples come from property and facilities management, and from transport and logistics, because those are the businesses where the contractor list is longest and the sites are the most spread out.

What Is Contractor Management?

Contractor management is the set of checks, controls and records a business uses to decide which contractors may work for it, which of their people may come on site, what they must do while they are there, and how it proves all of that afterwards. In Australia it is a safety and legal discipline before it is a purchasing one, because the work health and safety (WHS) laws treat the people a business engages as people it owes a duty to.

A contractor, for this purpose, is a wider group than companies holding a contract. The law's word is worker, and it takes in anyone who carries out work in any capacity for a business, including a contractor, a subcontractor or an employee of either.¹ A sole trader replacing a tap, a cleaning company's night crew and a subcontractor's apprentice are all inside it.

Most people picture the discipline as an approval step. A questionnaire comes back, a certificate is filed, and the contractor is approved. That is the first of seven stages. The rest of the discipline is what happens between approval and the day the contractor leaves: whether the person who turns up is the person who was checked, whether their licence is still current on the day, and whether anyone removes their access when the contract ends.

Contractor Management Is Not Contract Management or Contractor Payroll.

Three different subjects share the name, and it is easy to land on the wrong one. Contract management is commercial. It tracks what a supplier agreed to deliver, at what price and by when, and what happens when the scope changes. Contractor payroll, the subject of many HR software pages, covers how independent contractors are engaged as suppliers, invoiced and paid.

Contractor management in the WHS sense asks a different question: are the people doing the work on our sites safe, and can we show we took the steps the law expects? The contract is where the three meet, because it is where safety requirements get written down. But they are run by different people and measured differently. A procurement team can run a flawless tender and still have no idea whether the electrician at the plant room door holds a licence.

That split is also why a search for a contractor management plan often returns a government contract management plan instead. The two documents are covered in the contractor management plan and procedure guide, which includes a template.

Who Carries the Duty When a Contractor Does the Work?

The business that engages the contractor does, alongside the contractor. A contractor's people are workers, so the business owes them the same primary duty it owes its own staff, so far as is reasonably practicable and to the extent it can influence and control the matter, or would have that capacity but for an agreement or arrangement limiting it (sections 16(3) and 19 of the model WHS Act). That duty cannot be transferred (section 14), and a contract term that tries to transfer it is void (section 272).¹ Comcare's guidance for Commonwealth PCBUs adds that relying on a specialist does not shed it: you are required to verify the contractor's expertise, its own safety systems, and that the work is in fact being done safely, and to keep consulting and instructing it.² The stages below put those three checks into practice.

Every state and territory except Victoria has implemented the model Act, some with changes, so check the section numbers against yours.³ Victoria's own Act extends an employer's duties to the independent contractors it engages and their employees, for matters the employer controls or would control but for an agreement limiting that control (section 21(3)).⁴ Officers, asbestos and notifying the regulator are covered in PCBU responsibilities for property owners and FM companies.

The Seven Stages of Contractor Management, in One Pass.

The discipline has seven stages. Each answers one question and leaves one record, and the record is the point: a stage that leaves nothing cannot be shown to have happened. The contractor management process, stage by stage follows one contractor through all seven in a property portfolio. This is the map.

1. Prequalification. The question is whether a company may work for you at all. The evidence is its insurances, licences, safety system and safety record, set against a tier that matches the type of work. A certificate that was current on approval day says nothing about the day a technician arrives, so the evidence needs reading, and what to check on a certificate of currency shows where the surprises are. Prequalification is where most businesses start.

2. Onboarding. This ties the approved company to the sites it will work on: each site's rules, the induction, the emergency arrangements, the after-hours access, and the person on site who is its contact. Approval is a decision about the company; onboarding makes it real for one building or one depot.

3. Worker verification. Approval clears the company, not the person who turns up. Each worker needs a record of their own: who they are, which licences and tickets the work needs and when each lapses, and which inductions they hold. For high risk work the model Regulations make the check law: a business at a workplace must not direct or allow a worker to carry out high risk work that needs a high risk work licence, such as forklift work, operating certain cranes and hoists, scaffolding or rigging, unless it sees written evidence, provided by the worker, that the worker has the relevant licence for that work, and it must keep a record of that evidence for at least 1 year after the work.⁵ Workforce compliance is where that record lives.

4. Site access. The question is whether this person is cleared for this site today. The answer is usually given at a loading dock, a security desk or a keypad by someone who cannot see the record, which is why the earlier stages count for nothing if the gate does not know about them. Site access earns its place when the sign-in itself holds the answer.

5. Permits and the work. Hot work, isolating a fire system, confined space entry and work at height on a plant deck need a permit before they start: it names the work, the controls, the responsible person and the expiry. The record to look for is the close-out, because the failure is a permit left open after the technician has gone. Digital permits make the open ones visible.

6. Incident reporting. An incident belongs on two records, the site's and the contractor's, so a repeat across several sites reads as a pattern and not as separate events. Agree in advance how a contractor reports to you and who notifies the regulator. The December 2025 model Act adds that the PCBU with the duty to notify the regulator (section 38) and the person with management or control of the workplace must each, immediately after becoming aware, ensure the other is notified, so far as is reasonably practicable (section 39A); your state may not carry that yet.¹

7. Review and offboarding. Documents expire on their own dates, so the checks keep running past the contract anniversary, and a year of visits should add up to a view on whether the contractor comes back. Offboarding is the stage with the least written about it, and it is practice, not a rule: stop the company being engaged for new work, remove every worker's access including the keys, cards and codes held in the building's own systems, close what is still open, and record the date and reason it ended. Keep the licence evidence for at least 1 year after the work, as the model Regulations require.

How Much Checking Does Each Contractor Need?

Not the same amount. A single questionnaire for everyone either buries the low-risk visitor in paperwork or waves the high-risk trade through, so the working approach is to tier contractors by the type of work and set the checks for each tier once.

The University of Southern Queensland's contractor management procedure, effective 30 March 2026, is a public example of the shape. It groups contractors into five categories: low risk (office cleaners and administrative consultants), medium risk (IT technicians, landscapers and maintenance staff), high risk (electricians, scaffolders and plant operators), specialist (asbestos removalists and hazardous materials handlers), and principal contractor for construction projects.⁶ Supervision then scales with the category, from minimal to close. The categories suit a university, so a distribution centre or a property portfolio would write its own, but the principle carries over: the checks follow the risk of the work.

Knowing which checks are law and which are practice saves effort. The licence check for high risk work is law, as above. Under the model Regulations, engaging a removalist licensed for the work is law too: a business that commissions asbestos removal must ensure it is done by a removalist licensed for that work. The exception, for 10 square metres or less of non-friable asbestos or minor contamination, still requires a competent person trained under regulation 445. For non-friable asbestos, Victoria's exception is narrower: 10 square metres and no more than 1 hour of removal work in total in a 7-day period (OHS Regulations 2017, regulations 246 and 250(1)(a)).⁵⁷ Insurance is different: it is good practice and often a contract term, but we found no WHS provision in the model laws or Victoria's that requires you to check it, so do not tell your board otherwise without your lawyer.

Two Contractors, Two Sets of Checks.

The two examples below are illustrative, not real customers.

A cleaning contractor at a shopping centre. Safe Work Australia's own example of several PCBUs at one site is a multi-tenanted shopping centre: the owner, the centre manager, each shop, and the businesses doing cleaning, security and trolley collection.⁸ Here the contractor is a cleaning company with a night crew. The risk per visit is modest, so the tier is medium, but the exposure is the churn: the company approved in March rarely sends the same people in June. The property manager's checks are therefore at the worker level. Every cleaner who holds an access card has been inducted, the chemicals on the company's list match what is in the cleaning store, and the roster of named people with keys is current. The record the facilities manager wants is simple: who is cleared tonight, and since when.

A racking repair crew at a distribution centre. A transport and logistics business has a pallet racking upright damaged by a forklift in the cross-dock aisle, and calls a repair contractor. The risk per visit is higher, because the work happens beside live forklift traffic, so the tier is high. The checks scale: the company's safety record and insurances, the crew's method statement for working next to live aisles read before work starts, a licence check for any worker who will operate a machine that needs a high risk work licence, a site induction on the traffic rules, and a named supervisor on the warehouse side. If the repair isolates fire detection, a permit follows. The warehouse's safety manager keeps one record that shows all of it, because the next question after any near miss with a forklift is who was working there.

The same discipline sits under carriers moving your freight. In the transport and logistics industry, chain of responsibility law adds its own duties, which the chain of responsibility guide covers.

Where Does Software Fit?

A spreadsheet works while contractors are few, the sites are one or two, the work is low risk and one person holds it all in their head. It stops working when the number of dates it has to watch outgrows that person: insurances, licences, inductions and permits, per company and per worker, per site. The work does not get harder at that point. It gets invisible, because nobody notices an expiry until the day it bites.

Software earns its place by running the record, not by making the decisions. A tool should hold the requirements for each tier once, chase the documents and renewals, tie the sign-in to the current record, and keep permits, incidents and the close-out in the same place. It cannot choose a tier, decide whether a safety system is good enough, consult the other duty holders or supervise the job. Duties cannot be transferred, and that includes to a tool.

ComplyFlow takes the record-running part: a business sets its requirements for suppliers and workers once, and the invitations, reminders and renewals follow.⁹ At the gate, a worker who is not cleared for the location is stopped, unless the site has chosen to let people sign in anyway, in which case the client is notified; each site makes that choice.¹⁰ Deactivating a company at the end of an engagement marks all its workers inactive and ends the reminders.¹¹ The full picture is on the contractor management software page.

If you are weighing tools, ten questions to ask and the bad answers to watch for is the place to start, and the 2026 Australian comparison sets the options side by side.

Five Questions to Test Your Own Contractor Management.

Pick one contractor who is working on one of your sites this week, and try to answer these from records, not from memory:

1. Can you show the decision to engage them, who made it, and the evidence it rested on?
2. Can you name every person from that company who has been on site this month, with each person's licences and expiry dates?
3. If one of those licences expired yesterday, what happens when that person arrives today?
4. Where would you find an open permit or an incident involving them?
5. If the contract ended tomorrow, who removes their access, and how would you know it had been done?

Whichever question takes more than a few minutes is where your process has a gap, most often one of the last three. That is a better starting point than a new policy. If you want the rules written down as a document, the plan and procedure template is the next step, and if you would like to run this test on your own sites, book a demo and bring one contractor's file.