Procurement and Contractor Management

Why This Topic Matters
Modern organizations rarely perform all of their work with their own employees. Construction, maintenance turnarounds, specialty inspections, hauling, janitorial services, IT installation and even core production tasks are routinely outsourced. At the same time, almost every hazard that enters a workplace arrives through a purchase order: chemicals, machinery, tools, PPE, raw materials and services. If safety is not built into how an organization buys things and hires people, the safety professional spends his or her career chasing hazards that could have been screened out before they arrived at the gate.

The BCSP recognizes this. Procurement and contractor management sits inside the Program Management domain of the CSP blueprint because it is one of the most powerful systems-level controls a safety professional can influence. Contractor fatality rates are consistently higher than those of host employees, multi-employer worksites create confusion about who is responsible for what, and under OSHA's multi-employer citation policy a host can be cited for hazards created by someone else's workers. Consensus standards such as ANSI/ASSP Z10, ISO 45001 (clause 8.1.4), ANSI/ASSP A10.33 and ANSI/ASSP Z590.3 all require that procurement and contractor processes be managed as part of the occupational health and safety management system. Expect several exam items that test whether you understand the lifecycle approach and the shared-but-not-transferable nature of host responsibility.

What It Is
Procurement management (for safety purposes) is the integration of health, safety and environmental requirements into the process of specifying, sourcing, evaluating, purchasing and receiving goods and services. It covers:
• Writing safety specifications into requests for proposal (RFPs), bid packages and purchase orders.
• Reviewing new chemicals, equipment and materials before purchase (chemical approval, SDS review, machine-guarding review, ergonomics review).
• Applying Prevention through Design (PtD) so hazards are eliminated or reduced at the design and purchasing stage rather than controlled later.
• Evaluating total cost of ownership or life-cycle cost, which includes injury, maintenance, disposal and compliance costs, not just the purchase price.
• Managing change: ensuring a new or substituted product goes through management of change (MOC) before it is placed in service.

Contractor management is the systematic process a host employer uses to select, prepare, monitor and evaluate outside companies and their workers so that their activities do not create unacceptable risk to themselves, host employees, the public or the facility. It is typically described as a lifecycle with six phases:
1. Prequalification – screening contractors before they are allowed to bid.
2. Selection and contracting – choosing a contractor on best value (safety performance weighted with cost, schedule and quality) and embedding safety requirements into the contract.
3. Pre-job planning – kickoff meetings, scope definition, hazard identification, JHAs/JSAs, permit requirements, emergency coordination.
4. Orientation and training – site-specific orientation covering host hazards, rules, emergency procedures, stop-work authority and reporting.
5. Monitoring the work – inspections, audits, permit-to-work verification, leading-indicator tracking, incident investigation and corrective action.
6. Post-job evaluation and close-out – scoring contractor performance and feeding results back into the prequalification database.

Key Concepts and Terms You Must Know
Prequalification criteria. Common screening items include the Experience Modification Rate (EMR), OSHA Total Recordable Incident Rate (TRIR), Days Away/Restricted/Transfer (DART) rate, fatality history, OSHA citation history, written safety program, training records, drug and alcohol program, insurance coverage and references. A frequently tested point: an EMR below 1.0 indicates better-than-average workers' compensation loss experience for that industry; above 1.0 is worse than average. Another tested point: lagging indicators (EMR, TRIR) describe the past and can be distorted by company size or under-reporting, so a mature program also evaluates leading indicators such as program quality, training, near-miss reporting and management commitment. Third-party databases (e.g., ISNetworld, Avetta, Veriforce) are often used to collect and verify these data.

Contract language. Contracts should specify applicable regulations and standards, the host's site rules, required training and certifications, PPE, reporting of injuries and near misses, drug testing, subcontractor flow-down, right of the host to audit and stop work, and consequences for non-compliance. Risk-transfer clauses include indemnification and hold-harmless agreements, additional insured status on the contractor's liability policy, certificates of insurance (COI) and waiver of subrogation. The exam often tests that these clauses transfer financial risk but do not relieve the host of its OSHA duties or its moral responsibility.

Host versus contractor responsibility. Under OSHA's Multi-Employer Citation Policy (CPL 02-00-124), an employer on a site may be cited as a creating, exposing, correcting or controlling employer. A host that controls the site and has the authority to correct hazards is a controlling employer and must exercise reasonable care to detect and prevent violations by contractors. Reasonable care is scaled to the host's level of control and the nature of the hazard; it does not require the same level of inspection as the contractor's own supervision, but it does require periodic inspection, a system for correcting hazards and enforcement. In process safety (29 CFR 1910.119(h)), the host must inform contractors of known hazards, explain emergency action plans, develop safe work practices for contractor entry and periodically evaluate contractor performance; the contractor must train its employees and document that training.

Two-way communication. The host must tell the contractor about site hazards (chemicals, energy sources, confined spaces, traffic, overhead work). The contractor must tell the host about hazards its work will introduce (hot work, cranes, chemicals it brings on site). Hazard communication, lockout/tagout (1910.147(f)(2) outside personnel), confined space (1910.146(c)(8) host and contractor duties) and construction (1926.16) all contain explicit coordination requirements.

Permit-to-work and work authorization. Hot work, confined space entry, excavation, energized electrical work, lifting and line-breaking permits are the operational tools that enforce pre-job planning while the work is underway.

Safety in purchasing. A chemical approval process (new chemical request, SDS review, substitution evaluation) and an equipment safety review (guarding, noise, ergonomics, CE/UL/NRTL listing, lockout points, access for maintenance) should occur before the purchase order is released. Specifying safety features at purchase is far cheaper than retrofitting; this is the core of PtD and ANSI/ASSP Z590.3.

How It Works in Practice (The Integrated Process)
Step 1 – Define the need and the risk. Before anything is bought or bid, define the scope of work and classify the risk level (low, medium, high). High-risk work (hot work, heights, confined spaces, energized electrical, heavy lifts, hazardous chemicals) triggers more stringent prequalification and oversight. Low-risk services (e.g., office supply delivery) receive proportional controls. Risk-based tiering is a tested concept: controls should be proportionate to risk.

Step 2 – Build safety into the procurement document. Safety requirements, performance expectations and evaluation criteria are written into the RFP so that bidders know safety is weighted in award decisions. Purchasing, legal, operations and safety collaborate; safety should not be a late review step but a defined part of the procurement workflow.

Step 3 – Prequalify and select. Collect EMR, TRIR, DART, citation history, program documents and insurance. Verify, do not just accept. Compare against industry benchmarks (BLS rates). Evaluate the quality of the written program and interview key supervisors for high-risk work. Award on best value. Document the rationale; if a marginal contractor is selected for business reasons, document the compensating controls (additional oversight, mentoring).

Step 4 – Pre-job planning. Hold a kickoff meeting. Review scope, schedule, simultaneous operations (SIMOPS) with host activities, hazard analysis, required permits, emergency response, incident reporting, subcontractor approval and site logistics. Agree on points of contact and communication protocols.

Step 5 – Orientation and verification. Deliver site-specific orientation to every contractor worker before work begins; document attendance; verify certifications (forklift, rigging, confined space, OSHA 10/30 where required). Issue badges or stickers that visibly show orientation status.

Step 6 – Monitor. Conduct scheduled and unscheduled inspections. Review permits daily. Track leading indicators (toolbox talks, near-miss reports, audits completed, corrective actions closed). Apply a graduated enforcement process: coaching, written warning, removal of an individual, removal of the contractor. Investigate incidents jointly and share lessons learned.

Step 7 – Evaluate and close out. Score the contractor on safety performance, responsiveness and compliance. Record the evaluation in the prequalification database so that future selection decisions benefit from actual performance, closing the Plan-Do-Check-Act loop required by Z10 and ISO 45001.

Measuring Program Effectiveness
A mature program tracks: percentage of contractors prequalified before award, percentage of workers oriented before entry, inspection findings per hour worked, contractor TRIR versus host TRIR, near-miss reporting rate, permit compliance rate, corrective action closure time and percentage of purchases that passed a safety review. The exam favors answers that combine leading and lagging measures and that feed results back into the process.

Common Pitfalls the Exam Likes to Test
• Awarding on lowest bid without weighting safety.
• Relying solely on EMR or TRIR, especially for small contractors whose rates swing wildly with one injury.
• Assuming an indemnification clause or COI eliminates host liability.
• Allowing contractors to begin work before orientation or before permits are issued.
• Failing to flow requirements down to subcontractors.
• Treating contractor incidents as not our problem and excluding them from investigation and metrics.
• Buying new chemicals or equipment without SDS review, MOC or design review.
• Having no post-job evaluation, so poor performers are rehired.

Exam Tips: Answering Questions on Procurement and Contractor Management
1. Think lifecycle and think early. When a question asks for the most effective or first step, the correct answer is usually the one that occurs earliest in the process: prequalification before selection, safety criteria in the bid document before award, design or purchase review before the equipment arrives. Prevention through Design and hierarchy-of-controls logic apply: eliminating a hazard at purchase beats controlling it later.

2. The host never fully transfers responsibility. If an answer choice implies that a contract clause, insurance certificate, or a contractor's own safety program removes the host's duty to exercise reasonable care, it is wrong. Choose answers that describe shared responsibility with the host retaining oversight.

3. Know the multi-employer categories. Be ready to identify creating, exposing, correcting and controlling employers from a scenario. A general contractor or plant owner with authority over site conditions is typically the controlling employer and must perform reasonable inspections and enforcement.

4. Interpret EMR and rates correctly. EMR less than 1.0 is favorable; greater than 1.0 is unfavorable. TRIR and DART are lagging indicators normalized per 200,000 hours. Questions that ask for limitations of these metrics want answers about small-company volatility, under-reporting and backward-looking nature; the fix is adding leading indicators and program review.

5. Prefer systems over single actions. The CSP exam rewards management-system thinking. An answer that describes a documented, risk-based, repeatable process (prequalify, plan, orient, monitor, evaluate) is almost always better than one that describes a one-time inspection, a memo or a training session alone.

6. Risk-based proportionality. If a question asks how much oversight a contractor needs, the right answer ties the level of screening and monitoring to the risk of the work, not to the size of the contract or the contractor's reputation alone.

7. Two-way communication is required. Scenarios involving lockout/tagout, confined spaces, hazard communication or process safety will test whether you know the host must inform the contractor of site hazards and the contractor must inform the host of hazards it introduces, and that both must coordinate procedures.

8. Total cost, not purchase price. For procurement questions, choose answers that evaluate life-cycle or total cost of ownership, including safety, maintenance, training and disposal, over answers that minimize up-front cost.

9. Close the loop. If a choice includes feeding post-job evaluations back into prequalification or using incident data to update contract requirements, it reflects continuous improvement and is usually the best answer.

10. Eliminate absolutes and shortcuts. Distractors often contain words like always, never, solely, or describe skipping steps to meet schedule. The professional, ethical answer protects workers first and documents decisions.

Quick Review Checklist
• Six-phase contractor lifecycle: prequalify, select/contract, pre-job plan, orient/train, monitor, evaluate.
• Prequalification data: EMR, TRIR, DART, citations, written program, insurance, references; verify and supplement with leading indicators.
• Contract tools: safety specifications, indemnification, hold harmless, additional insured, COI, flow-down to subs, audit and stop-work rights.
• OSHA multi-employer policy: creating, exposing, correcting, controlling; reasonable care.
• Regulatory coordination duties: PSM 1910.119(h), LOTO 1910.147(f)(2), confined space 1910.146(c)(8), construction 1926.16.
• Consensus standards: ANSI/ASSP Z10, ISO 45001 clause 8.1.4, ANSI/ASSP A10.33, ANSI/ASSP Z590.3 (PtD).
• Procurement controls: chemical approval and SDS review, equipment design review, MOC, total cost of ownership.
• Metrics: mix of leading and lagging, contractor data integrated with host data, results fed back into selection.

Master these concepts and, when faced with an exam item, ask yourself three questions: Is this the earliest point in the lifecycle to control the hazard? Does the host retain oversight? Is the approach systematic and proportionate to risk? The answer that satisfies all three is almost always the one the BCSP is looking for.