[ISO 45001 Series] Planning: Contractor and Outsourcing Controls

Introduction

The planning of controls for non-routine risks has finally reached its last article: planning controls for contractors and outsourcing.

Sometimes an organization does not choose to procure labor services from outside to help carry out its internal affairs. Instead, it may bundle the relevant work and ask people outside the organization to handle it. Compared with labor-service procurement, the organization still retains some control over the work; once it outsources the work, however, its control over that work actually decreases.

ISO 45001 therefore considers controls necessary. An organization cannot simply stop considering occupational health and safety because it outsourced the work (if that were how it worked, everyone would just outsource everything =口=). Readers who have already studied the standard will notice that, compared with planning procurement controls or change-management controls, ISO 45001 contains relatively more requirements for contractor and outsourcing controls.

Although I still think other rules are needed to fill in the gaps XD.

Contractor and Outsourcing Control Requirements in ISO 45001

If an organization arranges for an external organization to perform part of a function or process, ISO 45001 defines this as “outsourcing” (Outsource).

When an organization outsources a function or process, ISO 45001 requires it to ensure that the outsourced function or process is controlled, that the outsourcing arrangement complies with applicable laws and other requirements, and that the arrangement supports the intended outcomes of the organization’s occupational health and safety management system.

For external organizations selected by the organization—contractors—ISO 45001 requires the organization to coordinate its procurement process with contractors that may affect the organization, their workers, and contractors of other interested parties, in order to identify hazards, assess risks, and control occupational health and safety risks.

The reason is that an organization cannot exclude its responsibility for workers’ safety and health simply because it has assigned part of an activity to a contractor.

Accordingly, an organization can use the following measures to ensure that contractors and their workers meet the requirements of its occupational health and safety management system:

1. Use contracts that clearly define the responsibilities of the parties.

2. Use tools such as prequalifying contractors based on past safety and health performance, or making safety and health matters contractual requirements, to ensure contractors’ safety and health performance at the workplace.

3. Coordinate with contractors on hazard reporting, controls on entry into hazardous areas, and procedures for emergencies.

4. Specify how contractors must cooperate with the organization’s occupational health and safety management-system processes and accident reporting.

The organization must verify a contractor’s ability to perform the work before allowing it to begin.

The 2022 Rules and the Current Contractor-Management Requirements after the 2026 Amendment

What the rule was when this article was published in 2022: When the original article discussed Article 26 of the Occupational Safety and Health Act, it focused on the duty, before contracting out all or part of a business, to inform contractors and subcontractors of the work environment, hazardous elements, and the safety and health measures required by the Act. That wording is retained as the legal context at the time of publication.

What changed in 2026: The amendment to the Occupational Safety and Health Act was promulgated on December 19, 2025, and took effect on July 1, 2026. The Ministry of Labor explains that the amendment strengthens contractor management and safety-and-health responsibilities across multiple tiers of contracting._[4]

Current contractor-management requirements after the amendment: Under current Article 26, a business entity must conduct a risk assessment of the contracted work before contracting it, inform the contractor of the assessment results concerning the work environment, hazardous elements, and safety and health equipment and measures to be adopted, and require the contractor to execute the work precisely according to the assessment results during the contract period. Contractors and subcontractors must follow the same requirements when subcontracting their contracted portion, while a business entity that leases or lends a workplace or equipment must give advance notice of the relevant hazards and safety-and-health precautions._[2]

Current requirements for joint operations: When the original business entity works together with workers of contractors and subcontractors, current Article 27 requires it to establish a consultation group; appoint a person responsible for supervision and coordination of the workplace; regulate and integrate work; inspect the workplace; direct and assist with contractor safety and health education and training; control the entry of machinery, equipment, tools, and personnel; and take other measures necessary to prevent occupational accidents. If a business entity contracts work separately to two or more contractors for joint operations but does not participate in those operations, it must designate one contractor to assume the responsibilities of the original business entity. When contractors or subcontractors subcontract their contracted portion, they must also carry out the liaison, inspection, education and assistance, entry-control, and other necessary measures described above, and they must act in response to the necessary measures taken by the original business entity._[3]

Practical Methods Recommended in This Article

Problems Outsourced Work May Create and Why Controls Are Necessary

When an organization assigns part of its work to an external organization, the external organization’s personnel may be unfamiliar with the business entity and may be temporary rather than regular workers. Their awareness and alertness regarding hazards and risks at the worksite may therefore be lower, making accidents more likely.

Because an organization cannot exclude its responsibility for workers’ safety and health simply by assigning part of an activity to a contractor, ISO 45001 requires it to ensure that outsourced functions or processes are controlled and meet the requirements of the occupational health and safety management system. It must also coordinate the procurement process with contractors to identify hazards, assess risks, and control occupational health and safety risks.

Distinguishing Outsourcing from Labor-Service Procurement and Their Control Differences

As explained in my article [ISO 45001 Series] Planning: Procurement Controls, both labor-service procurement and outsourcing involve an organization bringing labor in from outside. In my analysis, an organization should not classify the work only by asking whether the later contract is a “contract for work” under the Civil Code. The relevant question is whether the organization still has a certain level of authority to control and plan all or part of the work, and which control measures should therefore apply.

The reason is that the Ministry of Labor’s Contractor Management Technical Guidance and Procurement Management Technical Guidance distinguish the two according to the organization’s degree of control and planning over the work.

For labor-service procurement, the organization retains a certain degree of control and planning over the work. Its control measures therefore tend to use contracts and procurement specifications to set safety and health requirements for the labor being procured and to define how the contract should be performed. The organization can also plan in advance how the work should be carried out to meet the goals of the occupational health and safety management system.

By contrast, the organization has much less authority to control or plan outsourced work. It can mainly rely on selecting the contractor in advance, communicating and coordinating with the contractor, and managing the work during construction to require compliance. Compared with controls for labor or construction procurement, the organization has less ability to intervene in how an outsourcing contract is performed, so the control measures and methods differ.

Accordingly, when designing controls for outsourcing and contractors, the Contractor Management Technical Guidance first uses methods similar to procurement controls to select a contractor and has the organization assess the hazards and risks of the work to be assigned. During the work, the organization then communicates and applies corresponding controls with the contractor. The concept combines general workplace risk controls with procurement controls.

Overview of the Contractor and Outsourcing Control Process

ISO 45001 offers only general recommendations for outsourcing controls and does not describe in detail what control measures an organization should adopt.

Outsourcing and the labor-service procurement described above both involve bringing outside labor into an organization to help perform all or part of its work. In my article on [ISO 45001 Series] Planning: Procurement Controls, I used the Ministry of Labor’s Procurement Management Technical Guidance because Taiwan’s Occupational Safety and Health Management System (TOSHMS) and ISO 45001 are not substantially different in content. To keep the control process consistent, I also use the Ministry’s Contractor Management Technical Guidance for outsourcing and contractors._[1]

However, the Ministry’s Contractor Management Technical Guidance calls all of these operations “contracting.” As explained above, whether a contract is legally a contract for work does not mean that it necessarily belongs under contractor controls. To avoid confusion, I use ISO 45001’s term “outsourcing” for organizational work to which contractor controls apply.

Based on the Ministry of Labor’s Contractor Management Technical Guidance and ISO 45001, I have established the contractor and outsourcing control measures shown below.

The Contractor Management Technical Guidance divides the outsourced work an organization may perform into “general contracting,” which is unrelated to manufacturing or production safety and health, such as construction or expansion projects; “construction contracting,” such as machinery and equipment inspection and maintenance; and “transportation contracting,” such as transporting chemicals or vehicles.

Only work that the organization actually outsources needs to be managed under these outsourcing and contractor controls. Work that is not outsourced should continue to use other risk-control measures. Before planning outsourcing and contractor controls, the organization must therefore identify which work may be outsourced, understand which operations will be outsourced, and determine the type of outsourcing involved. This helps control and manage the outsourced work.

Hazard Identification and Risk Assessment for Different Types of Outsourced or Contracted Work

Because an organization does not avoid responsibility for workers’ safety and health by outsourcing part or all of its work, it should complete hazard identification, risk assessment, and the control measures based on the assessment before formal work begins, even when the work is outsourced. The results should be reviewed and confirmed before construction starts.

When conducting hazard and risk assessments for outsourced work, the organization can set different contractor-selection criteria according to the area, type of contractor work, and risk characteristics. For example, hot work in an explosion-proof area has a higher risk than hot work outside such an area, so the contractor-selection standard for the explosion-proof area should be stricter.

Identifying the safety and health rules and protective measures that contractors must follow can provide a reference for safety and health requirements in procurement specifications or contracts, as well as a basis for later checks.

For routine outsourced work, the organization can use the periodic hazard identification and risk assessment process in its occupational health and safety management system to identify potential hazards and risks from outsourced work and plan the relevant controls.

In my article [ISO 45001 Series] Identifying Internal Issues in the Context of the Organization, the worker and work-environment inventory creates lists by job title or work content, whether or not the work is outsourced. Hazards and risks are then identified and assessed according to the corresponding job title or work content. The organization may therefore use the results of the periodic assessment to plan contractor controls instead of repeating the entire hazard-identification and risk-assessment process.

When conducting hazard identification and risk assessment, the organization must also consider whether a contractor may bring external machinery or materials into the work. Their hazards and risks should be included in the worker and work-environment inventory.

Temporary outsourced work may not have been assessed during the periodic hazard-identification and risk-assessment process. I therefore recommend conducting an additional hazard identification and risk assessment for temporary outsourcing and planning the corresponding controls.

If temporary outsourced work were assessed in exactly the same way as routine outsourced work, time pressure could create more serious hazards and risks or delay the entire outsourcing process. A simpler risk-assessment method, such as a checklist or brainstorming, may therefore be sufficient for temporary work.

For transportation contracting, ISO 45001 treats a “workplace” as any place controlled by the organization that people need to visit for work. The organization should therefore assess not only hazards and risks within its own premises but also traffic hazards and risks associated with transporting chemicals, customers, or other people and items.

Who Should Be Responsible for Hazard Identification and Risk Assessment for Outsourced Work?

Routine outsourced work is usually assessed together with periodic hazard identification and risk assessment. Based on the organizational structure discussed earlier, it is therefore relatively straightforward for the organization’s occupational health and safety personnel to take responsibility.

For temporary outsourced work, however, the Contractor Management Technical Guidance considers it unnecessary for the occupational health and safety unit to be responsible in every case. The contractor may refer to the organization’s hazard-identification and risk-assessment method and submit a relevant report after signing the contract but before formal work begins.

I believe that contractors are inevitably less familiar with the organization’s work environment than internal personnel. In addition, under the current Article 26 of the Occupational Safety and Health Act, a business entity contracting out its business must conduct a risk assessment in advance, inform the contractor of the assessed work environment, hazards, and required safety and health equipment and measures, and ensure the contractor implements the assessment results during the contract period.

If the organization conducts the hazard identification and risk assessment first, it can place the risk-control measures planned from those results into the tender documents, purchase requisition, or contract as requirements for selecting contractors. This is more appropriate than waiting until after the contract is signed for the contractor to conduct the hazard identification and risk assessment.

I therefore recommend that the organization itself conduct hazard identification, risk assessment, and risk-control planning for both routine and temporary outsourced work.

Considerations When Selecting Contractors for Outsourced Work

The organization should consider the type of outsourced work and the results of its hazard and risk assessment. In addition to specifying the outsourced items, contractor qualifications, and conditions in tender documents, purchase requisitions, or contracts, it may also include relevant occupational health and safety rules and conditions.

The Contractor Management Technical Guidance considers the following matters appropriate for explicit inclusion in a written contract: 1. safety and health responsibilities and obligations; 2. the occupational health and safety management organization or personnel; 3. occupational health and safety laws related to the outsourced work, the business entity’s own safety and health rules, and specific requirements for preventing occupational accidents or reducing risks; 4. worker qualifications and safety and health education and training; 5. the performance and supervision of occupational health and safety duties; 6. reporting and handling of incidents during outsourcing; 7. safety and health rules for special work; 8. restrictions, qualifications, and requirements for subcontractors; and 9. penalties.

Because this step is similar to procurement, I recommend that the organization’s procurement unit handle the tender documents, purchase requisitions, or contract, as well as the process of evaluating contractors through contract signing.

For outsourced work, the procurement unit may of course actively look for suitable contractors or passively wait for contractors to submit bids.

A good contractor can ensure project quality and safety and health performance, reduce accidents during the contract, and reduce the cost and resources required for contractor control.

The organization can require contractors to submit a work plan and an occupational health and safety management plan based on the organization’s needs, allowing it to select suitable contractors.

To help contractors understand the worksite and prepare an effective plan, the organization can allow them to conduct a site survey before submitting a plan or bid, or hold a briefing to explain the outsourced work in detail.

To prevent price competition between contractors from reducing safety and health equipment and funding, the organization can budget occupational health and safety management expenses separately from the original construction budget.

For contractor-selection criteria, ISO 45001 allows past occupational health and safety performance to be considered. The Contractor Management Technical Guidance goes further by identifying factors that may be considered when selecting contractors, which I have organized in the table below. I recommend that the procurement unit evaluate contractors together with the organization’s occupational health and safety unit and, where necessary, involve senior management.

Coordination Procedures before Contractors Begin Work

After signing the contract with a contractor and before formal work begins, the Contractor Management Technical Guidance requires the person responsible for the contractor work to convene the organization’s relevant personnel, the person responsible for the outsourced work, and occupational health and safety personnel for a coordination meeting.

The meeting should coordinate the following: 1. the division of responsibilities and obligations; 2. the occupational health and safety laws and matters to be followed in the contract and work instructions; 3. routes for people entering and leaving the worksite and their activity areas; 4. controls for vehicles, machinery, and equipment entering and leaving; 5. hazards, protective measures, and emergency response in the workplace and work environment; 6. controls for special work, such as applying for permission to use electricity; and 7. the types and methods of incidents that must be reported.

In addition to holding a coordination meeting before formal work begins, the organization should appoint a responsible person and have that person communicate with the contractor’s responsible person through regular or irregular meetings, especially when worksite or environmental conditions change and the contractor’s cooperation is needed.

I recommend using the communication system established earlier for this purpose. It can connect the organization’s outsourcing representative with the contractor and also connect other workers who may be affected by the outsourced activity.

Management and Supervision during Contractor Work

Management Measures

When a contractor performs work at the organization’s workplace, the organization should accurately track the contractor’s daily work situation, work items, and locations in order to manage the work in progress. It should require the contractor to notify or obtain consent from the supervisor responsible for the relevant area before starting work each day. High-risk work should not begin until approval has been obtained.

The organization should also require the contractor to carry out occupational health and safety measures during the work, including control requirements, risk-control measures, communication with personnel, and incident reporting or handling. It should use patrols, inspections, or audits to ensure that the contractor actually implements these measures. Contractors that fail to follow the relevant safety and health rules should receive different sanctions according to the circumstances and the contract, such as immediate suspension of work, demerit points, or fines.

If an accident occurs during the work, the organization’s control and planning over outsourced work are lower than they are in labor-service procurement. The Contractor Management Technical Guidance therefore requires the contractor to submit an accident-handling and investigation report within a specified period, rather than requiring the organization to handle and investigate the accident itself.

Of course, this does not mean that the organization can completely stand aside. When necessary, it should still provide appropriate assistance.

For management after work, the organization should require the contractor to complete safety checks and housekeeping at the worksite every day before leaving the organization’s workplace. The Contractor Management Technical Guidance includes the following: confirming worksite safety and organizing the environment; safely shutting down machinery and equipment; removing materials and equipment that must leave the workplace; storing materials and equipment that remain according to the organization’s rules; counting personnel before they leave; and obtaining the organization’s approval when personnel need to work overtime.

Before leaving the organization’s workplace, the contractor must report the day’s work progress, situation, and occupational health and safety matters to the organization’s responsible person.

Supervision Measures

The organization’s supervision of contractors can include supervision during the work, supervision after completion, and performance evaluation. The results can be used when deciding whether a contractor should later be prohibited from, restricted from, or prioritized for outsourced work.

For supervision during the work, the organization can adopt different mechanisms according to the seriousness and risk of the outsourced work. It may use continuous supervision in a high-risk work environment and spot supervision or inspections in a low-risk environment. If an occupational health and safety deficiency during the work threatens people’s safety or health, the organization must require improvement and may require work to stop until the improvement is complete.

The organization can of course also evaluate the contractor’s occupational health and safety performance.

The Ministry of Labor’s Contractor Management Technical Guidance provides examples of performance factors the organization may consider:

1. Participation in safety and health coordination meetings and handling of the instructions given at those meetings.

2. Communication and contact between the responsible person and occupational health and safety management personnel and the relevant personnel of the business entity.

3. Preparation of the work plan and safety and health management plan.

4. Implementation of training for new personnel and worksite safety and health education and training.

5. Deployment, presence at the worksite, and performance of duties by personnel with statutory safety and health qualifications.

6. The status of worksite inspections.

7. Establishment and implementation of safe-work standards.

8. Control and safety checks for machinery, equipment, tools, materials, and other supplies.

9. Implementation of sorting, organizing, cleaning, housekeeping, and discipline.

10. Use of personal protective equipment and compliance with safety and health laws and related control requirements.

11. Incident reporting, the number of incidents, and subsequent handling and improvement.

To simplify the process, occupational health and safety performance evaluation can be combined with schedule control, construction quality, and work management. For contractors with short work periods, the evaluation can be conducted after completion. For contractors with longer work periods, occupational health and safety performance should be evaluated regularly.

Acceptance after Contractors Complete the Work

After a contractor completes the outsourced work, the organization should not only check whether the work requirements in the contract have been completed. It must also confirm that machinery, tools, and materials brought in have been safely removed; borrowed machinery and equipment have been returned in full; information about residual risks in the work area has been communicated; and all safety and health management information from the work period has been provided before the contract is closed.

Retaining Documented Information for Contractor and Outsourcing Controls

ISO 45001 requires the organization to retain documented information for its planning, implementation, control, and maintenance processes.

Based on the recommendations in the Contractor Management Technical Guidance, I believe that, in addition to retaining the relevant documented information, the contractor-control records should include: 1. the contractor-management plan; 2. the result of grading the contractor’s safety and health management capability; 3. contractor requirements and the contract; 4. the work plan and safety and health management plan, including the coordination organization, hazardous-work controls, education and training, and emergency response; 5. records of hazard communication, communication, coordination, and meetings; 6. records of routine supervision, inspections, and audits; 7. occupational-accident reports, handling records, and investigation reports; and 8. the results of safety and health management performance measurement and evaluation.

Conclusion

Contracting, outsourcing, and labor-service procurement were some of the terms that confused me most when I first encountered ISO 45001. Fortunately, after reviewing the relevant definitions and combining my legal background with Taiwan’s Contractor Management Technical Guidance, I finally understood how they fit together.

To prevent readers from falling into the same confusion and wondering when to use procurement controls for labor-service procurement and when to use outsourcing controls, I have provided relevant analysis in both the procurement-control and outsourcing-control articles.

Because an organization loses some degree of control when it handles work through outsourcing, readers will find that outsourcing controls depend to a considerable extent on the contractor’s cooperation. That cooperation is necessary for the occupational health and safety management system to work effectively. This is the main reason outsourcing controls must be planned separately from procurement controls for labor-service procurement.

Although ISO 45001 appears to contain more requirements for outsourcing controls than for some other controls, those requirements are still abstract—more like a skeleton of concepts than a fully specified process. I therefore relied on Taiwan’s TOSHMS guidance to put some flesh on this part and turn it into a more complete outsourcing-control process.

These articles have covered most of the planning for controls over non-routine hazards and risks. The final control-planning topic is emergency response: even when routine risk controls reduce risks to an acceptable level, something can still go wrong, so the organization needs a plan for responding to an emergency.

See you in the next article : D.

References

[1] Occupational Safety and Health Administration, Ministry of Labor. TOSHMS Contractor Management Technical Guidance, 2015.

[2] Ministry of Justice, Laws and Regulations Database. Occupational Safety and Health Act, Article 26; law compilation current through August 28, 2026. https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=N0060001

[3] Ministry of Justice, Laws and Regulations Database. Occupational Safety and Health Act, Article 27; law compilation current through August 28, 2026. https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=N0060001

[4] Ministry of Labor. “The New Occupational Safety and Health Act Provisions and 11 Subsidiary Regulations Take Effect Together on July 1: New Systems Focused on Source Prevention and Friendly Workplaces,” July 1, 2026. https://www.mol.gov.tw/1607/1632/1633/93216/