Subcontractor Risk Management Plan: A Practical Guide

A steel-fix crew is pushing towards a concrete pour, but the subcontractor risk management plan is still sitting untouched in the site office. The crew has changed since tender, the work sequence has moved, and another subcontractor now shares the same access route. The paperwork may be complete, yet the controls no longer describe the job in front of the supervisor.

That failure is common across Australian construction and industrial work. Subcontractors make up a substantial part of the workforce. In 2023, Australia had about 1.0 million independent contractors, representing 7.5% of all employed people according to the national review of subcontractor risk. A plan that only works at procurement stage won't control the exposure created by changing crews, interfaces, plant, weather and production pressure.

The practical answer is to treat the plan as a living control system. It should connect prequalification, procurement, SWMS, site coordination, audits, commercial controls and escalation. The document matters, but the update routine matters more.

Table of Contents

• Why Most Subcontractor Plans Fail on Live Sites
  • The recurring failure pattern
• Prequalifying Subcontractors Before They Step on Site
  • Set the evidence standard before procurement starts
  • Verify, don't just file
• Scoring and Tiering Subcontractor Risk
  • Score the work in its site context
• SWMS, Contract Clauses and the Control Hierarchy
  • Review controls in the right order
  • Bind the system through the contract
• Monitoring, Auditing and Monthly Performance Reviews
  • Use a predictable monitoring rhythm
  • Make the monthly review decision-oriented
• Linking the Plan to Your WHS Act Duties
  • Connect each control to evidence
• Keeping the Plan Current When Scope and Crews Change
  • Use trigger reviews, not annual optimism
  • Make updates visible in the field
  • Action the routine this week

Why Most Subcontractor Plans Fail on Live Sites

A subcontractor plan can be approved, filed and still fail during the first shift. The scope may have changed, a different crew may arrive, or another trade may share the same work area. If the plan remains unchanged, the site team is working from evidence that no longer matches the job.

Approval is a control point, not the finish line. Procurement may collect certificates, the project manager may store a generic SWMS, and the subcontractor may mobilise without anyone checking whether the controls still fit the current sequence. Production pressure then exposes gaps that were hidden during tender.

Live sites change quickly. Scope shifts, plant changes, supervisors leave, exclusion zones become contested, and variations introduce high-risk work that was absent from the original package. Surface conditions and weather can also make an approved method unsafe.

Practical rule: If the plan doesn't change when the work changes, it isn't controlling the work.

The evidence points to a serious document-control problem. An RMIT review found that, for construction jobs involving high-risk work, only 29% to 44% had a risk-assessment form uploaded, depending on the state. In one subset, only 6 of 25 jobs involving incidents or uncontrolled hazards had a risk assessment attached in the Australian subcontractor risk review.

The recurring failure pattern

Weak plans commonly show several connected gaps:

• Tender-only scope: The assessment reflects the bid package rather than the issued-for-construction sequence.
• Untested evidence: Documents are collected, but nobody confirms that licences, competencies, insurance and WHS systems match the work.
• Flat oversight: Review effort is the same for every subcontractor, regardless of exposure, complexity or control maturity.
• Detached SWMS: Generic hazards sit in a folder instead of being tested with the crew at the workface.
• No change trigger: The plan does not identify who must review it after a variation, incident, crew change or new interface.
• Commercial blind spots: Payment security, lower-tier subcontractors and financial capacity remain separate from WHS governance.

A Tier 2 subcontractor may replace a leading hand without notifying the principal contractor. That person may have understood the isolation plan, permit system and site constraints. Without an escalation trigger, the control gap can remain hidden until work is underway.

The plan also needs to cover commercial controls. WA government construction audits have examined prequalification, tender risk assessment, payment assurance, financial capacity, business risk assessments and complaint handling for non-payment as outlined by the WA Office of the Auditor General. A working plan therefore functions as both a WHS control and a governance record, with updates tied to changes in scope, people, interfaces and commercial conditions.

Prequalifying Subcontractors Before They Step on Site

Prequalification should be a decision gate. If the evidence doesn't support the scope, the subcontractor isn't ready for award or mobilisation. Price and availability can influence the decision, but they shouldn't override a material control gap.

Set the evidence standard before procurement starts

Build requirements around the actual work package. A subcontractor performing routine low-risk maintenance doesn't need the same evidence as a demolition contractor, crane crew or electrical business working around energised systems.

Require the following before award:

• Insurance: Check currency, policy type, exclusions and limits against the work scope. Don't treat a certificate as proof that every relevant exposure is covered.
• Workers compensation: Obtain the relevant clearance or evidence required in the jurisdiction and confirm it relates to the subcontractor's workforce.
• Trade licences: Verify licences, registrations and high-risk work credentials for the people who'll perform the work, not just the company name on the contract.
• WHS history: Review available incident history, regulator notices, enforcement outcomes, improvement actions and indicators such as TRIFR or LTIFR. A number without context isn't enough. Ask what happened and what changed.
• Safe systems of work: Require written systems for the actual tasks. A generic construction safety policy doesn't demonstrate control of a specific lifting, isolation, demolition or confined-space activity.
• Supervisor competence: Confirm that nominated supervisors understand the work, can interpret the SWMS and have enough authority to stop or resequence it.
• Referees: Contact past PCBUs or principal contractors. Ask how the business responded to corrective actions, whether supervisors were present, and whether the subcontractor reported changes promptly.

The subcontractor management best practices should support a consistent process across procurement, operations and project teams. The important point is ownership. Procurement shouldn't approve a subcontractor on documents that the site team can't use, and the site team shouldn't discover missing evidence after mobilisation.

Verify, don't just file

Call referees and ask specific questions. Compare the proposed supervisor's experience with the work package. Check regulator information where available, and investigate unexplained gaps in incident records or insurance documents.

Use a clear rejection or hold checklist:

1. Scope mismatch: The subcontractor can't demonstrate experience with the actual hazards.
2. Evidence gap: Required insurance, licences, workers compensation evidence or competencies are missing or expired.
3. Weak WHS system: The business can't provide task-specific safe systems or explain how it reviews them.
4. Unresolved history: Serious incidents, regulator action or repeated non-conformances have no credible close-out.
5. Supervision concern: The nominated supervisor lacks competence, availability or authority.
6. Commercial exposure: Financial or lower-tier subcontracting risks haven't been assessed.

A hold isn't automatically a rejection. It means the award decision waits until the risk owner accepts the evidence and records the conditions.

Scoring and Tiering Subcontractor Risk

A tiering model helps a project team spend oversight time where failure would cause the greatest harm. Keep the model simple enough for a pre-award meeting, but structured enough that two reviewers reach broadly similar conclusions.

Score each subcontractor against likelihood, consequence and control maturity. Use a defined scale, such as low, moderate and high, or an internal numeric scale approved by the organisation. The exact scale matters less than consistent application. Weight control maturity heavily because a hazardous scope with weak controls deserves closer attention than the same scope managed by a demonstrably capable team.

A practical calculation is:

Residual risk rating = likelihood × consequence × control-maturity factor

The control-maturity factor should increase the rating when evidence is weak, outdated, generic or untested. It should reduce the rating only when the subcontractor can demonstrate competent supervision, task-specific systems, current evidence and reliable field implementation.

Score the work in its site context

The trade name alone shouldn't set the tier.

• Electrical: Electrical work may sit in a medium tier during isolated installation, then move to high risk where the scope involves live systems, complex interfaces or incomplete isolation information.
• Structural steel: Steel erection may score high where crane lifts, work at height and multiple crews overlap. The rating may be lower for controlled ground-level fabrication away from active construction interfaces.
• Demolition: Demolition usually requires close scrutiny because unknown services, unstable structures, dust, plant interaction and changing conditions can undermine the original method.
• Cranage: A crane crew's risk depends on lift complexity, ground conditions, exclusion zones, communication, weather and the competence of the lift team. The same subcontractor can receive different ratings across projects.

The tier must drive action, not just colour coding:

For organisations building a broader supplier framework, guidance on smarter sourcing decisions can help connect risk scoring with procurement decisions. Don't let the procurement score replace the WHS assessment. A low commercial risk rating doesn't make a hazardous task safe.

SWMS, Contract Clauses and the Control Hierarchy

A SWMS is the operational anchor for high-risk construction work. Safe Work Australia requires a SWMS before that work starts, and the document must identify the activities, hazards and controls. The PCBU must keep the SWMS, ensure workers comply with it, review it when necessary and provide it to the principal contractor under the Safe Work Method Statement information sheet.

Reject a SWMS that describes the tender scope but not the actual task. It should name the high-risk construction work triggers under the WHS Regulations, identify site-specific hazards and show how controls will work in sequence.

Review controls in the right order

The hierarchy of controls isn't a formatting exercise. It determines whether the subcontractor has tried to remove the hazard before relying on worker behaviour.

1. Eliminate: Remove the hazardous activity or avoid entering the exposure zone.
2. Substitute: Use a safer material, process or plant.
3. Isolate: Separate people from the hazard with distance, barriers or controlled access.
4. Engineer: Use guarding, interlocks, mechanical handling or other physical controls.
5. Administer: Apply permits, sequencing, supervision, training and communication.
6. PPE: Use personal protective equipment as the final layer, not the primary solution.

A SWMS that jumps straight to hard hats, gloves and awareness training hasn't demonstrated adequate control thinking. The review should test what the crew will do, where they will stand, who controls the interface and what condition requires the job to stop.

Bind the system through the contract

Contract clauses should require compliance with site rules, incident notification, access for the safety team, document updates, supervisor attendance and corrective-action close-out. They can also define consequences for repeated non-conformance, including scope reduction, suspension or recovery of reasonable costs where the contract allows it.

Take an electrical subcontractor submitting a SWMS for live cable work. The method should sequence isolation, lockout and tagout, testing for dead and verification before a worker enters the enclosure. It should identify the nominated spotter, define the isolation boundary and require the isolation register to be signed off by the site supervisor.

Walk through that SWMS with the crew at the prestart. The project manager's approval at head office isn't enough. The people doing the work must understand the sequence and challenge controls that don't match site conditions. Practical guidance on what a Safe Work Method Statement is can help standardise that review.

Monitoring, Auditing and Monthly Performance Reviews

A subcontractor risk management plan only earns credibility through field verification. Use three monitoring layers, each with a different purpose. Daily observations test behaviour and conditions. Scheduled audits test the management system. Monthly reviews test whether the relationship should continue at its current level of scope and oversight.

Use a predictable monitoring rhythm

Supervisors should record short field observations and discuss findings with the subcontractor supervisor immediately. Check the work against the approved SWMS, access and exclusion controls, plant condition, housekeeping and interaction with other crews. Don't turn every observation into a lengthy report. Capture the fact, action, owner and due date.

Scheduled audits need more depth. Sample the SWMS against what workers are doing, check licence and training currency, inspect plant registers, review permits and compare incident reports with what the crew and supervisor observed. A document can be current while the field control has drifted.

The Office of the Federal Safety Commissioner recorded 278 corrective action requests for FP4, Management of Subcontractor WHS, with a 7.5% issue rate in its 2021 data report. The same report recorded 33.2% of companies affected by that criterion, showing why subcontractor controls need active verification rather than document collection alone in the Federal Safety Commissioner data report.

Make the monthly review decision-oriented

Bring together lagging indicators, such as TRIFR, LTIFR, near misses and audit non-conformances, with leading indicators, such as SWMS quality, prestart attendance and supervisor engagement. Review safety alongside quality, schedule and cooperation. A subcontractor that repeatedly ignores interface instructions may create WHS exposure even when its incident record looks clean.

Escalation may mean closer supervision, a corrective-action plan, reduced scope or removal from site. Keep the cadence predictable. Subcontractors should know the standard every week, not only when an audit team arrives.

Linking the Plan to Your WHS Act Duties

A defensible plan maps each control to a duty, responsible person and verification record. That turns the document from a collection of preferences into evidence that the PCBU identified risk, allocated responsibility, implemented controls and reviewed performance.

Under section 19 of the WHS Act, a PCBU has the primary duty to ensure, so far as is reasonably practicable, that workers and other persons aren't exposed to health and safety risks arising from the business or undertaking. Safe Work Australia's construction guidance also requires PCBUs to identify, assess and control hazards, starting with elimination where reasonably practicable in the model Code of Practice for Construction Work.

Connect each control to evidence

The plan should show:

• Primary duty: Prequalification, SWMS review, supervision and field verification.
• Principal contractor responsibility: Project WHS management plan controls, site coordination and subcontractor procedures.
• Consultation: Prestarts, toolbox meetings, worker feedback and interface planning with subcontractor workers.
• Incident response: Immediate notification clauses, investigation responsibilities and corrective-action tracking.
• Officer due diligence: Approval records, review minutes, resourcing decisions and evidence that officers tested whether controls worked.

Where the organisation acts as principal contractor, section 20 requires a WHS management plan for the construction project. Subcontractor controls should feed into that plan, rather than sit in a separate procurement file.

Sections 46 to 49 cover consultation duties, including consultation with workers who may be affected by the work. Section 270 and the WHS Regulations establish notifiable incident reporting requirements, so subcontractor clauses should require immediate notification. That gives the principal contractor a chance to assess the event and meet its own reporting obligations.

Section 29 due diligence obligations apply to officers. A signature on the cover page isn't enough. The record should show who reviewed the risk, what information they considered, which actions were assigned and when the controls will be tested. The responsibilities of a PCBU provide a useful reference point when assigning those accountabilities.

Keeping the Plan Current When Scope and Crews Change

The assumption that a plan remains valid because nobody has changed the file is unsafe. A scope variation, new crew or changed environment can invalidate the risk assessment without changing the document title.

A living subcontractor risk management plan needs a named owner with authority to stop work and require an update. That owner should maintain the tier register, coordinate the trigger review and confirm that revised controls reach the people doing the work. The project manager, WHS lead and subcontractor supervisor each have defined responsibilities, but one person must own the system.

Use trigger reviews, not annual optimism

Run a weekly trigger review against the programme, look-ahead schedule and site conditions. Ask what has changed since the last review:

• Scope or design: Has a variation, drawing revision or changed sequence introduced a new hazard?
• Crew mobilisation: Has a new subcontractor, supervisor, labour-hire group or lower-tier crew arrived?
• High-risk work: Has the project added demolition, lifting, excavation, work at height, energised systems or another high-risk activity?
• Environment: Have weather, ground conditions, access, neighbouring operations or simultaneous work changed?
• Performance: Has an incident, near miss, failed audit or repeated breach shown that the existing control isn't reliable?
• Legal requirements: Has a regulatory or client requirement changed the control standard?
• Crew turnover: Has turnover exceeded the organisation's defined threshold, making the competence assumptions in the plan unreliable?

The percentage threshold for crew turnover should be defined by the business before the project starts. The point isn't to find a universal figure. It's to create a trigger that supervisors can apply without waiting for a serious event.

Make updates visible in the field

Retire obsolete SWMS rather than leaving multiple versions in circulation. Mark the current version, brief affected workers, record attendance and test understanding through questions or observation. Update the subcontractor tier register when scope or control maturity changes.

A practical refresh cycle looks like this:

1. Weekly trigger review: The plan owner checks changes in scope, crews, interfaces and conditions.
2. Interim update: The responsible supervisor revises the affected risk assessment, SWMS, permit or coordination control.
3. Field verification: The WHS lead or supervisor confirms the revised control is operating.
4. Monthly performance review: The project team checks whether the subcontractor's tier and oversight remain appropriate.
5. Quarterly deep audit: The organisation reviews the full evidence set, including procurement records, contracts, licences, insurance, incidents, audits and close-out history.

Action the routine this week

Don't start by rewriting the entire binder. Start by fixing ownership and trigger discipline.

• Reassign plan ownership: Name the person accountable for updates, approvals and escalation.
• Schedule the next trigger review: Put the weekly review on the project calendar and link it to the look-ahead programme.
• Retire obsolete SWMS: Remove superseded versions from shared folders, noticeboards and crew packs.
• Update the tier register: Recheck each subcontractor against current scope, interfaces and control maturity.
• Confirm escalation contacts: Verify who receives incident notifications, failed audit results and urgent scope changes.
• Check lower-tier visibility: Confirm that Tier 2 subcontractors and replacement supervisors are captured in the approval process.

Use a digital system, spreadsheet or controlled document register that the site team will maintain. Safety Space offers configurable contractor management, document collection, subcontractor oversight and real-time health and safety records for teams replacing paper and disconnected spreadsheets. Visit Safety Space to review how it can support a current, evidence-based subcontractor risk management plan across your sites.