On this page
The short version
- Clause 8.1.4.2 mandates coordinating procurement processes with contractors to evaluate and control cross-activity health and safety risks.
- Clause 8.1.4.3 requires organisations to ensure outsourced functions and processes conform to legal requirements and management system outcomes.
- Contractors perform activities at workplace locations, whereas outsourced processes involve external organisations performing system functions.
- Internal auditors must verify health and safety criteria in contractor selection and defined control levels for outsourced processes.
Background, Regulatory Context, and Affected Roles
ISO 45001 establishes an operational framework requiring organisations to manage health and safety risks throughout their supply chain and extended workforce. Modern organisations increasingly rely on external service providers, specialist contractors, and outsourced service partners to perform critical operational activities. Consequently, Clause 8.1.4 mandates established, implemented, and maintained procurement processes to control products, services, contractors, and outsourced functions. Quality managers, compliance leads, and internal auditors must understand the distinct operational control requirements applied to contractors versus outsourced processes.
This operational scope impacts top management, procurement leads, facility managers, internal auditors, and non-managerial workers. Failing to establish clear boundaries and control mechanisms for external workers exposes organisations to unmanaged workplace hazards, legal non-compliance, and severe incident liabilities. ISO 45001 addresses these vulnerabilities by establishing explicit procurement rules for contractors under Clause 8.1.4.2 and outsourced processes under Clause 8.1.4.3. Internal auditors must verify that operational controls match the specific risk profile of the external arrangement.
Technical Nuances: Contractors Versus Outsourced Processes
Understanding the distinction between contractors and outsourced processes relies on standard definitions and operational scopes. Clause 3.29 defines an outsourced process as an arrangement where an external organisation performs part of an organisation's function or process. The external organisation resides outside the management system scope, whereas the function or process itself remains within the system scope. Conversely, a contractor is an external organisation providing services to the organisation in accordance with agreed specifications, terms, and conditions, operating on-site or within operational boundaries.
Under Clause 8.1.4.2, organisations must coordinate procurement processes with contractors to identify hazards and assess risks arising from three specific interactions. These include contractor activities impacting organisation workers, organisation activities impacting contractor workers, and contractor activities impacting other interested parties. Furthermore, the organisation must define and apply occupational health and safety criteria when selecting contractors, ensuring that contractor workers comply with management system requirements.
Under Clause 8.1.4.3, organisations must ensure that outsourced functions and processes are controlled to achieve intended management system outcomes. The organisation must guarantee that outsourcing arrangements conform to legal requirements and other requirements. Unlike contractor management, where the organisation exerts direct physical supervision, the type and degree of control applied to outsourced processes must be defined within the management system based on risk level, technical capability, and shared operational controls. Non-managerial workers must be consulted when establishing procurement, contractor, and outsourcing controls under Clause 5.4 d) 7).
| Feature | Clause 8.1.4.2 Contractors | Clause 8.1.4.3 Outsourced Processes |
|---|---|---|
| Definition and Scope | External providers offering services according to agreed specifications on-site or in operations | External organisations performing a full function or process within system scope |
| Primary Hazard Focus | Physical workspace interactions, shared equipment, multi-employer worksite risks | Function execution risks, compliance with legal requirements, systemic output quality |
| Selection Criteria | Mandatory health and safety selection criteria defined and applied prior to contract award | Evaluation of provider capabilities, legal compliance, and system alignment |
| Control Mechanisms | Direct operational controls, site inductions, work permits, joint safety coordination | Contractual requirements, performance monitoring, periodic audits, defined control levels |
Audit Evidence and Verification Methods
Internal auditors must gather distinct audit evidence when evaluating compliance across Clause 8.1.4.2 and Clause 8.1.4.3. To verify contractor control under Clause 8.1.4.2, auditors must inspect procurement selection records, site orientation logs, joint risk assessments, and pre-work safety permits. Auditors must interview line supervisors and contractor personnel to confirm that multi-employer safety coordination occurs effectively in daily operations.
For outsourced processes under Clause 8.1.4.3, auditors must verify that the management system explicitly defines the type and degree of control applied to external providers. Evidence must include service level agreements containing health and safety performance indicators, compliance monitoring reports, and third-party audit records. Organisations may utilise contractual clauses, competency assessments, or joint process reviews to demonstrate adequate control over outsourced functions.
| Focus Area | Clause Reference | Mandatory Requirement | Core Audit Evidence |
|---|---|---|---|
| Procurement Criteria | Clause 8.1.4.2 | Define and apply health and safety selection criteria for contractors | Contractor pre-qualification files, safety scoring criteria |
| Multi-Employer Coordination | Clause 8.1.4.2 a)-c) | Coordinate processes to identify and control cross-activity hazards | Pre-job hazard reviews, work permits, joint safety meetings |
| Outsourcing Governance | Clause 8.1.4.3 | Ensure outsourced processes conform to legal requirements and controls | Service contracts, legal compliance reviews, supplier audits |
| Worker Consultation | Clause 5.4 d) 7) | Consult non-managerial workers on procurement and contractor controls | Consultation records, committee minutes, worker feedback logs |
What to do now
- Review procurement procedures to ensure health and safety criteria are defined and applied during contractor selection.
- Update risk assessment procedures to mandate joint hazard identification for contractor activities on multi-employer worksites.
- Audit the management system register to confirm that all outsourced functions and processes are identified with defined control levels.
- Inspect service level agreements for outsourced processes to verify that legal compliance duties and safety performance parameters are specified.
- Conduct joint site inspections and contractor interviews during internal audits to verify that operational controls are actively enforced.
Reference documents
- BS ISO 45001:2018 Occupational health and safety management systems -- Requirements with guidance for use
Manage this work in 4Auditee
Keep audit plans, problems, corrective actions and document versions in one place. See the records behind each change and decision.
Book a demo