ISO 45001:2018 · clause 8.1.4
Anyone working on your site is working inside your management system.
ISO 45001 gives procurement its own clause, split into general procurement, contractors and outsourcing. That is unusually explicit for a management system standard.
The reason is uncomfortably concrete: a substantial share of serious workplace accidents involves external firms. The standard therefore requires procurement to settle health and safety requirements before award – not at the incident.
Contractors add coordination: hazards arising from working alongside each other must be identified and controlled jointly. Where functions are outsourced, responsibility stays with the outsourcing organisation.
Where it breaks in practice
- External firms without documented safety instruction before their first shift.
- Qualification records such as welding or operating certificates that have expired.
- Coordination duties between firms working in parallel that nobody records.
- Outsourcing where it is unclear who owns the hazard assessment.
What the standard requires
- 8.1.4.1
- Establish and control procurement processes so that health and safety requirements are met.
- 8.1.4.2
- Coordinate procurement with contractors; identify and control hazards from their activities.
- 8.1.4.2
- Include health and safety criteria in contractor selection.
- 8.1.4.3
- Control outsourced functions and processes; responsibility remains with the organisation.
- 7.2
- Ensure required competence and retain evidence – for external personnel too, where applicable.
How SCRM covers it
Contractor file
Instruction, qualifications and clearances per firm and assignment, with expiry.
Selection criteria
Safety metrics as part of the scoring scheme, not a gut feeling.
Incidents on the supplier
Events recorded where they feed the next selection decision.
Due dates
Expiring qualifications appear as a task before anyone enters the site.
Frequently asked
Does this apply to one-off assignments?
Yes. The standard distinguishes by hazard, not duration. An hour on a machine can trigger more than a week of office work.
Who owns the hazard assessment when we outsource?
Responsibility for control stays with you. How deeply you verify is a risk decision – one that should be reasoned.
How does it relate to ISO 9001?
Both share the same structure and ask about the same external providers. The criteria differ; the underlying data does not.