Most principal contractors understand that they need to collect compliance documentation from their subcontractors. Insurance certificates, RAMS, method statements — the admin team gathers these before work starts, files them somewhere, and moves on. What happens when those documents expire six months into a twelve-month project is a different matter entirely.
This is where the gap between having a compliance process and actually managing compliance becomes real.
What the law says about subcontractor management
Under CDM Regulation 8, principal contractors have a duty to plan, manage, monitor, and coordinate the construction phase — including the work of all contractors and subcontractors operating on the site. That duty doesn't end when the subcontractor starts work. It's a continuing obligation throughout the project.
Under the Management of Health and Safety at Work Regulations 1999, you also have a duty to assess the risks from your own undertaking — which includes the activities of contractors working on your behalf. If a subcontractor's work creates a hazard that affects your workers, that's a risk you need to have assessed and controlled.
What this means practically is that "they had their insurance when we started them" is not a complete defence if that insurance has since expired and something goes wrong.
The documentation you need from every subcontractor
Before work starts, you should have:
Employers' liability insurance. Legally required for any employer, minimum cover £5 million (though most policies are £10 million). The certificate must show the company name exactly as it appears on any contract or purchase order — discrepancies between the trading name and the insured entity are common and can create coverage gaps.
Public liability insurance. Covers damage to third parties. Minimum levels vary by trade and project, but £2 million is common for smaller contractors; many clients specify £5 million or £10 million. Check your contract requirements.
Risk assessments and method statements specific to the work they'll be carrying out on your site. Generic RAMS copied from another project don't satisfy this requirement. The assessments need to identify the specific hazards at your site and the control measures that will be applied. You should review and accept these before allowing work to begin — and keep a record showing that you did.
Worker competency documentation. For trades that require certification — scaffolders (CISRS), plant operators (CPCS, NPORS), electricians (Part P, ECS card), asbestos workers (Category C licence) — you should have evidence of current certification for everyone they put on your site.
The expiry problem
Employers' liability insurance policies typically run for twelve months. On a project that runs for twelve months, you'll likely see every subcontractor's insurance expire and be renewed at some point during the works. If you collected their cert in January and it expires in October, and their renewal is delayed, you could have subcontractors operating without valid insurance on your site in November.
This isn't hypothetical. Insurers do impose payment terms. Renewals slip. Some smaller subcontractors have cash flow issues that occasionally delay renewal. The only way to manage this is to have a system that tracks expiry dates and alerts you when something needs to be renewed — not to rely on subcontractors flagging it themselves.
The same applies to individual worker certifications. A CSCS card that was valid at the start of a project may expire mid-project. An operator licence that was current in month one may not be in month eight. On a busy site with multiple subcontractors, tracking this manually across your whole workforce is effectively impossible.
Reviewing RAMS — the step most companies skip
Collecting RAMS is not the same as reviewing them. The review step — where someone with authority and competence looks at the risk assessment and method statement, confirms it's appropriate for the work on your site, and formally approves it — is frequently skipped or done so superficially that it provides no real protection.
Problems that a proper review would catch: RAMS that reference different site conditions to yours (a groundworks RAMS written for open farmland being submitted for an urban basement project), RAMS that don't account for proximity to public areas, RAMS that specify plant or equipment that isn't what the subcontractor is actually going to use, and RAMS for work activities that don't match what you've actually appointed them to do.
A review that results in no questions, no requests for revision, and no formal record of acceptance doesn't look like a review — it looks like rubber-stamping.
Integrating subcontractors into your site safety management
Beyond documentation, CDM requires you to coordinate between contractors. In practice, this means: briefing subcontractors on the CPP and any site-specific rules before they start, including them in toolbox talks where their activities create relevant risks, ensuring there are clear interfaces between trades (especially where working sequences create temporary hazards), and keeping records of all of this.
When subcontractors attend a toolbox talk, their attendance should appear in the record. When a pre-activity briefing is held for a specific high-risk operation, the subcontractor's site supervisor should be there, and that should be documented.
What a working compliance dashboard looks like
The principal contractors who manage subcontractor compliance well typically have some form of single view — either a spreadsheet that's actively maintained (which works at small scale, doesn't scale) or a dedicated system that tracks each subcontractor's documentation status, flags upcoming expiries, and provides evidence of review.
SiteProof includes a subcontractor compliance module that does exactly this: each subcontractor has a profile with their insurance certificates, RAMS, and worker certifications attached, with expiry dates tracked automatically. You get an alert at 30, 14, and 7 days before anything expires, and the compliance dashboard shows at a glance which subcontractors are fully current and which need attention.
When a client or inspector asks about a subcontractor's compliance status, it's not a question you need to answer from memory or go looking for paperwork to support — it's visible on the screen.
Start a free 14-day trial to see how SiteProof handles subcontractor compliance management.