Most problems with subcontractor compliance happen at the start — documents not collected, checks not run, assumptions made because a subcontractor "seemed professional." By the time the issue surfaces (an audit, a near-miss, an insurance claim), the moment to fix it has long passed.
Getting subcontractor onboarding right is a straightforward process once the document list is clear. This guide covers what to collect, in what order, and why each item is either legally required or standard good practice.
Why onboarding compliance matters
Under CDM 2015 Regulation 8, principal contractors must satisfy themselves that every contractor they appoint has the skills, knowledge, experience, and organisational capability for the work. This is a substantive legal duty — not a form-filling exercise — and the evidence must exist before the subcontractor starts work.
The Employers' Liability (Compulsory Insurance) Act 1969 separately requires every employer to hold valid EL insurance. If a subcontractor's operatives are working on your site without it, you appointed them knowing the risk.
And the Construction Industry Scheme requires you to verify CIS status before making any payment. An incorrect deduction rate — even through honest error — creates a liability for your business, not the subcontractor's.
These are not compliance bureaucracy. Each document serves a legal purpose.
The document list
Organise collection in three categories: legally required, standard good practice, and project-specific.
Legally required (must have before work starts)
1. Employers' liability insurance certificate
Required under the Employers' Liability (Compulsory Insurance) Act 1969. Every employer with employees must hold at least £5 million cover. Check:
- Certificate is current (has not expired)
- Insured entity name matches the company you are contracting with
- Cover level is at least £5 million
A photocopied or scanned certificate is acceptable. What matters is the expiry date — track it. Our free insurance expiry calculator can hold renewal dates for your entire subcontractor list and alert you 30, 14, and 7 days before expiry.
2. CIS verification record
Before making the first payment, verify the subcontractor's CIS status through the HMRC Construction Industry Scheme online service. Record and retain the verification reference number, date, and the deduction status returned (gross / 20% / 30%).
Do not rely on the subcontractor's own statement of their CIS status. The verification must come from HMRC.
3. Risk assessments and method statements (RAMS)
Under CDM 2015 Regulation 15, principal contractors must ensure contractors have the information they need to carry out the work safely. Site-specific RAMS that address the actual hazards on your project are required before work starts.
Check the RAMS against your construction phase plan. If they reference hazards not relevant to your site, or fail to address hazards that are present, return them for revision.
4. CDM competence evidence
Under CDM 2015 Regulation 8, you must be satisfied the subcontractor has the necessary skills, knowledge, and experience. A structured prequalification questionnaire is the standard approach — our free contractor PQQ template covers the categories you need.
Competence evidence typically includes CSCS card types for all operatives, trade qualifications, and evidence of the subcontractor's health and safety management (health and safety policy, recent audit results, or accreditation scheme membership).
5. Company health and safety policy
Any employer with five or more employees must have a written health and safety policy under Section 2(3) of the Health and Safety at Work etc. Act 1974. Requesting it confirms the subcontractor has met this basic obligation. For smaller firms (fewer than five employees), no written policy is required but the underlying safety management obligations still apply.
Standard good practice (strongly recommended)
6. Public liability insurance certificate
Not legally mandated in the same way as EL insurance, but required by most principal contractors as a commercial condition of appointment. Confirm the level of cover required by your contract and that the subcontractor's policy meets it. Standard levels in construction are £1 million, £2 million, or £5 million per occurrence depending on project scale.
7. Professional indemnity insurance (where applicable)
Relevant for subcontractors with design responsibility — specialist contractors producing working drawings or structural calculations, for example. Check your sub-contract to confirm whether PI is required and at what level.
8. CSCS card list for all operatives
A list of operatives expected to work on site, with their CSCS card types and expiry dates. This gives you a baseline for the site induction check and allows you to identify gaps before operatives arrive — rather than turning someone away on the day they're expected to start.
9. Trade-specific certifications
For specialist trades, check certifications before work starts:
- Gas Safe registration (gas work)
- NICEIC or NAPIT registration (electrical work)
- IPAF/PASMA cards (powered access, mobile scaffolding)
- Asbestos awareness training certificates (any work on pre-2000 buildings where asbestos may be present)
- Confined space training (where relevant)
These are not CDM requirements in isolation, but they form part of your Regulation 8 competence evidence for these trades.
10. Previous health and safety performance
Any record of enforcement action, prohibition notices, or HSE prosecutions in the past three years is relevant to the Regulation 8 competence assessment. Prequalification questionnaires typically ask for this directly.
Project-specific (dependent on the work)
11. Environmental management (for projects with environmental conditions)
CSCS environmental card or equivalent evidence of environmental awareness training — required on projects where the principal contractor's environmental management plan covers activities that require it.
12. Waste carrier registration
If the subcontractor will be removing waste from site, they must hold a current waste carrier registration with the Environment Agency (or Natural Resources Wales). A registered carrier number can be verified online.
13. Relevant structural or mechanical certification
Plant certificates (LOLER thorough examination for lifting equipment, PUWER for work equipment), scaffolding inspection records, or pressure testing certificates — depend on the work scope and should be specified in the sub-contract.
How to manage the collection process
Use a standard checklist for every subcontractor. A bespoke document request for each appointment is how things get missed. A standard PQQ that covers the core categories — and is reviewed once per year to reflect any changes in legal requirements — ensures consistency.
Set a completion condition before appointment. The PQQ and mandatory documents should be returned before the subcontractor's appointment is confirmed, not chased during the project. If collection is treated as pre-condition rather than formality, compliance rates are significantly higher.
Centralise storage and track expiry dates. Documents held in different locations — email inboxes, shared drives, site filing cabinets — cannot be monitored for expiry. A central register, with expiry date columns and alert settings for EL and PI certificates, is the practical minimum. You can generate a compliance checklist for your specific project to structure this.
Induct every operative individually. Site induction is the point at which you confirm CSCS card types for individual operatives and give them the site-specific health and safety information required by CDM 2015. A general induction for the subcontractor company does not satisfy this requirement. Every person who sets foot on site as a worker should have received the induction before starting work.
Revisit documentation when scope changes. If a subcontractor takes on additional work outside the original appointment — different trade type, different area of the site — the original documentation may not cover the new scope. Request RAMS for the additional work before it starts.
What happens when a gap is identified
If a document is missing or expired when a gap is identified during the project, the decision is binary: pause the affected work until the gap is resolved, or accept a documented risk.
Accepting a documented risk requires recording: what the gap is, what risk it creates, what mitigation (if any) is in place, and who has authorised the decision. This is a last resort for minor issues — a subcontractor whose PL insurance renews next week and who has provided evidence the renewal is in hand. It is not appropriate for missing EL insurance, unverified CIS status, or absent RAMS.
For the broader CDM compliance framework that these onboarding requirements sit within, see our CDM compliance guide. For the specific checks required throughout the project (not just at onboarding), see our subcontractor compliance checklist.
SubComply automates document collection, chases subcontractors for renewals, and tracks expiry dates across your contractor list — so you're not managing it in spreadsheets.
Sources
- The Construction (Design and Management) Regulations 2015 (SI 2015/51), Regulation 8
- Employers' Liability (Compulsory Insurance) Act 1969
- Health and Safety at Work etc. Act 1974
- HSE — CDM 2015 guidance
- HMRC — Construction Industry Scheme (what it is and how it works)
This guide is for informational purposes and does not constitute legal advice. For project-specific compliance questions, consult a qualified health and safety professional.
Last reviewed: 5 August 2026