Contractor compliance checklist UK 2026: what to check before anyone works for you

Bringing a contractor or subcontractor onto a site or into a portfolio without checking them properly is how uninsured work, rejected RAMS and awkward client questions happen — usually all at once, and usually at the worst possible moment. A good compliance check is not bureaucracy for its own sake; it is the difference between knowing the people working for you are insured, competent and legal, and merely hoping they are. This checklist covers what to confirm before anyone lifts a tool for you, why each item matters, the traps that catch people out, and — the part most guides skip — how to keep the whole thing current after day one, because a check done once and never repeated is worth very little.

Before they start: the full checklist

Here is the ground to cover. Read past the list — the detail under each item is where the real risk lives.

Public liability insurance

Ask for the certificate or policy schedule, not a verbal assurance. A genuine document names the insurer, the policyholder, the type and level of cover, the policy number and — crucially — the dates. Check three things. First, that it is current and not expired. Second, that the policyholder's name matches the business you are actually dealing with; a certificate in a slightly different name (a related company, or an individual rather than the trading name on the quote) is a red flag worth questioning directly. Third, that the level of cover sensibly matches the job. A one-million-pound policy may be fine for a small internal job but light for major work next to a neighbour's property, where a single incident could cause damage well beyond that figure. And read the schedule for exclusions: some policies exclude work at height above a certain level, hot works such as welding or torch-on roofing, or work involving asbestos. If your job sits inside an exclusion, the cover is not really cover.

Employers' liability insurance

If the contractor employs anyone — including labourers, apprentices or subcontracted labour treated as employees — employers' liability insurance is a legal requirement, and the standard minimum cover is five million pounds. Confirm it exists and is in date. A common gap: a contractor's own policy may not extend to independent subcontractors they bring in alongside them, so ask specifically how cover works for anyone else who will be on site under their control.

RAMS — and whether they actually fit

A risk assessment and method statement should be for this trade and this scope, not a generic template with the company name changed. This is where "present" and "adequate" diverge most often. A RAMS can be a real, professional-looking document and still be wrong for your job — written for a different trade, missing the specific hazards of your site, or listing controls that do not match the actual conditions. Read it against the work: does it name the real hazards, is the method plausible for this site, are the controls proportionate? A RAMS that could have been for any job on any site is a warning sign, not a reassurance.

Accreditations

CHAS, SMAS, SafeContractor and Constructionline are the common third-party accreditations, and many clients and principal contractors require one before you can even bid. Check the accreditation is current, in the right name, and at the level the contract demands. Remember what an accreditation is and is not: it is evidence that a contractor passed a standardised health and safety assessment at a point in time. It is not a substitute for checking that this contractor is right for this job — it is one input, not the whole decision.

Qualifications and cards

CSCS, CISRS, IPAF, first aid and trade-specific tickets should be in date and — this is the part that gets missed — held by the people who will actually be on site, not just by the company owner who quoted. A contractor with impeccable credentials who sends an unqualified crew has not met the standard. Ask whose cards you are being shown and whether those are the people attending.

Right to work

Confirm right to work for the individuals working for you where that responsibility sits with you. The checks are quick, the penalties for getting it wrong are not, and it is far easier to build the check into onboarding than to unpick it later.

References

For a new contractor on significant or higher-risk work, ask for evidence they have done comparable work well before. A short conversation with a previous client tells you things no certificate can — whether they turned up, whether they cleaned up, whether the paperwork matched the work.

Checking, not just collecting

The most common and most dangerous mistake in the whole process is treating collection as compliance. It is easy to feel productive gathering a folder of PDFs from every contractor, and to mistake the folder for safety. But every item above has to be checked for validity, scope and date — not just filed. An expired certificate looks identical to a valid one in an inbox. A RAMS for the wrong trade reads perfectly well until you look closely. Insurance can be genuine, current, and still only cover half of what your job needs. The folder tells you documents arrived; it does not tell you they are any good. This is precisely the work that contractor compliance software takes off your hands: it reads each document against the job and returns a verdict, so "present" is never mistaken for "adequate".

A worked example of how it goes wrong

Consider a common scenario. You engage a roofing subcontractor for a domestic extension next to a neighbouring property. Their paperwork looks complete: a public liability certificate, a RAMS, a CSCS card, a current CHAS accreditation. You file it and they start. Three weeks in, a slate falls and cracks the neighbour's conservatory roof. Now the details matter. The public liability policy turns out to be one million pounds — fine in principle, but the schedule excludes work at height above three metres, and the roof was higher. The RAMS was a generic roofing template that never mentioned the proximity of the neighbouring structure or the exclusion zone that should have been in place. The CSCS card belonged to the owner, who was not on site that day. Every document was present. None of them, checked properly against this job, would have passed. That gap — between present and adequate — is the entire reason the checklist has to be a checking exercise, not a collecting one.

Keeping it current: the check is a standing position, not an event

Insurance renews. Cards expire. Accreditations lapse. A contractor who was fully compliant when you onboarded them can drift out of compliance halfway through a long job without anyone noticing, because nothing changed visibly — the certificate in your folder still looks fine; it just quietly stopped being valid. This is why the checklist is not a one-off gate but a standing position. Track every renewal date, watch for what is expiring, and re-request documents before they lapse rather than after. For a single contractor you might manage this by memory. For a supply chain of any size, keeping it current by hand is exactly the part that fails — which is the argument for a live view of every contractor's status that updates itself and warns you in advance.

For principal contractors and property managers

If you run subcontractors across several sites, fold this checklist into your onboarding so it happens every time, the same way, before work starts — consistency is what stops the busy week producing an unchecked contractor. And keep the evidence, because you will need to produce it for CDM duties and client pre-start checks. Subcontractor management software organises the whole supply chain around exactly these checks, site by site, and shares the verification engine behind contractor compliance software. Property managers face the same job across a portfolio of trades: the checklist is identical, only the setting changes.

The short version

Confirm insurance (public and employers', at the right level, for the right work, in date), a job-specific RAMS that genuinely fits, the accreditations the contract requires, qualifications and cards held by the people actually attending, right to work, and references for significant work. Check every item rather than filing it. Then keep it all current, because compliance is a state you maintain, not a box you tick once. Do that and the awkward questions — from clients, from principal contractors, from your own conscience after an incident — all have good answers.