How to build and maintain an approved contractor list

Build an approved contractor list with clear scope, risk-based evidence, decision ownership, review triggers and a practical example. Understand what the list does not prove.

An approved contractor list is a record of suppliers your organisation has decided may be considered for defined kinds of work. The useful part is the decision behind each entry: what work was assessed, what evidence was reviewed, who approved it, which conditions apply and when the position needs another look. A list of company names without that context can give false confidence.

The term “approved contractor” is usually an internal procurement and risk-management label. It is not a universal UK licence or a legal status granted by placing a business in a spreadsheet. A contractor approved for low-risk painting work is not automatically suitable for work on a roof, electrical installation or a live production line. Approval also does not authorise entry to a particular site or remove the need to plan, coordinate and supervise a job.

This guide shows how to set up a list that people can use. It covers selection evidence, approval scope, review triggers, suspended status and a worked record. It does not replace a prequalification assessment, a construction appointment decision or a site induction. If you are comparing platforms to manage these records, ask each vendor to demonstrate invitation, document collection, review and decision steps in the current released product.

Decide what the list is for before choosing fields

Start by defining the decisions the list must support. Do project managers use it to identify a company to invite to quote? Do site managers check whether a contractor is already assessed for a category of work? Does procurement use it to see which evidence needs review? Those are different tasks. A list that tries to answer all three with a single “approved” tick will soon become unreliable.

Specify the work categories you will use. They might be routine grounds maintenance, general building repair, roof work, electrical work, specialist surveying or plant maintenance. The categories should follow the work you commission, not a generic supplier taxonomy. Add enough description that a user can tell whether a proposed job falls within the approved scope. “Building works” may be too broad if the same organisation undertakes both decorating and structural alteration.

Next decide who can approve or change an entry. An administrator may collect files, but the approval decision may belong to a procurement lead, contract manager or person with suitable technical knowledge. Separate collecting evidence from deciding what it means. Where the work has unusual hazards, the person making the decision may need specialist input. A document management system can show that a file exists; it cannot decide whether the contractor has the skills and systems for the job.

Define the outcome states before you populate the list. “Approved within scope”, “conditional”, “under review”, “suspended” and “not selected” are clearer than a single yes/no. A conditional entry should state the condition and the person responsible for clearing it. A suspended entry should stay visible to prevent a user from accidentally treating an old approval as current. The wording and fields are practical choices, not statutory labels.

Match the checks to the work and the risk

The Health and Safety Executive's contractor guidance describes selection, coordination, induction, supervision and review as parts of contractor management. That sequence is a useful reminder that the approved list is one part of a wider process. The checks you make before appointment should be proportionate to the nature and complexity of the proposed work.

For a simple, low-risk service, relevant experience, an agreed scope and basic insurance information may be enough to start a decision. For work involving height, lifting equipment, hazardous substances or a complex interface with your own workers, ask more targeted questions. Who will supervise the work? What similar jobs has the business completed? What equipment and competent people will it use? How will it control the significant hazards? The answers should inform the decision rather than merely fill a document folder.

Construction work has a specific legal context in Great Britain. CDM 2015 regulation 8 says a person appointing a designer or contractor to work on a project must take reasonable steps to satisfy themselves that the appointee has the skills, knowledge, experience and, for an organisation, organisational capability needed for its role. The HSE's construction guidance describes examples of evidence and stresses that what is needed should reflect the complexity and risks of the project. Northern Ireland has separate CDM regulations; do not apply this Great Britain citation as if it were the single UK rule.

The legal duty is not to maintain one standardised approved contractor spreadsheet. Nor is an accreditation logo a universal answer. Third-party assessments and references can be useful evidence, but the appointing organisation still needs to consider the contractor for the actual role and work. A list should record the scope of the decision so that an earlier assessment can be reused appropriately without being stretched beyond what it covered.

Build a record that explains the decision

The core fields should answer five questions: who is the contractor, for what work was it assessed, what evidence was considered, who made the decision and what would cause a review? Add a company identifier or trading name so two similar suppliers cannot be confused. Record a principal contact for administration, but do not make one person's phone number the only way to find the supplier record.

Describe the approved category in practical terms. “Internal painting and minor finishing work at occupied offices” is more useful than “property services”. Add exclusions where a user might assume too much: no roof access, no structural work or no electrical isolation, for example. These are internal scope decisions, not claims that a contractor is incapable of doing other work. The contractor may be considered for a broader role after a separate review.

Log the evidence reviewed with dates and sources. This might include a company description, named experience, relevant qualifications, insurance information, references, examples of safety arrangements and any role-specific licensing. Record who checked each item and what conclusion they drew. Avoid treating an uploaded certificate as independently validated unless a person actually checked it with the issuing body or another authoritative record where needed.

Record the decision and any condition in plain language. “Approved for routine painting work at office sites, subject to current insurance evidence before each appointment” is more actionable than “approved”. If the approval requires a named competent supervisor or a particular method for working in occupied areas, record that. State the review trigger or date and the person who owns the next review.

Protect the record from silent changes. A user should be able to see why an entry was approved, who changed the scope and when a concern led to suspension. This does not require a complicated workflow for a small business. A controlled register with a change log may be enough. The important feature is that the person choosing a contractor can trust the current status and find the supporting reasoning.

Example approved contractor entry

Imagine a facilities team considering Northside Decorating Ltd for internal painting at several offices. It has completed comparable jobs and supplied current insurance information. The team has reviewed its proposed method for working around staff and visitors. It has not assessed the company for roof coating or structural repairs.

This is an editorial example, not a model legal approval. The facilities team would need to check the real company and job before making a decision. The example deliberately keeps the list decision separate from work authorisation. The same contractor might be invited to quote for a roof task, but the earlier internal-painting approval would not settle its suitability for that task.

Separate prequalification from permission to start

One common failure is using an approved list as a site-access list. Prequalification asks whether the organisation appears suitable for a category of work. Appointment asks whether it is suitable for a particular role and contract. Before work starts, the parties still need to exchange information, plan the task, address interfaces, give any induction and apply the controls required at that site.

The HSE's guidance for businesses using contractors describes defining the job, selecting a suitable contractor, assessing work risks, sharing information and managing the work. Its general process remains useful, although an older leaflet linked from it references superseded CDM rules. For current Great Britain construction legal detail, use CDM 2015 and current HSE CDM pages instead.

At job level, ask who is controlling the work area. What hazards does the site create for the contractor? What hazards will the contractor introduce for others? Who coordinates shutdowns, traffic routes or simultaneous work? What information does the contractor need from the client? An approved list cannot answer those questions once for every future job. The answer may change with the site, timing and people involved.

Make the handoff explicit in your workflow. The list might let a project manager identify a contractor within scope. The project file then records the actual appointment, risk information, agreed method and site access decision. If an item is missing, the work should not be treated as authorised merely because the supplier is on the list. Conversely, a contractor not yet on the list can still be considered through an appropriate fresh assessment.

Keep evidence current without creating arbitrary expiry rules

Different evidence changes for different reasons. An insurance policy has its own end date. A professional registration or licence may have a renewal date. Experience and organisational capability can change after staff turnover, acquisition or a shift into unfamiliar work. A method statement can be unsuitable because the task changes even when the document is recently dated.

Build reminders around the evidence you actually rely on. Before a document expires, assign someone to obtain and review the next version. When a contract is renewed, check whether the work category remains the same. After a serious concern or incident, decide whether approval should be paused while the facts and controls are reviewed. When a contractor changes a key supervisor or subcontracting arrangement, ask whether the original decision still stands.

Avoid a universal annual reapproval claim. A periodic review date can prevent neglect, but it cannot replace an event-driven review. The right cadence depends on the risk and the evidence. If the business rarely uses a contractor, the most useful check may occur before the next engagement. If it uses one continuously on higher-risk work, review may be part of active contract management rather than a once-a-year spreadsheet exercise.

Record the result of a review, including no change. A dated note that the scope, performance and evidence were checked is more informative than resetting an approval date without explanation. If a condition was not met, move the supplier to under review or suspended and tell people who might otherwise book the work. A list is only dependable if its users learn about changes promptly.

Deal with poor performance and suspended approval

An approved supplier can later deliver work that raises a concern. The list should have a route for reporting it and a person who decides what happens next. A quality problem may require correction. A safety concern may require work to stop, immediate protection and a different level of review. Do not hide serious issues by leaving the status green while an investigation continues.

Record the specific issue and the affected scope. “Missed site induction at Building A” gives the reviewer more to work with than “non-compliant”. Note what immediate action was taken and who must verify the correction. Decide whether the concern affects one appointment, all work of that type or the entire supplier relationship. The decision should be made on the facts and risk, not by an automatic score alone.

The contractor should know the concern and be able to provide relevant information. There may be a misunderstanding, a system gap or a genuine failure needing corrective action. The list should support a traceable decision rather than a permanent unexplained black mark. Where the issue is serious or specialist, seek the right competent input. Software can record the process, but it does not determine the proportionate response for you.

If approval is restored, record what evidence supported that decision. A new certificate alone may not resolve a concern about supervision or how work was carried out. The review may require a changed method, a different supervisor, retraining or evidence from a completed job. Make the restored scope and any continuing conditions clear to future users of the list.

Avoid these common list mistakes

One approval for every task. A contractor can be suitable for one category and unassessed for another. Record scope and exclusions.

A document tick instead of an assessment. A file may be expired, irrelevant, unverified or insufficient for the work. Record what was actually considered.

Confusing accreditation with site permission. A third-party scheme can contribute evidence. It does not replace job planning, local coordination or the appointing party's reasonable steps under applicable law.

Treating an insurance date as total compliance. Insurance information matters commercially, but it does not show technical competence, safe systems or current site arrangements.

Deleting suspended suppliers. Keeping a visible status and reason can prevent an accidental new appointment through a different team. Apply sensible access controls to sensitive details.

No owner for review. A reminder with no named person is easy to ignore. Assign responsibility and a clear escalation route.

No route to add a new supplier. A list should help make decisions, not become a closed club that bypasses appropriate competition or prevents a capable new contractor from being assessed.

When to use a spreadsheet and when to use software

A small organisation with a few contractors may be able to keep a controlled register and linked evidence folder. The limitations appear when many people can appoint suppliers, work is spread across sites, or document and approval changes must reach users quickly. Then it becomes difficult to know which entry is current and why a decision was made.

Whatever tool you choose, test the same workflow. Can a manager see approval scope before booking a job? Can the reviewer find the evidence and conditions? Can an expired or suspended item be made visible to relevant users? Can the business distinguish the supplier-level decision from the site-specific work authorisation? If the system cannot do those things, a polished dashboard may simply conceal the same weak process in a new interface.

For a business evaluating platform options, ask Complys for a demonstration of the specific record and review workflow it can provide today. A supplier self-check is not a buyer's approval of a contractor for a job. This guide does not claim that Complys automatically verifies certificates, decides legal suitability or maintains a complete approved list without a responsible user.

The practical next step is to choose one real contractor and write down the work category, evidence, decision owner, conditions and review trigger. Test whether a second manager can understand and use that decision without guessing. Once that works, apply the same structure to the rest of the list. If manual maintenance is becoming unreliable, ask shortlisted vendors to demonstrate the workflow you have defined.