Contractor offboarding: close access and preserve the right evidence
An engagement may end with a final invoice while open defects, site access and document questions remain. Contractor offboarding is the point at which the client confirms what work was completed, what still needs attention and which records must remain available. It is a separate task from onboarding or assessing a contractor for the next job.
The HSE's Using contractors guide includes managing, supervising and reviewing the job. A sensible offboarding record supports that review. It is not a blanket statutory “completion certificate,” and it does not discharge a contractor's own responsibilities.
Close the work package, not just the supplier account
Identify the contract, site, work dates, supervisor and final scope. Ask the contractor to state what was done and what differs from the original method or order. Collect handover documents appropriate to the work: test results, commissioning records, as-built information, waste documents, warranties or maintenance instructions where relevant. Do not request a generic bundle merely because a template lists it; explain which deliverables the job actually requires.
Walk through outstanding defects and temporary controls with the person responsible for the site. Record who owns each action and when it must be closed. If work is incomplete, avoid marking the entire engagement “complete.” A useful status may be “physical work ended; two corrective actions open.” The difference matters when an occupant, auditor or later contractor asks what was left behind.
Remove access deliberately
Check keys, passes, shared links, portal accounts and system permissions. Some people may need limited access to resolve defects or submit final records; give that access a named purpose and end date. Do not leave access active because the contractor might be hired again. If site access was granted through a subcontractor, confirm which individual accounts and passes were issued and who is responsible for their return.
Tell the contractor how to raise a later warranty or defect issue after normal access ends. Keep the route practical: the site contact should not have to restore broad permissions merely to receive a photograph or repair note.
Decide what to retain by record category
Retain evidence needed for safety, contract, warranty, property or regulatory purposes in the right record location. Distinguish a RAMS version used during the work from superseded drafts, and a defect-closure photo from unrelated personal images. The retention period and lawful basis may differ by category. The ICO's storage-limitation guidance says personal data should not be kept longer than needed for its purpose and should be reviewed. It does not prescribe one universal period for contractor records.
Name the retention owner and the event that starts the period. Record any legal hold, dispute or open claim before deletion. If the contractor's files include worker names, certificates or identity material, limit access to those with a work reason. “Keep everything forever” is not a defensible default; nor is deleting the only record of a material safety decision immediately after completion.
Confirm obligations that survive the last day
Check warranty visits, planned maintenance, statutory inspections, monitoring, defect liability and follow-up training. These are contract- and work-specific. If another contractor will take over, provide the information it needs to work safely without indiscriminately sharing personal data or confidential commercial material. Record the transfer and what the new party is authorised to use.
Review incidents or near misses linked to the work and close agreed learning actions. An unresolved incident should not disappear when the supplier record is archived. If the contractor is still on a general approved list, decide separately whether its status remains appropriate for future work. Offboarding a job and removing a supplier from an approved list are different decisions.
A compact closure record
The closure record should identify the work package, final version of relevant documents, completed deliverables, open actions, access removed or time-limited, records retained and their owner, and the person who accepted the handover. Add a short note on lessons for the next appointment. The client can then answer what happened without retrieving a chain of emails from an absent project manager.
To compare ways to organise contractor evidence, see Complys contractor management software. Ask to see how the current product would represent closure, outstanding actions and restricted access. Do not assume it automatically removes accounts or decides a legal retention period.
Example: closing a refurbishment job with defects open
A refurbishment contractor finishes its planned attendance, but two fire-door defects remain. The client records that site work has ended while the defects are still open, identifies who will make the area safe and agrees a date for correction. It collects the test and handover records already due, removes general site access and grants only the limited access needed for the return visit. The closure record names the final documents, open actions and person who will verify repair. It also preserves the relevant RAMS version and defect evidence under the right retention category. Marking the supplier “offboarded” must not erase the open fire-door action or allow an unrelated contractor to assume the doors were accepted.
Questions to ask before archiving
Does anyone still depend on the contractor for a warranty, inspection or specialist instruction? Are temporary controls visible to the next site manager? Has each personal-data category been assigned a retention rule, or is it being kept because nobody knows who can delete it? Can a future reviewer identify the contractor's legal entity and the exact work package from the saved record? These questions turn offboarding into a controlled handover rather than an account-deactivation exercise.