You Can Be Cited for a Contractor's Employee. At Scale, That Is a Process Problem.
OSHA's multi-employer worksite policy can put the host employer on a citation for exposure it controls. Across dozens of sites with a rotating contractor base, prequalification alone does not cover it.
Most large operators have a contractor prequalification process. Far fewer have a defensible answer to the question an inspector actually asks, which is not whether the contractor was qualified but who controlled the hazard.
Four roles, and you can hold more than one
OSHA's multi-employer citation policy describes categories of employer that may be citable at a worksite where more than one employer is present. In broad terms:
- The creating employer caused the hazardous condition.
- The exposing employer has employees exposed to it.
- The correcting employer is responsible for correcting it.
- The controlling employer has general supervisory authority over the worksite, including the authority to require others to correct hazards.
The category that catches host employers is controlling. If you have general supervisory authority over a site — and at your own facility you almost certainly do — you can be citable for a hazard affecting a contractor's employees, even where none of your own people were exposed and you did not create the condition.
The standard applied to a controlling employer is generally one of reasonable care in preventing and detecting violations, and reasonable care is measured against what you could have known and done. It is a lower bar than the one applied to the employer whose people are exposed. It is not no bar.
What "reasonable care" tends to mean in practice
The factors that come up include whether you conducted periodic inspections appropriate to the scale and nature of the work, whether you had a system for correcting hazards you found, and whether you enforced that system. In other words: did you look, and when you found something, did anything happen.
This is where the multi-site version diverges sharply from the single-site version. At one facility, a site manager who walks the contractor work daily is exercising reasonable care and can say so. Across forty facilities with a rotating contractor base, "our site managers keep an eye on it" is a description of intent, not a system. Nothing about it is auditable, and nothing about it produces evidence a year later.
Where multi-site contractor management fails
Prequalification is mistaken for the control. Insurance certificates, EMR figures and a signed safety agreement establish that the contractor is credible. None of them say anything about the hazard on the day. Prequalification is necessary and it is not what reasonable care is measured against.
Orientation varies by site. Each location built its own contractor induction. Some are thorough, some are a signature on a clipboard. A contractor working across five of your sites receives five different accounts of your requirements, which means none of them are your requirements.
Nobody knows who is on site. Ask a large operator to produce a list of every contractor employee on any given site last Tuesday and the answer often takes days. If you cannot establish who was present, you cannot establish what you did about them.
Findings go to the contractor and stop. A site identifies a contractor working unsafely and raises it with the contractor's supervisor. It gets fixed. Nothing is recorded, so the pattern — this contractor, this issue, four sites — never becomes visible, and the organisation cannot show it enforced anything.
Contract terms and site practice diverge. The master services agreement contains robust safety obligations negotiated by procurement. What actually happens at the site is governed by whatever the site and the contractor's foreman worked out. Both parties may be perfectly reasonable and still be operating outside the agreement.
What a defensible system looks like
The components are unglamorous and they compound:
One induction, delivered identically. Whatever your requirements are, every contractor at every site should receive the same statement of them, with a record of who received it and when. This single change removes an entire class of dispute about what the contractor was told.
Presence records. Know who was on which site on which day. This is a logistics problem before it is a safety problem, and solving it makes everything downstream possible.
Inspections proportionate to the work. A contractor replacing light fittings and a contractor working at height inside a confined space do not warrant the same oversight cadence. Define what triggers what, so the site is not exercising judgement about how much attention to pay under production pressure.
A finding record with a close-out. Every contractor safety observation logged, with what was done and by whom. This is the artefact that demonstrates enforcement. Without it you have a policy; with it you have a practice.
Roll-up by contractor, not just by site. The pattern that matters most is a single contractor generating findings across multiple sites. That is invisible in site-level records and obvious in a portfolio view, and it is the thing you most want to catch before an incident rather than after.
The high-risk work is a separate conversation
Contractor work involving confined space entry, hot work, work at height, or energy isolation on your equipment carries additional obligations that interact with your own programs. Energy control in particular requires the host and outside employer to inform each other of their respective procedures.
At scale, "the site sorts it out with the contractor" is not a program. These interfaces need to be defined once, centrally, and applied everywhere — because the alternative is that each site invents its own arrangement, and the quality of those arrangements will vary exactly as much as you would expect.
Where to start
Pick your three highest-risk contractor activities. For each, write down what your requirements are, how the contractor is told, who verifies, and where that verification is recorded. If any of those four has no answer, that is the gap — and it is the same gap at every site, which at least means fixing it once fixes it everywhere.
General guidance only, not legal advice. Multi-employer citation policy and its application are fact-specific. Consult qualified counsel and a safety professional regarding your contractor arrangements.
Not sure where you stand?
Take the 5-minute compliance assessment. Answer a few questions about your business and get a prioritized list of what OSHA expects, free.
Related Articles
Continue learning about OSHA compliance and workplace safety
Contractor Safety
The Staffing Agency Is Not the Only Employer of Your Temporary Workers
OSHA treats host employers and staffing agencies as jointly responsible for temporary workers. Across many sites with different agencies, the division of duties is rarely written down anywhere.
Construction Safety
Excavation's Competent Person Is Designated at the Site. Corporate's Org Chart Assigns the Role by Title.
OSHA's excavation standard, 29 CFR 1926.651, requires a competent person who evaluates that specific site's soil daily. A title alone cannot substitute for it.
Fire Protection
Combustible Dust Isn't One Hazard. Across a Portfolio of Sites, It's a Different One at Each Address.
Combustible dust falls under OSHA's General Duty Clause and NFPA standards, not one rule — a portfolio policy must fit a different material at each site.