Document {{ORG_PREFIX}}-013

Procurement & Contractor Management Procedure

1. Purpose

This procedure defines how {{ORG_NAME}} decides which external providers to use, what it tells them, how tightly it controls them, and how it keeps watching them — so that everything obtained from outside the organisation (goods, services, contractor labour, and outsourced processes) arrives fit for purpose and never introduces uncontrolled quality or OH&S risk into the work. It operationalises the commitments in quality-ohs-policy, which this procedure implements.

The end state this procedure exists to maintain: every external provider the organisation depends on has a row in the Supplier & Contractor Register showing what they provide, how critical they are, whether they are approved, when they were last evaluated, and — for anyone working at a workplace — that the OH&S coordination steps in §3.5 happened before their work started.

2. Scope

This procedure applies to everything {{ORG_NAME}} buys or brings in from outside: [ORG-DECISION: the organisation's typical purchase categories, listed at instantiation, e.g. subconsultant services, laboratory testing, field contractors, software, plant hire]. Coverage does not depend on how small the purchase is or on where it ends up: §3.1 sets each provider's Criticality from what a failure of its provision would cost, and §3.4 sizes the control that follows. Work {{ORG_NAME}} has placed with an external party rather than running it in-house sits here too, under §3.6.

It also applies to contractors — external parties whose people perform work at a workplace {{ORG_NAME}} controls, or alongside {{ORG_NAME}}'s workers at a shared workplace such as a client site (§3.5) — and to the procurement of goods with OH&S implications: hazardous substances, materials, plant, and equipment (§3.2).

No purchase is excluded from this procedure; instead, the extent of control is proportionate to impact (§3.1, §3.4). The {{ROLE_QUALITY_MANAGER}} owns this procedure and the quality-side evaluation of providers; the {{ROLE_OHS_COORDINATOR}} owns the OH&S procurement checks (§3.2) and all contractor OH&S coordination (§3.5).

3. Procedure

3.1 Evaluation and selection

{{ORG_NAME}} buys only from providers evaluated and approved under this section. That is the end state §1 describes: an evaluated register row for every provider before any order is placed. Evaluation is the first link in a chain this procedure completes elsewhere: §3.3 writes {{ORG_NAME}}'s requirements, health and safety included, into the engagement document, and §3.4 verifies what arrives against them, protecting the deliverable the provision feeds and the customers who receive it. A provider is only asked to meet those requirements once {{ORG_NAME}} is satisfied it can.

Every provider is categorised on its register row:

• Criticality (High / Medium / Low) — judged on what a failure of this provision would do to {{ORG_NAME}}'s ability to deliver conforming outputs to customers, to meet legal and customer requirements, and to protect workers. Incorporated provision, direct-to-customer provision, and outsourced processes (the three situations in §2) always warrant at least Medium; outsourced processes default to High.
• OH&S Coordination Required (checkbox) — set for any provider whose work involves presence at a workplace, a shared workplace, or provision of hazardous substances, plant, or equipment. Setting it makes the OH&S criteria below mandatory in selection and triggers §3.2 and/or §3.5.

How providers earn and keep approval. The two criteria sets below govern every judgement the step table makes about a provider, from the first assessment of a candidate at step 2 to the scheduled and triggered re-checks at step 5, always in proportion to Criticality:

Criteria set	What is assessed	Applies to
Quality capability	Ability to supply to specification: relevant track record or references, technical competence and capacity, relevant certifications (e.g. an ISO 9001-certified system), warranty/rework terms, and history with {{ORG_NAME}} if any	All providers
OH&S performance	Safety management arrangements appropriate to the work, competency evidence and licences for the people doing it, incident history the provider discloses, willingness to comply with {{ORG_NAME}}'s OH&S requirements, and [ORG-DECISION: required insurance types and minimum cover, jurisdiction- and contract-dependent, set at instantiation]	Every provider with OH&S Coordination Required set (see also §3.5 step 1)

Step	Action	Responsible role	Output / record
1	On a new provision need, categorise it: what the provider will supply and where it lands, the proposed Criticality, and whether OH&S Coordination Required must be set.	{{ROLE_QUALITY_MANAGER}} (Criticality); {{ROLE_OHS_COORDINATOR}} (OH&S flag)	New Supplier & Contractor Register row: Supplier, Provides, Criticality, OH&S Coordination Required
2	Evaluate the candidate against the criteria table above — High: documented assessment against every applicable criterion before any engagement; Medium: documented assessment of the criteria material to the provision; Low: a one-line suitability judgement in Notes.	{{ROLE_QUALITY_MANAGER}}, with {{ROLE_OHS_COORDINATOR}} for the OH&S criteria set	Evaluation outcome and reasoning in the register row's Notes, with any assessment artifacts linked
3	Set the selection decision: Evaluation Status = Approved, Conditional (approved with stated limits or follow-up actions, recorded in Notes), or Rejected; set Last Evaluated and Next Evaluation. Work may only be ordered from Approved or Conditional providers, within any stated conditions.	{{ROLE_QUALITY_MANAGER}}	Updated register row
4	Monitor performance during supply: delivery conformity, verification results (§3.4), OH&S behaviour on site (§3.5), and responsiveness. Log issues in the row's Notes as they occur.	{{ROLE_QUALITY_MANAGER}} (quality); {{ROLE_OHS_COORDINATOR}} (OH&S)	Dated monitoring entries in Notes
5	Re-evaluate on schedule — [ORG-DECISION: re-evaluation cadence — default annually for High criticality, at each new engagement for Medium, on issue only for Low] — and immediately on any trigger: a nonconformity attributable to the provider, an incident involving the provider's work, repeated late or defective supply, or a material change in what they provide. Update Evaluation Status, Last Evaluated, Next Evaluation.	{{ROLE_QUALITY_MANAGER}} with {{ROLE_OHS_COORDINATOR}}	Updated register row; follow-up actions in Notes
6	Act on failures: downgrade to Conditional or Rejected as warranted, and raise provider-attributable nonconformities through the organisation's nonconformity and corrective action process, linking the outcome back to the register row.	{{ROLE_QUALITY_MANAGER}}	Status change; corrective action reference in Notes

The Supplier & Contractor Register row carries the live picture of each provider: Evaluation Status, Criticality, Last Evaluated and Next Evaluation, with the reasoning behind each judgement, the dated monitoring entries, and the follow-up actions in Notes, and larger assessment artifacts linked from it. Because a register is an index and never the evidence itself, the register is snapshotted at each re-evaluation cycle and before audits into docs/records/procurement-evaluations/ (via tools/snapshot_register.py); the committed snapshot is what {{ORG_NAME}} keeps as proof of how each provider was judged, how it performed, and what followed from that.

3.2 Evaluation and selection (OH&S procurement)

Procured goods can carry hazards into the workplace, so goods with OH&S implications pass these controls before purchase and before first use. A purchase can satisfy its technical specification and still hurt someone; the steps below exist to catch exactly that case:

Step	Action	Responsible role	Output / record
1	Before purchasing a hazardous substance: obtain the current safety data sheet, assess the hazard through the organisation's hazard identification and risk assessment methodology (including whether a less hazardous alternative would do the job), and approve or reject the purchase.	{{ROLE_OHS_COORDINATOR}}	Approval noted in the register row's Notes; SDS linked/filed with the substance's risk assessment
2	Before purchasing plant or equipment: check suitability for the intended task, guarding and safety features, required compliance documentation from the supplier, and any competency or licence needed to operate it.	{{ROLE_OHS_COORDINATOR}}	Pre-purchase check noted in Notes
3	Before purchasing materials with specified safety-relevant properties: require the conformance documentation (test certificates, conformity declarations) named in the purchase requirements, per §3.3.	{{ROLE_QUALITY_MANAGER}}	Certificate requirement on the purchase order
4	On receipt and before first use: verify what arrived is what was approved; inspect plant/equipment before it enters service; make storage, handling, and use requirements known to the workers affected.	{{ROLE_OHS_COORDINATOR}}, with the receiving worker	Receipt/pre-use check noted in Notes; hazard controls communicated
5	Feed any new hazard the purchase introduces into the organisation's hazard and risk process so controls exist before the item is used in anger.	{{ROLE_OHS_COORDINATOR}}	Updated risk assessment for the affected work

3.3 Information to providers

{{ORG_NAME}} does not blame a provider for failing to meet a requirement it never clearly communicated. A vague order is expensive as well as unfair: the rework, the delay, and the argument over who pays for both land back on {{ORG_NAME}}, and a provider cannot be judged fairly at §3.1 step 5 against expectations nobody ever gave it. So {{ORG_NAME}} puts the whole of what it wants into the engagement document, and reads it once more before it goes out.

No half-specified orders. The person raising a purchase requirement reads it back before sending it: the specification is complete and current, quantities and delivery expectations are stated, acceptance criteria are defined, and the OH&S requirements from §3.2/§3.5 are in. A gap found on {{ORG_NAME}}'s own desk costs a few minutes; the same gap found at the provider's costs money, programme, and goodwill. For High-criticality provision the {{ROLE_QUALITY_MANAGER}} reads the requirement and releases it for issue.

The engagement document does the communicating. Whether it is a purchase order, a subcontract, or an engagement letter, {{ORG_NAME}} drafts it in the order below. Engagements differ in what they warrant: a box of consumables needs the first two sections and nothing more, while a subcontracted field programme runs the whole way down.

Purchase document section	What {{ORG_NAME}} writes there
Scope and specification	The line items or scope of work, how much, by when, and to where, then the specification the output must meet and any standards that apply to doing the work. The provider prices and plans the job off this section, so it is written to be worked from without a follow-up phone call.
Commercial terms	Price basis and payment terms, the insurance the provider carries, confidentiality and the handling of {{ORG_NAME}}'s and its clients' information, and whether any of the work may be passed further down the line.
Who does the work	Where it matters who does the work, the document names the people or the standing they bring: the licences, tickets, formal qualifications, or competence demonstrated in another form that the provider's personnel hold before they start. Clients accept a great deal of {{ORG_NAME}}'s work on the strength of who produced it, and an unlicensed operator on a job becomes {{ORG_NAME}}'s problem as fast as it is the provider's.
Keeping in contact while the work runs	Who the provider deals with at {{ORG_NAME}} and who {{ORG_NAME}} deals with at the provider, what gets reported and how often, and the meetings both sides attend. The document also sets out the yardstick {{ORG_NAME}} applies while the work is under way (§3.1 step 4), because the re-evaluation at §3.1 step 5 goes better, and is argued over less, when the provider has known the measure since day one.
Where {{ORG_NAME}} says yes before the job moves on	The points where the provider stops and waits for {{ORG_NAME}}, each one named in the document alongside the person who releases it. Where the way the work is done affects the result, {{ORG_NAME}} signs off the work method and the equipment the provider proposes before that work starts; where the particular item matters to the specification, it signs off the product or material the provider proposes to use. Those sign-offs hold for the rest of the job: substituting anything ordered, or changing an agreed work method or piece of equipment, needs {{ORG_NAME}}'s written approval before it happens. Nothing the provider produces moves on into {{ORG_NAME}}'s work or out to the client until {{ORG_NAME}} releases it, because from that point it carries {{ORG_NAME}}'s name.
Seeing the work where it happens	Some work can only be judged on the provider's own floor: a rig under test, a batch part-made, a process being run the way it will be run all month. Where {{ORG_NAME}} plans to attend the provider's premises for that, or has agreed a client may attend alongside it or in its place, the document sets down the access and the notice the provider receives. Access that is not written in at the start cannot be had once the work is running.
Working at a workplace	For providers with OH&S Coordination Required set: the applicable site rules, the hazard information {{ORG_NAME}} holds, and the coordination duties per §3.5. A contractor who first hears about a workplace hazard at the gate has already lost time and may already be exposed.
Handover	What the provider gives back at the end and in what form: test certificates and conformance documentation (§3.2 step 3), data and its format, as-left information, operating and maintenance material, and safety data sheets. These are named in the document because they are hard to extract once the provider has been paid and moved on.

The issued purchase order or subcontract is referenced from the provider's register row, so the communicated requirements are traceable per engagement.

3.4 Controls on providers

The type and extent of control over each provider and its outputs is decided deliberately, not by habit:

Step	Action	Responsible role	Output / record
1	At selection (§3.1 step 3), define the controls for this provider and its outputs. Control loosens with demonstrated reliability and tightens with the stakes: the more demonstrably the provider already controls its own work, the lighter {{ORG_NAME}}'s checking needs to be; the more a failed provision would hurt {{ORG_NAME}}'s customers or put {{ORG_NAME}} in breach of its legal obligations, the tighter the control. A provider with a certified management system and clean history warrants lighter incoming verification than an unproven one.	{{ROLE_QUALITY_MANAGER}}	Controls and verification method recorded in the register row's Notes
2	Decide how {{ORG_NAME}} will satisfy itself that each provision arrives as ordered, choosing from: incoming inspection or test, review of certificates or conformance documentation, review of the deliverable before it is incorporated or passed on, witness or hold points during the provider's work, and post-delivery confirmation with the customer where the provider supplies that customer directly.	{{ROLE_QUALITY_MANAGER}}	Named verification step(s) per provision, in Notes and on the purchase requirement
3	Perform the chosen verification when the provision arrives or completes, within the acceptance and release controls of operational-control-service-delivery-procedure. No externally provided input is incorporated into a deliverable, and no direct provision is treated as delivered, until its planned verification has passed.	Role named in the verification step	Verification result logged in the register row's Notes
4	Run every externally provided process through the same IMS machinery as in-house work: a named internal owner, defined requirements (§3.3), defined verification (step 2), and live status on its register row. {{ORG_NAME}} answers for the process whoever performs it, including processes outsourced by the organisation's own decision (§3.6).	{{ROLE_QUALITY_MANAGER}}	Register row current; owner named in Notes
5	On verification failure, quarantine or reject the provision, record the failure in Notes, and route it through the organisation's nonconformity and corrective action process; feed the result into re-evaluation (§3.1 step 5).	{{ROLE_QUALITY_MANAGER}}	Failure entry in Notes; corrective action reference

3.5 Contractors

Contractor work is where external provision and workplace safety meet. The duty runs both ways: {{ORG_NAME}} protects the contractor's workers from its own work, and its own workers and everyone else at the workplace from the contractor's. Steps 1 to 6 below deliver both:

Step	Action	Responsible role	Output / record
1	An unsafe contractor does not win the work: any contractor whose work involves workplace presence or OH&S risk is evaluated against the OH&S performance criteria set in §3.1 before selection, and a contractor who fails them is not selected regardless of price or capability.	{{ROLE_OHS_COORDINATOR}} evaluates; {{ROLE_QUALITY_MANAGER}} records	OH&S evaluation in the register row's Notes; OH&S Coordination Required set
2	Exchange hazards before mobilisation, in both directions: {{ORG_NAME}} gives the contractor the known hazards of the workplace and the work, the site rules, and the emergency arrangements; the contractor gives {{ORG_NAME}} the hazards their activities introduce and the controls they will apply (e.g. their safe work method documentation for the task).	{{ROLE_OHS_COORDINATOR}} with the contractor	Completed hazard exchange linked from the register row
3	Map the exposures at the workplace and close every one: the contractor's workers are exposed to {{ORG_NAME}}'s work, {{ORG_NAME}}'s workers to the contractor's, and other contractors, visitors, and anyone else present are exposed to both. Assess and control each exposure and agree who provides and maintains each control. At shared workplaces such as client sites, this coordination includes the other parties present.	{{ROLE_OHS_COORDINATOR}}, consulting the workers affected	Documented risk assessment and coordination allocation, linked from the register row
4	Induct before work starts: contractor workers receive the workplace induction covering hazards, controls, site rules, emergency response, and how to report incidents and hazards. No contractor worker starts work without it.	{{ROLE_OHS_COORDINATOR}}	Induction acknowledgement per contractor worker, linked from the register row
5	Hold contractors to the OH&S management system during the work: monitor compliance with the agreed controls and site rules through workplace checks proportionate to the risk; any {{ORG_NAME}} worker or the {{ROLE_WORKER_REP}} can stop contractor work that presents an immediate danger; incidents involving contractor work are reported and investigated through the organisation's incident reporting and investigation process.	{{ROLE_OHS_COORDINATOR}}	Monitoring entries in the register row's Notes
6	On completion, feed OH&S performance into the contractor's monitoring and re-evaluation under §3.1 steps 4 and 5, so it shapes whether they are used again.	{{ROLE_OHS_COORDINATOR}} with {{ROLE_QUALITY_MANAGER}}	Updated Notes and Evaluation Status

3.6 Outsourcing

{{ORG_NAME}} treats a process as an outsourced process when two things are true at once: the work sits with an external party by {{ORG_NAME}}'s own decision, where {{ORG_NAME}}'s own people would otherwise perform it; and how the work is performed still shapes the conformity of {{ORG_NAME}}'s deliverables or the OH&S management system. This section governs every process that meets that test. [ORG-DECISION: which processes, if any, are currently outsourced, identified at instantiation; if none, this section stands ready and the register simply holds no outsourced-process rows.]

For every outsourced process:

Step	Action	Responsible role	Output / record
1	Register it: a Supplier & Contractor Register row with Provides naming the process, Criticality defaulting to High, and OH&S Coordination Required set if the process affects the OH&S system.	{{ROLE_QUALITY_MANAGER}}	Register row
2	Put the control regime for the process in writing: the requirements it must meet (§3.3), the verification applied to its outputs (§3.4), the monitoring cadence, the named internal owner, and {{ORG_NAME}}'s right to review the provider's performance of it. Where the process affects the OH&S system, the {{ROLE_OHS_COORDINATOR}} defines the OH&S controls within it.	{{ROLE_QUALITY_MANAGER}}; {{ROLE_OHS_COORDINATOR}} for OH&S aspects	Documented control definition linked from the register row
3	Keep the process under {{ORG_NAME}}'s control for as long as it is outsourced: it remains inside the IMS per §3.4 step 4, its performance is monitored and re-evaluated per §3.1, and a change to the outsourced arrangement (new provider, changed scope, brought back in-house) is handled through the organisation's management-of-change process before it takes effect.	Named internal owner	Live register row; monitoring entries

Outsourcing transfers the performance of a process, never the responsibility for it. {{ORG_NAME}} remains answerable to its customers, its workers, and its legal obligations for outsourced work exactly as for work done in-house.

4. Records and Registers

Activity	Register (index)	Record (evidence)
Provider evaluation, selection, monitoring, re-evaluation (§3.1)	Supplier & Contractor Register — Evaluation Status, Criticality, Last/Next Evaluated; reasoning and actions in Notes	Periodic register snapshots committed to docs/records/procurement-evaluations/ at each re-evaluation cycle and audit prep (snapshot_register.py)
OH&S procurement checks (§3.2)	Supplier & Contractor Register — OH&S Coordination Required, Notes	SDS, pre-purchase and pre-use checks linked/filed with the affected work's risk assessment
Requirements communicated to providers (§3.3)	Supplier & Contractor Register — purchase order / subcontract referenced in Notes	The issued purchase order or subcontract itself, retained in [ORG-DECISION: where procurement and contract artifacts are stored, e.g. the organisation's contract filing system]
Contractor hazard exchange, risk assessment, induction (§3.5)	Supplier & Contractor Register — Notes and linked artifacts	Completed hazard exchanges, coordination risk assessments, and induction acknowledgements linked from the provider's row
Provider-attributable failures and incidents (§3.1 step 6, §3.4 step 5, §3.5 step 5)	Supplier & Contractor Register cross-reference in Notes	Handled and evidenced through the organisation's nonconformity/corrective action and incident reporting processes respectively

The Supplier & Contractor Register is the live index; what {{ORG_NAME}} keeps as proof of how each provider was judged, how it performed, and what followed is the periodic snapshot committed to docs/records/procurement-evaluations/. The register's dates, statuses, and linked artifacts drive those snapshots but are never themselves the evidence.

Honest status: in this template the Supplier & Contractor Register is empty. This procedure has run for the first time only when a real provider row carries a completed evaluation with Evaluation Status and Last Evaluated set — until then, {{ORG_NAME}} has no evaluated providers and says so.

5. Exceptions

An exception to this procedure (for example, an urgent engagement of an unevaluated provider to keep a delivery or make a workplace safe) is requested in writing to the {{ROLE_QUALITY_MANAGER}}, who assesses the quality exposure — with the {{ROLE_OHS_COORDINATOR}} assessing the OH&S exposure wherever workplace presence or OH&S risk is involved — and refers it to {{ROLE_TOP_MANAGEMENT}} for approval. An approved exception is logged in the provider's register row Notes, the retrospective evaluation is completed within [ORG-DECISION: retrospective-evaluation window, e.g. 14 days], and the exception is valid for at most [ORG-DECISION: exception validity period, e.g. 90 days] before re-review.

No exception is available to: the pre-purchase check for hazardous substances (§3.2 step 1); the hazard exchange and induction before contractor work starts (§3.5 steps 2 and 4); or the verification of externally provided outputs before they reach a customer (§3.4 step 3). Urgency changes how fast these happen, never whether they happen.

6. Related Documents

• quality-ohs-policy — the policy this procedure implements (implements frontmatter); it commits the organisation to conforming delivery and to protecting everyone working under its control, including contractors' workers.
• operational-control-service-delivery-procedure — the controlled conditions, acceptance, and release steps within which externally provided inputs are verified and incorporated (§3.4 step 3).
• schemas/registers.schema.yml — the field specification of the Supplier & Contractor Register (a schema, not a controlled document).

7. Revision History

Version	Date	Author	Description of Changes	Reviewed By	Review Date	Approved By	Approval Date
0.1	2026-07-16	{{ROLE_QUALITY_MANAGER}}	Initial draft	—	—	—	—

8. Document Control

Document	{{ORG_PREFIX}}-013
Type	Procedure
Version	0.1
Status	Draft
Owner	{{ROLE_QUALITY_MANAGER}}
Reviewer	{{ROLE_OHS_COORDINATOR}}
Approver	{{ROLE_TOP_MANAGEMENT}}
Next Review	2026-08-15
Classification	Internal

Held in the document frontmatter, mirrored to the Document Register.