How to Build a Contractor Safety Scorecard in 30 Days

The ILO estimates that nearly 3 million workers die each year from work-related accidents and diseases, and contractor work often concentrates the interfaces where those exposures become harder to control. This 30-day guide shows an EHS manager how to build a contractor safety prequalification scorecard that screens real operating risk before a purchase order turns into field exposure.

Why contractor prequalification must test control capacity

Contractor safety prequalification is the process of deciding whether a supplier has the leadership, supervision, competence, controls, and evidence needed to perform high-risk work without importing unmanaged exposure into the site. It should not be a document chase, because a folder full of certificates can still hide weak field supervision, poor energy isolation, rushed permits, or a subcontractor chain that nobody controls.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture appears in repeated decisions, not in declarations. That thesis matters in procurement because a contractor's true safety culture appears in how it prices work, plans the job, assigns supervisors, reacts to pressure, verifies critical controls, and stops work when conditions change.

The market usually treats prequalification as a compliance gate. The better approach treats it as risk intelligence for the buyer, the EHS team, and the operating manager who will host the work. Use this guide when the work involves maintenance shutdowns, construction interfaces, confined spaces, LOTO, work at height, hot work, mobile equipment, chemical exposure, or any task where a weak contractor can create SIF exposure within one shift.

Step 1: define the work packages before scoring suppliers

A useful contractor scorecard starts with work packages, because the same company may be low risk for office cleaning and unacceptable for energized maintenance, lifting, or confined space work. The EHS manager should separate services by exposure, not by purchasing category alone.

Across 25+ years leading EHS at multinationals, Andreza Araujo has observed that organizations often screen contractors with one generic questionnaire and then feel surprised when field risk changes after mobilization. The problem is not only the contractor's behavior; it is also the buyer's failure to define which risk the contractor is being hired to control.

Create four work-package classes. Class A covers SIF-exposed tasks such as energy isolation, work at height, heavy lifting, excavation, line breaking, hot work, and confined space entry. Class B covers routine operational support inside industrial areas. Class C covers low-exposure services under site supervision. Class D covers off-site or administrative services, which may need commercial screening but not a full field-risk scorecard.

Step 2: choose the scoring dimensions that predict field behavior

The scorecard should measure dimensions that predict how the contractor will behave under operating pressure. A low incident rate may be relevant, but it cannot carry the decision alone because underreporting can make a weak contractor look clean.

In more than 250 cultural-transformation projects supported by Andreza Araujo's team, one recurring pattern is that clean metrics often coexist with poor control ownership. A contractor can show zero recordables and still have no verified supervisor competence, no stop-work protocol, no subcontractor control, and no proof that critical controls survive schedule pressure.

Use six dimensions for Class A and Class B work: leadership commitment, supervisor competence, risk assessment quality, critical-control verification, incident learning quality, and subcontractor governance. For Class C, reduce the model to competence, induction, basic controls, and site supervision. The scorecard should become stricter as the work package moves closer to SIF exposure.

Step 3: request evidence that can be tested, not only declared

Every scorecard item should ask for evidence that a site team can test. Policies, certificates, and insurance documents belong in the file, although they should not be confused with proof that the contractor can manage the job.

The trap is accepting statements such as "all workers are trained" or "we follow ISO 45001 principles" without asking what that means during a permit handover, a tool change, or a delayed shutdown. A stronger request asks for the last three job-specific risk assessments, supervisor field-verification records, examples of corrective action closure, and one recent stop-work or job-pause decision.

Use a simple evidence rule: if the answer cannot be verified in the field or connected to a named owner, it receives low weight. This keeps the scorecard close to critical control verification, where the question is not whether the control exists in a procedure, but whether it is present and effective when work starts.

Step 4: weight the scorecard by exposure, not by paperwork volume

Weighting decides whether the scorecard protects the operation or rewards the supplier with the best documentation team. For high-risk work, field-critical dimensions must carry more weight than corporate presentations and generic certificates.

A practical Class A model can assign 30% to critical-control verification, 20% to supervisor competence, 15% to risk assessment quality, 15% to incident learning quality, 10% to leadership commitment, and 10% to subcontractor governance. Those numbers are a starting model, not a universal formula, because the site should adjust them for its risk profile.

The important decision is what receives little weight. A glossy policy, a slogan, or a lagging indicator without context should never outweigh proof that the contractor knows how to isolate energy, maintain pedestrian separation, control dropped objects, or stop work when a permit no longer matches the job.

Step 5: set pass, conditional pass, and no-go thresholds

The scorecard needs thresholds before suppliers are evaluated, because changing the pass line after seeing the commercial bid invites pressure and inconsistency. Define the decision rules with procurement, operations, and EHS before the first supplier responds.

For Class A work, set a minimum total score and a separate minimum for critical dimensions. A supplier might reach the total score through strong documents, but it should still fail if supervisor competence or critical-control verification is weak. This is where many programs collapse, since the buyer lets a low price compensate for missing field capacity.

Use three outcomes. Pass means the contractor may proceed to mobilization planning. Conditional pass means the contractor may proceed only after named gaps are closed and verified. No-go means the contractor cannot perform that work package until the exposure class changes or the company proves a different control capacity.

Step 6: interview the supervisor who will run the work

The contractor's field supervisor should be interviewed before approval, because that person will translate the contract into daily decisions. A corporate HSE manager may answer perfectly while the field supervisor has no authority, no crew history, or no practical stop point.

During the PepsiCo South America tenure, where the accident ratio fell 50% in six months, Andreza Araujo learned that safety improvement depended on the operating routine, not only on the central standard. The same logic applies to contractors, since the person managing the job front often decides whether the written control becomes real work.

Ask the supervisor to explain the highest-risk step of the job, the control that can fail, the verification method, the stop-work trigger, and the escalation path. Then ask for a recent example where the crew paused or redesigned work because the plan no longer matched the condition. If the answer is only "we tell people to be careful," the contractor is not ready for Class A work.

Step 7: connect prequalification to procurement clauses and mobilization

Prequalification loses power when it ends at approval. The scorecard should become a contract condition, a mobilization plan, and a field-verification agenda for the first days of work.

The related article on procurement safety clauses explains why safety language must define authority, stop-work rights, subcontractor approval, data sharing, and consequences for control failure. The scorecard tells the buyer where the contract must be sharper, because each weak dimension should become a condition, not a private note in the EHS file.

Before mobilization, transfer the top three scorecard gaps into the kickoff meeting. If the contractor scored weakly on subcontractor governance, require the final list of subcontractors before access badges are issued. If the gap is LOTO competence, verify the isolation method in the field before the first intervention. If the gap is supervision, require named supervisor coverage for each shift and escalation rules for absence.

Step 8: review the contractor after the first 30 days of work

The first 30 days should test whether the prequalification score predicted field performance. A contractor that looked strong on paper may struggle once schedule pressure, shift changes, and interface work begin.

Review five signals after the first month: permit deviations, stop-work or job-pause quality, corrective action closure, supervisor presence, and worker feedback from the host area. Compare those signals with the original scorecard, because the goal is to improve the screening model as much as to manage one contractor.

Connect the review to the risk register fields that keep controls alive. If the contractor creates a recurring exposure, the site should not hide it in supplier performance notes. The risk register should show the exposure, owner, interim control, verification method, and decision date.

Contractor scorecard model for high-risk work

A high-risk contractor scorecard should make the approval decision visible to EHS, procurement, and operations. The table below gives a practical structure that can be adapted to local legal and commercial requirements.

Do not let the table become a substitute for judgment. The EHS manager should read the scorecard alongside the task, location, schedule, supervision model, and history of interface failures, since contractor risk is often created between organizations rather than inside one company.

What to do when a strategic supplier fails the scorecard

A strategic supplier that fails the scorecard should not be approved quietly because the business depends on the contract. The right response is a documented risk decision with interim controls, senior ownership, and a deadline for capability improvement.

This is the moment where compliance pressure becomes visible. If procurement says the supplier is irreplaceable, operations says the shutdown date cannot move, and EHS says the contractor is not ready, the organization has reached a real risk-management decision, not an administrative inconvenience.

Each contractor approval that ignores known gaps teaches the site that price and schedule can outrank control capacity, which is exactly how weak signals become normal work before a serious event.

Use conditional approval only when the gap can be controlled before exposure begins. If the missing element is a document, the gap may be closed quickly. If the missing element is supervisor competence, subcontractor governance, or critical-control verification, the safer decision may be postponement, scope reduction, or direct host-company supervision until capability is proven.

Conclusion

A contractor safety prequalification scorecard works when it classifies work packages by exposure, scores dimensions that predict field behavior, requests testable evidence, weights controls above paperwork, sets no-go thresholds, interviews the real supervisor, and reviews the first 30 days of work.

For practitioners ready to apply this end to end, Safety Culture Diagnosis offers Andreza Araujo's practical logic for testing perception against evidence. Safety is about coming home, and contractor approval should protect that promise before the first badge is printed, the first permit is signed, or the first shortcut becomes part of the job.