Contractor Management: What It Covers and What a Host Employer Owes

Short answer

Contractor management is the set of controls an organization uses to select, brief, supervise and evaluate outside firms whose people work on its premises. In U.S. workplaces the safety side is anchored in two OSHA sources: the multi-employer citation policy, which says who can be cited when several employers share a worksite, and 29 CFR 1910.119(h), which lists host-employer and contract-employer duties where a covered process is involved.

Definition and scope

In a lab or research facility, “contractor” usually means an outside company whose staff do maintenance, repair, renovation, calibration or specialty work in spaces the institution controls. Contractor management covers the whole relationship: what is checked before selection, what the contractor is told about site hazards, how entry and exit are controlled, and how performance is reviewed afterward.

It is not the same question as how a sponsored award treats an outside party. Whether a party is a subrecipient, a contractor or a vendor for award-monitoring purposes is a separate classification, covered in Subrecipient vs. Contractor vs. Vendor. Procurement-side qualification of a prospective federal contractor is covered in FAR 9.104 Responsibility Determination and Federal Contract Compliance.

How contractor oversight works in practice: the OSHA multi-employer roles

OSHA’s Multi-Employer Citation Policy (CPL 2-0.124, effective December 10, 1999) sorts employers on a shared worksite into four roles. The directive defines them as follows:

• Creating employer: “The employer that caused a hazardous condition that violates an OSHA standard.”
• Exposing employer: “An employer whose own employees are exposed to the hazard.”
• Correcting employer: an employer “engaged in a common undertaking, on the same worksite, as the exposing employer” that “is responsible for correcting a hazard.”
• Controlling employer: an employer with “general supervisory authority over the worksite,” “including the power to correct safety and health violations itself or require others to correct them.”

An employer can hold more than one role at once. Read against a research institution, the practical point is that the institution does not stop being relevant to a hazard just because an outside firm’s employees are the ones exposed: an institution that has general supervisory authority over the lab building fits the controlling-employer description, and an institution whose own staff share the space with the contractor can also be an exposing employer. The contractor, for its part, can be the creating employer when its work causes the condition.

Host-employer and contract-employer duties under 29 CFR 1910.119(h)

Where a facility has a process covered by OSHA’s Process Safety Management standard, paragraph (h) of 29 CFR 1910.119 sets duties on both sides. It applies to contractors doing “maintenance or repair, turnaround, major renovation, or specialty work” on or adjacent to a covered process. It excludes incidental services that do not affect process safety, such as janitorial, food, laundry and delivery services. The standard applies only to covered processes; it is not a general rule for every lab contractor.

Topic	Host employer, 1910.119(h)(2)	Contract employer, 1910.119(h)(3)
Before the work	Obtain and evaluate the contract employer’s safety performance and programs at selection.	Train each contract employee in the work practices needed to do the job safely.
Hazard and emergency information	Inform the contract employer of known fire, explosion or toxic release hazards, and explain the applicable parts of the emergency action plan.	Instruct employees on those known hazards and on the emergency action plan.
Control of presence	Develop safe work practices to “control the entrance, presence and exit of contract employers and contract employees” in covered process areas.	Ensure employees follow the facility’s safety rules, including its safe work practices.
Records	Maintain a contract employee injury and illness log.	Document each employee’s training: identity, date and how understanding was verified.
Feedback loop	Periodically evaluate the performance of contract employers.	Advise the host employer of unique hazards presented by the contractor’s work.

Types and related concepts

Contractor management vs. supplier audit

A contractor on site is managed through entry controls, briefings and performance review. A supplier whose work happens elsewhere is typically assessed by audit; see second-party audit.

Contractor management vs. sponsor oversight of delegated work

In clinical research, a sponsor that delegates functions to a contract research organization has its own oversight expectations; those are discussed in Sponsor Oversight of Delegated CRO Functions Under ICH E6(R3). That is a regulatory-quality relationship, distinct from site-safety control of on-premises trades.

Where it matters for labs and clinics

The two OSHA sources give labs a concrete checklist to compare against their own practice:

• Does the institution know which of the four multi-employer roles it holds when an outside firm works in a lab space?
• Where a covered process exists, is there evidence that safety performance was evaluated at selection, hazards and the emergency action plan were communicated, and entry and exit are controlled?
• Does the contract require the contractor to report unique hazards its work creates, and is there a mechanism to receive that report?
• Is contractor training documented with identity, date and how understanding was verified?
• Is there a periodic performance evaluation and an injury and illness log for contract employees in covered areas?

Common misunderstandings

• “Hiring a contractor transfers the responsibility.” The multi-employer policy assigns roles by what each employer did and controlled, not by who signed the contract.
• “1910.119(h) covers every contractor in a lab.” It reaches contractors working on or adjacent to a covered process, and it excludes incidental services such as janitorial and delivery.
• “A subrecipient or vendor classification settles safety oversight.” Award classification and site-safety control answer different questions.

FAQ

What is contractor management?

It is the practice of selecting, briefing, controlling and evaluating outside contractors who work on an organization’s premises, so that hazards and duties are assigned clearly.

Who is the host employer in a lab?

Paragraph (h) uses the term for the employer of the facility with the covered process, which is the party that must evaluate and inform contractors. Under the multi-employer policy, the institution with general supervisory authority over the worksite fits the controlling-employer description.

Do these duties apply to janitorial or delivery contractors?

Under 1910.119(h)(1), incidental services that do not influence process safety, including janitorial, food, laundry and delivery, are excluded.

Sources

• OSHA, Multi-Employer Citation Policy, CPL 2-0.124, effective December 10, 1999: osha.gov/enforcement/directives/cpl-02-00-124 (checked October 29, 2026).
• OSHA, 29 CFR 1910.119, Process safety management of highly hazardous chemicals, paragraph (h) Contractors: osha.gov/laws-regs/regulations/standardnumber/1910/1910.119 (checked October 29, 2026).