A scaffold crew is three days into a turnaround at your plant. On your Tuesday walkthrough you find an unprotected leading edge on the mezzanine where their people are staging material. You point it out to the foreman, note it on your walkthrough sheet, and he agrees to take care of it. Thursday, same edge, same finding, same conversation. The following Tuesday, again. Your documentation is clean: three dated entries, three verbal notifications, three commitments to correct.
Then a compliance officer walks that mezzanine and sees what you saw. The scaffold contractor gets cited. So do you.
The instinct is that the paper trail protects you. Under OSHA’s multi-employer citation policy it can do the opposite, because what it documents is that you knew and kept working anyway. Construction and extraction occupations alone accounted for 1,032 fatal work injuries in 2024, and much of that work happens on somebody else’s site under somebody else’s contract. Host employers are squarely inside that exposure.
What Makes You a Controlling Employer
OSHA’s Multi-Employer Citation Policy (CPL 02-00-124), in effect since December 1999, sorts every employer on a shared worksite into one or more of four roles: creating, exposing, correcting, and controlling. A controlling employer is one with general supervisory authority over the worksite, including the power to correct safety violations itself or require others to correct them. That authority can come from your contract language, and it can also come from how you actually behave on site even when the contract is silent.
Two points of nuance matter here. First, this is an enforcement directive rather than a standard; the duties it describes arise from your existing obligation to comply with OSHA standards and to exercise reasonable diligence. Second, the directive is explicit that the bar for a controlling employer is lower than the bar for protecting your own employees. You are not expected to inspect contractor work as often as you inspect your own, or to match a specialty trade’s technical expertise.
The Three Things Reasonable Care Actually Requires
When OSHA evaluates whether a controlling employer exercised reasonable care, the directive points inspectors at three questions: did the employer conduct periodic inspections at an appropriate frequency, did it implement an effective system for promptly correcting hazards, and did it enforce the other employer’s compliance through an effective, graduated system of enforcement and follow-up inspections.
Most host programs handle the first well, the second unevenly, and the third not at all. Building all three is less about adding paperwork than about deciding in advance what happens when a finding does not close.
Building Contractor Oversight That Meets the Reasonable Care Standard
OSHA names three factors: the scale of the project, the nature and pace of the work including how fast the hazards change, and what you already know about that contractor’s safety history and expertise.
The directive calls for greater frequency at the beginning of a project when you have never worked with a contractor and do not know its compliance history.
“Told the foreman” is not a correction system. A finding with no owner and no deadline has no mechanism to close.
This is the step most programs skip, and the one that decided the outcome in OSHA’s own worked examples.
Close the finding on evidence that the hazard is gone, and keep the verification record with the original finding.
Derived from: OSHA, CPL 02-00-124, Multi-Employer Citation Policy
Where Host Programs Break Down
The directive works through two examples that land on opposite sides of the line, and the difference between them is instructive. In one, a general contractor inspects often enough, finds fall protection violations repeatedly, points them out each time, and takes no further action. It is citable. In the other, a host employer runs weekly inspections, holds phone discussions with the contractor, reviews the contractor’s own inspection reports weekly, and has a graduated enforcement system it has actually applied. A respiratory protection violation occurs two days before the next scheduled inspection and OSHA arrives the next day. That host is not citable.
Documented Versus Defensible
| Documenting the hazard | Exercising reasonable care |
|---|---|
| Finding is noted on a walkthrough sheet | Finding is assigned to a person with a close-out date |
| Hazard is raised verbally with the crew foreman | Repeat hazard escalates in writing to contractor management |
| Same item reappears across three inspections | Affected task stops until the hazard is corrected |
| Correction is closed on the foreman’s word | Correction is closed on a verified follow-up inspection |
Neither of those employers failed at finding hazards. What separated them was what happened after the finding. And that is worth sitting with, because it reframes the mezzanine scenario. When a contractor crew keeps working next to an unprotected edge, the honest read is not that those workers are careless. They are on a fixed-price schedule where the correction costs them time, and nothing in their relationship with you makes leaving it uncorrected more expensive than fixing it. The system put them on that edge. A graduated enforcement ladder is how you change the arithmetic.
Build the Enforcement Ladder Before You Need It
A workable ladder has four rungs, and each one has to be real. First rung: a written finding with an owner and a due date. Second: written notice to contractor management, above the field supervisor, with a follow-up inspection scheduled. Third: a stop-work on the affected task until the hazard is corrected and verified. Fourth: removal of the crew or the company from the site, with the correction performed by other workers and back-charged.
That last rung only exists if your contract gives it to you. OSHA’s favorable example turns partly on the host having the contractual right to have non-compliance corrected using other workers and to back-charge for that work. Negotiate those terms at award, alongside the inspection and audit expectations you will hold the contractor to, rather than during the argument that follows the third repeat finding.
If Your Process Is PSM-Covered, the Bar Is Written Into the Standard
For contractors doing maintenance, repair, turnaround, major renovation, or specialty work on or adjacent to a process covered by process safety management, 29 CFR 1910.119(h) converts good practice into a written requirement. When selecting a contractor you must obtain and evaluate information on its safety performance and programs. You must periodically evaluate contract employers on how they are meeting their own obligations. You must maintain a contract employee injury and illness log for their work in process areas. The contractor, for its part, must train each employee in the work practices needed to do the job safely, instruct them on the fire, explosion, and toxic release hazards and the emergency action plan, and document that it did so.
One carve-out worth knowing: paragraph (h) does not reach contractors providing incidental services that do not influence process safety, such as janitorial work, food and drink service, laundry, or delivery. That distinction is narrower than teams often assume, so read the scope against the actual scope of work rather than the vendor category.
How Contractor Management Can Help
Quantum’s Contractor Management module is built around the part of this that programs usually leave to memory and goodwill. Once a work permit is approved, the system generates a recurring work inspection task to the project in-charge and to the responsible person for that location, so oversight frequency is a configured setting rather than something that depends on how busy the week gets. When an inspection records a significant non-compliant finding, the affected work is automatically suspended until the related corrective actions are closed. That is the graduated consequence the directive looks for, applied by the system instead of by a difficult conversation on the floor.
Corrective actions can be assigned to the contractor’s own users, who work them through a review loop in the contractor portal, so the close-out is evidence rather than an assurance. Required compliance documents are tracked per company, per person, and per project, with expiry reminders that start well before a certificate lapses. If you want to see how that maps to your own contractor population, talk it through with our EHS team.
