Your certificate covers your control of subcontracted work. A subcontractor holding their own ISO certificate is an input to that control rather than a replacement for it, and certifying you does not certify them. Three clauses carry the obligation: ISO 9001 clause 8.4, ISO 14001 clause 8.1 and ISO 45001 clause 8.1.4. They ask different things of you, so an arrangement that satisfies one of them can produce a finding against another.
What each standard asks for
ISO 9001 clause 8.4 applies wherever a process, or part of a process, is provided by an external provider as a result of a decision you took. Clause 8.4.1 asks for criteria for the evaluation, selection, monitoring of performance and re-evaluation of those providers, and for documented information on the results. Clause 8.4.2 asks you to define the type and extent of control you apply, scaled to the effect the provided process has on conformity. Clause 8.4.3 asks that the requirements you communicate to the provider are adequate before you send them, covering approval, competence, interaction with your system and any verification you intend to carry out at their premises.
ISO 14001 clause 8.1 requires that outsourced processes are controlled or influenced, and that the type and extent of that control or influence is defined within the environmental management system. The same clause asks you to determine environmental requirements for the procurement of products and services, and to communicate relevant environmental requirements to external providers, contractors included.
ISO 45001 clause 8.1.4 splits into three. Clause 8.1.4.1 covers procurement generally. Clause 8.1.4.2 covers contractors, and asks you to coordinate your procurement process with them so that hazards are identified and OH&S risks controlled in both directions: the risks their activities create for your organization, and the risks your activities create for their workers, along with the effect of their work on anyone else in the workplace. It also asks you to define and apply OH&S criteria for the selection of contractors. Clause 8.1.4.3 covers outsourced functions and processes, which have to be controlled, with the type and degree of control defined in the system and the arrangements consistent with legal and other requirements.
The difference that catches organizations out is the scaling. ISO 9001 lets you apply lighter control where the provided process has little effect on conformity. ISO 45001 offers no equivalent trade, because the risk arrives in your workplace at whatever size the contract is. A two-day scaffolding subcontract can be a minor entry in a quality supplier file and a significant one in the OH&S system, and both readings are correct.
The findings we raise
The approved supplier list with nothing behind it. Names, trades, sometimes a trade license number, and no record of what qualified any of them or when they were last looked at again. Clause 8.4.1 asks for the criteria and for the results of applying them, and a list on its own evidences neither.
The subcontractor's certificate used as the whole evaluation. Their certificate is evidence about their management system, in the scope printed on it, on the day you checked it in the issuing body's register. It belongs in the file. It says nothing about the type and extent of control you decided to apply to their work, which clause 8.4.2 asks you to define, so a file holding the certificate and no control decision draws a finding against 8.4.2.
Requirements that stop at the commercial terms. The subcontract agreement carries price, program and scope of works. The waste segregation and dewatering conditions attached to the site's permit, and the site OH&S rules, sit in an induction pack that was never made a contract requirement. ISO 14001 clause 8.1 asks for relevant environmental requirements to be communicated to external providers. Where a contractor was selected on price by a procurement team working to no defined OH&S criteria, we raise that against clause 8.1.4.2, and it sits against the procurement process rather than against the site team.
Monitoring that begins after something has gone wrong. Clause 8.4.1 asks for monitoring of performance, which is an ongoing activity with a defined frequency. A subcontractor file holding nonconformance reports and no periodic review evidences a reactive process, and the re-evaluation half of the clause has no records at all.
Supplied labor treated as your own staff for some purposes and as somebody else's for others. ISO 45001 defines a worker as a person performing work under the organization's control, which reaches a contractor's or a labor supplier's people on your site. Consultation under clause 5.4 and competence under clause 7.2 apply to them, and an incident involving one of them, on work under your control, is investigated under your clause 10.2 process. Auditors interview non-managerial workers directly, and those interviews are not confined to your payroll.
What the certificate then evidences
Subcontracting a process keeps it inside your management system, so the scope on your certificate covers work you deliver through others under your control. The certification stops there. Your subcontractor's name does not appear on your certificate, and nothing in our audit of you produces a conclusion about their system.
For a buyer reading a main contractor's certificate, that boundary is the useful part. The certificate evidences that the contractor operates a system for controlling subcontracted work, and that we sampled it against these clauses at the audits behind the current cycle. Where a particular subcontractor's certification matters to your contract, that certificate has to be checked on its own, in the register of whichever body issued it.
Our public register returns the standard edition, scope, validity dates and current status for every certificate we have issued, against the three standards EIAC and ANAB accredit us for: ISO 9001, ISO 14001 and ISO 45001. For a certificate issued by another body, the current status sits with that body, and its own register is where to look.
On construction and contracting work, subcontractor prequalification, control and site induction records are among the things we look at, and we schedule at least one audit on active works while work is underway. A prequalification file that reads correctly at head office, alongside a crew on site that morning whose induction record cannot be produced, is where ISO 45001 clause 8.1.4.2 gets tested.