Can a Construction Company Get ISO Certification If It Uses Subcontractors?
- Jul 14
- 6 min read
Many construction and engineering businesses rely heavily on subcontractors.
Electrical work, groundworks, scaffolding, specialist installation, design support and site labour may all be delivered by external providers rather than permanent employees.
That often raises an important question when the business starts considering ISO certification:
Can we still become certified if subcontractors carry out a significant part of our work?
The answer is yes.
Using subcontractors does not prevent a business from achieving ISO 9001, ISO 14001 or ISO 45001 certification. However, the company still needs to demonstrate that outsourced work is properly selected, controlled and monitored.
You can outsource an activity.
You cannot outsource responsibility for the outcome.
The short answer
A construction company can achieve ISO certification even if much of its work is completed by subcontractors.
The auditor will not expect every person working on your projects to be directly employed by you. Subcontracting is a normal and established part of the construction sector.
What the auditor will expect is evidence that you remain in control of the work being delivered on your behalf.
That normally means showing how subcontractors are:
selected and approved
given clear requirements
checked before starting work
monitored while work is underway
reviewed after completion
The level of control should reflect the risk and importance of the outsourced activity.
Why subcontractors matter during an ISO audit
ISO certification applies to the organisation and the activities included within its certification scope.
If your company promises a client that it will deliver a completed project, you remain responsible for meeting that commitment—even where parts of the work are subcontracted.
An auditor may therefore look at whether subcontractors are capable of meeting your requirements for:
quality
health and safety
environmental performance
legal and contractual compliance
This does not mean you need to manage every subcontractor exactly as you would an employee.
It means you need a sensible and proportionate process for ensuring external providers do not introduce uncontrolled risks into your projects.
What ISO 9001 expects
Under ISO 9001, subcontractors and external suppliers are normally considered external providers.
The organisation needs to decide what controls are necessary based on the effect the outsourced work could have on the final product or service.
For a construction company, this might involve reviewing:
previous experience and references
technical competence
qualifications and trade certifications
insurance
ability to meet project specifications
previous quality performance
A subcontractor carrying out minor, low-risk work may require relatively simple checks.
A specialist contractor responsible for a critical structural, electrical or fire-safety element would normally require much stronger controls.
The approach should be based on risk rather than applying the same paperwork to every supplier.
What ISO 45001 expects
Subcontractors are particularly important under ISO 45001 because they may be exposed to, or introduce, significant health and safety risks.
The organisation will need to demonstrate that contractors are brought into its health and safety arrangements rather than being treated as completely separate from them.
Depending on the work, this may include:
checking competence before appointment
reviewing risk assessments and method statements
providing site inductions
communicating emergency arrangements
confirming PPE requirements
monitoring work on site
including contractors in relevant consultation and coordination
An auditor may also want to see how the company responds when a subcontractor fails to follow site rules or agreed safe systems of work.
Simply asking a subcontractor to sign a form is unlikely to be enough if there is no evidence that their performance is monitored in practice.
What ISO 14001 expects
Subcontractors can also have a significant effect on environmental performance.
They may generate waste, handle fuels or chemicals, operate plant, create noise or dust, or carry out work close to sensitive environments.
Where those impacts are associated with your projects, your environmental management system should address them.
Controls might include:
communicating site environmental rules
setting waste-management requirements
checking licences and waste documentation
controlling spill and pollution risks
monitoring subcontractor activities
recording and addressing environmental incidents
Again, the expectation is not that every subcontractor has an identical environmental system.
The expectation is that your organisation understands the risks and applies appropriate controls.
Do your subcontractors need their own ISO certification?
Not necessarily.
Your subcontractors do not automatically need to hold the same ISO certifications as your company.
In some cases, a client or contract may require key suppliers to be certified. In others, your own supplier evaluation and monitoring process may be sufficient.
The decision should be based on factors such as:
contractual requirements
the risk of the activity
the importance of the subcontracted work
legal or industry-specific expectations
the subcontractor’s past performance
Requiring every small trade contractor to hold multiple ISO certificates may be unrealistic and unnecessary.
However, for critical or high-risk activities, independent certification may provide useful additional assurance.
What evidence might an auditor ask to see?
During an ISO audit, the auditor may select one or more live or recently completed projects and follow the subcontracting process through from appointment to completion.
They may ask to see:
an approved supplier or subcontractor list
completed supplier evaluations
competence and insurance checks
purchase orders or subcontract agreements
project specifications
RAMS and induction records
inspection or monitoring records
records of defects, incidents or complaints
subcontractor performance reviews
The purpose is not to confirm that you have a large quantity of paperwork.
It is to verify that the controls you describe are genuinely being used.
The common mistake: approving subcontractors once and never reviewing them
Many businesses carry out checks when a new subcontractor is first appointed but do little afterwards.
The insurance certificate is saved. Qualifications are checked. The company is added to an approved list.
Then the approval remains in place indefinitely.
This can create problems because circumstances change.
Insurance expires. Staff change. Performance declines. New types of work are allocated without checking whether the subcontractor remains suitable.
A stronger approach is to review subcontractors based on real performance.
That might include:
quality of completed work
reliability and communication
safety performance
environmental compliance
defects or rework
client or site-manager feedback
The review does not need to be complicated. It needs to produce a meaningful decision about whether the subcontractor should continue to be used.
Another mistake: assuming the main contractor controls everything
Some subcontractors assume that because they are working under a principal contractor, responsibility for management systems sits entirely with the company above them.
That is not always the case.
Each organisation remains responsible for the activities within its own control and for meeting the commitments it makes to clients.
Similarly, a principal contractor cannot simply assume that subcontractors will manage themselves.
Roles, requirements and interfaces need to be clear.
This is especially important where several businesses are working together on the same site and one company’s activities can affect another.
Will using subcontractors increase audit time or certification cost?
It can affect the complexity of the audit, but it does not automatically make certification significantly more expensive.
The certification body will consider factors such as:
the number of direct employees
the extent of subcontracted activity
the risk and complexity of the work
the number and location of active sites
the standards being assessed
A business with five employees coordinating dozens of subcontractors may be more complex to audit than its payroll figure initially suggests.
This is why the certification body should understand how the organisation actually delivers its services before calculating the audit programme.
What should your certification scope say?
The scope of certification should describe the activities your organisation controls and is responsible for delivering.
It should not create the impression that you directly carry out every trade where this is not the case, but it should still reflect the complete service provided to clients.
The wording needs to be accurate enough to withstand scrutiny from:
auditors
procurement teams
clients
framework assessors
A poorly worded scope can cause confusion later, particularly if the certificate is being used as part of a tender submission.
It is therefore worth discussing the scope carefully before certification begins.
Can subcontracting actually support certification?
Yes.
A well-managed subcontractor network can demonstrate that the business has effective controls over its supply chain.
ISO does not require every capability to sit permanently inside the organisation.
It requires the business to understand:
what has been outsourced
why it has been outsourced
what risks this creates
how those risks are controlled
whether the required result was achieved
For many construction companies, this is a far more realistic model than trying to employ every specialist trade directly.
Not sure whether your subcontracting arrangements are ready for audit?
If your business relies on subcontractors, ISO certification is still entirely achievable.
The key is being able to demonstrate that outsourced activities are managed as part of your overall system rather than sitting outside it.
Our free ISO readiness check can help you understand:
which ISO standards are relevant to your business
whether your existing controls are likely to support certification
where gaps may exist in subcontractor management
what your next step should be
Final thought
Using subcontractors does not prevent a construction or engineering business from achieving ISO certification.
In fact, auditors expect subcontracting to form part of how many companies operate.
What matters is control.
Your business does not need to carry out every activity itself, but it does need to know who is working on its behalf, what is expected of them and whether the finished work meets the required standard.
A well-managed subcontractor network can strengthen your business.
An uncontrolled one can create quality, safety, environmental and commercial risks that no certificate can hide.
Comments