Contractor Safety Needs Governance, Not Just Supervision
A personal reflection on my MSc research into contractor HSE governance in heavy industry, and why a site that runs safely can still leave an organization blind to its own risk.
A question I couldn't shake
I work in HSE for a global hydropower equipment manufacturer, and about two years ago a fairly ordinary observation started bothering me more than it should have. Our contractor safety was, by most measures, in good shape. Site supervision worked. Toolbox talks happened. Incidents got investigated. And yet whenever I tried to answer a simple question, "how well are we actually governing contractor risk across the whole business," I didn't have a confident answer. Neither did most of the people I asked.
That gap became the subject of my MSc project in Occupational Health and Safety Management at the University of Portsmouth: a work-based research study into contractor HSE governance, built around real interviews and a maturity survey inside the organization I work for. This is the first of four articles reflecting on that research, written for anyone in a similar position rather than as an academic summary. I've kept the findings general and left out anything identifying about my employer, because the pattern I found is not unique to one company. If anything, that's the point.
Operational safety and governance are not the same thing
The distinction that ended up organizing the whole project is a simple one, but it took me a while to see it clearly. Operational management is what happens at the site: executing tasks safely, supervising the work, running inspections, responding to incidents. Governance is something else. It's what defines who owns contractor risk, how that risk gets independently checked, how performance is monitored across projects rather than within one, and whether the organization actually learns anything from what goes wrong.
Most organizations, including mine, are reasonably strong at the first thing and much weaker at the second. That's not a criticism of the people doing the work. Frontline teams can be doing everything right and the organization can still be structurally blind, because nobody above the project level is aggregating what's happening, comparing it across sites, or holding anyone accountable for the pattern rather than the incident.
What happens when governance is missing
Once I started looking for it, the absence of governance showed up in a few consistent ways. The organization ends up relying on frontline supervision as its main line of defense, which sounds reasonable until you remember that frontline supervision is also the layer under the most schedule pressure. Safety standards start to vary with whoever happens to be leading a given project, rather than being set consistently from above. And because nobody is aggregating contractor risk data across the business, a problem that shows up on three different projects gets treated as three unrelated local issues instead of one systemic one.
This isn't a new idea in safety research. James Reason's work on organizational accidents describes exactly this: serious failures are rarely caused by a single frontline error, but by latent conditions sitting further back in the system, often invisible until something goes wrong (Reason, 1997). Andrew Hopkins makes a related point specifically about paperwork: an organization can have every procedure written down and still lack any real oversight of whether those procedures reflect what's actually happening on site, a pattern he calls "paper safety" (Hopkins, 2019). Hale and Borys describe the same gap another way, as the distance between work-as-imagined and work-as-done (Hale & Borys, 2013). All three are describing the same blind spot from different angles: procedures and supervision are necessary, but they are not the same thing as oversight.
Why this matters more in heavy industry
Contractor safety in complex, high-energy environments carries a specific kind of pressure. Heavy mechanical lifting, confined space entry, high-energy systems during commissioning, several contractors working simultaneously in the same space: these aren't hazards you can fully manage through a generic site induction and a supervisor's judgment. Industry guidance on this kind of work is explicit that these risks need to be built into contractor selection and capability assessment from the start, not just addressed after the contractor is already on site (vgbe energy, 2022).
Most organizations do address these risks somewhere, usually in the project-level risk assessment. What's often missing is the link between that risk assessment and how contractors get evaluated, tiered, and monitored at the governance level. A contractor doing the highest-risk work on a project can go through the same generic pre-qualification process as one doing low-risk general labor, simply because nothing in the system forces a distinction. That mismatch, between where the real risk sits and where the governance attention goes, is where I decided to focus the rest of the research.
What comes next
The rest of this series follows the shape of the project itself. Part 2 covers what the interviews and survey actually found, described in general terms without any identifying detail. Part 3 walks through the governance model I proposed as a response, including how it tiers contractors by risk and separates execution from independent assurance. Part 4 is the most personal part: what I think it actually takes to implement something like this, and what I'd tell someone trying to build organizational buy-in for it, not just the design.
None of this is a claim that any particular organization is doing safety badly. My own employer's operational safety is genuinely solid, which is exactly what made the governance gap interesting to study: it's not a story about failure, it's a story about a layer of the system that most organizations haven't built yet, and don't necessarily know is missing.
Sources & Further Reading
- UK HSE: Managing contractors, HSG159 (2021 guidance)
- ISO 45001:2018: Occupational health and safety management systems
- Reason, J. (1997). Managing the Risks of Organizational Accidents. Ashgate.
- Hopkins, A. (2019). Organisational Culture and Major Hazard Risk: Interpreting Concepts and Practices.
- Hale, A., & Borys, D. (2013). Working to rule, or working safely? Procedures and safety. Safety Science, 55, 207-221.
- vgbe energy: Hydropower plant safety guidance (2022)
Author: Myaser Ibrahim, MSc Occupational Health and Safety Management, University of Portsmouth.
Last reviewed: August 31, 2026.
Disclaimer: This article reflects general findings and personal views drawn from independent MSc research and does not name, describe, or represent any specific employer. Details have been generalized throughout. It provides general HSE education and does not replace applicable law, standards, or competent professional advice for your specific operation.