What the Research Actually Found About Contractor Governance

How I went looking for the gap

Part 1 of this series described the question behind my MSc research: why contractor safety can look solid at site level and still leave an organization unable to answer basic questions about its own risk. To actually test that, rather than just assert it, I ran a mixed-methods study inside the organization I work for: semi-structured interviews with people directly involved in contractor management, a contractor governance maturity survey, and a review of the actual contractor management documentation we use, like pre-qualification processes and HSE contract terms.

I'm deliberately not sharing survey scores or quoting interviewees in this article. Not because the numbers were dramatic, they weren't, but because specific figures would identify the organization, and the pattern matters more than the exact number attached to it. What follows is what came up again and again, described the way it would apply to most organizations running contractor safety this way, not just mine.

Safety that depends on who's running the project

The clearest theme across every interview was that contractor safety management is well established at the operational level but structurally inconsistent above it. Procedures exist. Expectations are generally understood. But how well any of it actually gets applied depends heavily on the individual project manager or site lead in charge at the time, rather than on a consistent organizational standard.

That's not really a story about weak leaders. It's what happens by default when governance doesn't exist to hold the line: the system quietly delegates consistency to whoever happens to be in the room, and consistency becomes a matter of individual judgment instead of organizational design.

Nobody quite owns it

The second theme was about ownership, and this one surprised me a little in how consistently it came up. Contractor safety responsibilities sit across three functions in most organizations like mine: supply chain, which usually owns pre-qualification and commercial terms; operations, which runs day-to-day supervision; and HSE, which provides technical guidance and audits. On paper that division makes sense. In practice, several people I spoke with described operational teams having outsized influence over safety decisions specifically because HSE's independence in that arrangement is weaker than it looks. When the function closest to delivery pressure also has the loudest voice on safety trade-offs, independence becomes theoretical.

Pre-qualification as paperwork, not as a risk tool

Every organization I've worked with runs some form of contractor pre-qualification: checking documentation, certifications, past safety performance. What came through clearly in the research is that this process, however thorough it looks, is often applied uniformly rather than proportionally. A contractor doing the highest-risk work on a site and a contractor doing low-risk general labor can go through functionally the same evaluation, because nothing in the process forces a distinction based on actual hazard exposure.

That's a subtle failure mode. It doesn't look broken from the outside, because the paperwork is being done. But a pre-qualification process that doesn't differentiate by risk isn't really a risk-based tool. It's an administrative gate that happens to sit in front of a risk-based activity.

Assurance that depends on the people it's meant to check

This is the gap I found most uncomfortable, honestly, because it's the one closest to my own function. Contractor safety performance gets monitored mainly through operational activity: site supervision, inspections, toolbox talks, incident reports. All useful. None of it independent. HSE audits exist too, but they tend to be project-specific rather than part of a structured, organization-wide assurance layer.

The practical effect is that the people checking whether contractor safety is working are often the same people responsible for delivering the work on schedule. That's not a conspiracy or a failure of integrity, it's a structural conflict that governance is specifically supposed to resolve, and in its absence, doesn't.

Strong at the start, weaker at the handover points

Contractor governance in most organizations is strongest during construction and installation, when everyone's attention is on the project. It tends to weaken during commissioning, maintenance, and outage work, which are exactly the phases where high-energy hazards, simultaneous operations, and less familiar teams tend to concentrate. The gap isn't usually a deliberate decision to relax oversight. It's what happens when governance is tied to project phases informally instead of being built to travel with the contractor across the whole lifecycle.

Lessons that stay local

Incidents get investigated at the project level almost everywhere I looked, which is good practice. What's inconsistent is whether the lessons from one project's incident ever reach the people making contractor decisions on a different project. Without a structured way to aggregate that data, an organization can have a genuinely strong culture of local investigation and still fail to learn systemically, because nothing carries the insight from one context into the next contractor selection decision.

Senior leaders who see the summary, not the pattern

The last recurring theme was about visibility at the top. Senior management engagement with contractor-specific safety trends was consistently described as limited, not from a lack of interest, but because nothing in the system routinely brings contractor governance up to that level for review. Contractor risk ends up managed almost entirely at the project execution level, which means the people with the authority to fix a structural gap are often the last to know one exists.

Seven different symptoms, one underlying pattern

Read individually, each of these seven gaps looks like a local, fixable process issue. Read together, they describe the same thing from different angles: an organization that manages contractor safety operationally, project by project, without a governance layer sitting above it to align risk, ownership, oversight, and learning. That's what Part 3 of this series is actually about, the model I built as a direct response to these seven gaps rather than as a separate idea layered on top of them.