OSHA Subcontractor Document Management: Every Record GCs Must Maintain in 2026

Documentation Is Your Primary Defense

Under OSHA's Multi-Employer Citation Policy, a GC cited as a controlling employer can contest the citation by demonstrating "reasonable diligence" in identifying and addressing hazards. The evidence for that defense comes entirely from documentation. Without records showing you had a system in place, that you used it consistently, and that you took corrective action when gaps were found, the citation stands.

In fiscal year 2025, controlling employers successfully contested 41% of multi-employer citations where they could produce comprehensive documentation of their oversight activities. When documentation was incomplete or missing, the contest success rate dropped to 8%. The records you maintain are not bureaucratic overhead; they are your legal defense strategy.

The Complete OSHA Sub Document Inventory

The documents a GC should maintain for subcontractor oversight fall into four categories: pre-mobilization records, training and certification records, ongoing oversight records, and incident records.

Pre-Mobilization Records

Training and Certification Records

For every sub worker on site, maintain copies of: OSHA 10 or 30-hour training completion cards, fall protection training certificates, equipment operator certifications (forklift per 1910.178, crane per Subpart CC, aerial lift per 1926.453), trade-specific certifications required by scope, scaffold competent person designations per 1926.451, confined space entry training certificates for applicable scopes, first aid/CPR certifications for designated responders, and respiratory fit test records where applicable.

The key detail many GCs miss: you need to maintain copies of these records in your own system, not just rely on the sub to produce them during an inspection. OSHA expects the controlling employer to have verified these records proactively. A certification tracking platform centralizes these records so you can retrieve any worker's certification history in seconds.

Ongoing Oversight Records

This is the category most GCs underdocument, and it's the most important for multi-employer citation defense:

Incident and Exposure Records

When incidents involve sub workers, the GC must maintain: incident investigation reports (even for near-misses), the sub's completed accident reports, workers' compensation claim records relevant to the incident, corrective action plans implemented after the incident, and any OSHA 301 incident reports if the injury is recordable. Note that the GC typically does not record sub employee injuries on the GC's OSHA 300 log (subs maintain their own), but the GC should document the incident and any oversight actions taken in response.

Document Retention: How Long to Keep What

OSHA's record retention requirements vary by document type. As a rule: safety training records should be retained for the duration of employment plus 3 years, exposure records (chemical, noise, respirable dust) must be retained for 30 years per 29 CFR 1910.1020, OSHA 300 logs and related forms must be retained for 5 years beyond the calendar year they cover, and general project safety records should be retained for at least 5 years after project completion.

For subcontractor records specifically, retain all documentation for a minimum of 5 years after the sub's last day on site. This covers the typical statute of limitations for OSHA citations (6 months) plus a comfortable margin for litigation, insurance claims, and project owner audits. See our complete document retention guide for industry-specific retention schedules.

Tracking OSHA 10/30 Cards for Sub Workers

OSHA 10 and 30-hour Outreach Training Program cards are among the most commonly requested certifications during construction site inspections. While OSHA does not mandate the 10/30-hour training for all construction workers at the federal level, many states (New York, Connecticut, Massachusetts, Missouri, Nevada, New Hampshire, Rhode Island, and West Virginia) require it by law, and most project owners and GCs require it contractually.

The tracking challenge is scale. A GC with 20 subs averaging 10 workers each needs to verify and track 200 OSHA cards. Workers rotate between projects, new workers join mid-project, and replacement cards from OSHA can take 4 to 6 weeks to arrive (creating a verification gap for recently trained workers). A digital tracking system that stores card images, tracks expiration dates (where applicable by state or GC policy), and flags workers without verified cards is essential at this scale.

Digital vs. Paper Document Management

Paper document management (binders in the jobsite trailer) creates three problems that digital systems solve:

• Retrieval speed: During an OSHA inspection, the inspector may ask for a specific sub worker's fall protection training record. In a paper system, finding that record takes 10 to 30 minutes of searching through binders. In a digital system with searchable metadata, it takes 10 seconds.
• Disaster recovery: Jobsite trailers are stolen, catch fire, and flood. When the binder is destroyed, the documentation is gone. Digital systems with cloud storage eliminate this risk entirely.
• Multi-site visibility: Paper binders are location-specific. A GC's home office has no visibility into the compliance documentation at any given jobsite without physically visiting. Digital systems provide real-time compliance visibility across all projects from anywhere.

The transition from paper to digital doesn't require replacing your entire workflow at once. Start with certifications and insurance (the documents with expiration dates that create the highest citation risk), then expand to safety program documents and oversight records. Most GCs complete the transition within 60 to 90 days. For insurance-specific guidance, see our COI tracking and insurance verification guide.

Organizing Documents for OSHA Inspection Readiness

When OSHA arrives for an inspection (whether planned or surprise), the CSHO (Compliance Safety and Health Officer) will typically request documents in this order:

1. OSHA 300 log and 301 forms for the current and previous calendar year
2. Written safety program for both the GC and any subs whose work areas are being inspected
3. Training records for workers in the inspection area (OSHA 10/30 cards, fall protection, equipment operator certs)
4. JHAs for the specific work activities being observed
5. Inspection and corrective action records demonstrating the GC's ongoing oversight

Your document management system should be organized to produce any of these categories in under 2 minutes. If it takes longer, the inspector's perception of your program's rigor decreases, which can influence citation severity. An audit preparation checklist can help ensure you're inspection-ready at all times. For construction-specific OSHA audit preparation, including the top 10 cited standards and multi-employer defense strategies, see our construction OSHA audit preparation guide.

How FileFlo Manages OSHA Sub Documentation

FileFlo's document management capabilities are purpose-built for the multi-employer construction environment:

• Structured document taxonomy: Every sub document is categorized by type (certification, insurance, safety program, inspection report) with searchable metadata including worker name, sub company, project, and expiration date.
• AI-powered processing: Upload a stack of OSHA 10 cards and FileFlo automatically extracts names, card numbers, and completion dates without manual data entry.
• Retention automation: Documents are retained according to configurable retention schedules. No manual deletion or archiving required.
• Inspection-ready export: Generate a complete compliance package for any sub, project, or worker in under 60 seconds, formatted for OSHA or project owner review.
• Timestamped audit trail: Every document upload, notification, and corrective action is logged with timestamps, building your multi-employer citation defense automatically.