Subcontractor Compliance Checklist: 29 Items Every GC Must Collect (2026)
Quick Answer
A subcontractor compliance checklist is a structured list of documents, certifications, and insurance requirements that a general contractor must collect and verify from each subcontractor before allowing them to begin work and throughout the project lifecycle.
A GC found to be the controlling employer on a worksite can be cited for a subcontractor's violation under OSHA's multi-employer policy — even with zero direct control over the hazard. The only defense is documented evidence that you collected the right paperwork, verified it, and monitored it throughout the project. This is that checklist: 29 items, organized by phase, with OSHA citation risk notes on the ones most commonly missing at inspection time.
29
Required Items
Multi-Employer
OSHA Liability Risk
$1M/$2M
COI Minimum Limits
12 Months
Update Every Year
In This Checklist
Why This Checklist Exists
"A GC found controlling a worksite can be cited for a sub's violation under OSHA's multi-employer policy — even with zero direct control over the hazard (OSHA CPL 02-00-124). The GC's only defense is documented evidence of a systematic compliance monitoring program." Use this checklist to build that evidence.
The Pre-Hire Checklist (Before Work Begins)
The pre-hire phase is the most important stage of subcontractor compliance management. Documents collected at this stage determine whether a sub is qualified to work on your project at all. Make completion of this checklist a hard gate — no documentation, no contract execution.
For a deeper explanation of each item and the verification process, see the full subcontractor compliance management guide.
Phase 1: Pre-Hire Documents (Items 1-8)
Must be complete before contract execution
Completed contractor prequalification questionnaire
Standardized form covering: scope capabilities, years in business, project references, key personnel, bonding capacity, safety program overview, and OSHA citation history.
Certificate of Insurance (COI) — all required coverages
ACORD 25 form showing CGL, workers' comp, commercial auto. Your company listed as Additional Insured. Policy limits meeting project requirements. See Section 2 for full COI checklist.
Additional insured endorsement form
Actual endorsement (CG 20 10, CG 20 37, or equivalent) — not just the ACORD 25 certificate. Verify coverage extends to completed operations for structural, waterproofing, or roofing subs.
Experience Modification Rate (EMR) verification letter
Letter on insurance carrier or broker letterhead confirming current-year and two prior-year EMRs. Request directly from carrier — do not accept sub's self-reported number.
OSHA 300A annual injury logs — 3 years
The annual summary form required by OSHA for employers with 10+ employees. Three years allows trend analysis. Unusually low incident rates warrant follow-up questions.
Written safety program
Company-wide safety program document. Must include: hazard communication, fall protection, emergency action plan, incident reporting, and competent person designations. A one-page document does not qualify.
State contractor license (verified through state board)
Do not accept the sub's copy — verify directly through the state licensing board's online database. Confirm the license type matches the scope, is active, and is held by the contracting entity.
W-9 and business entity documentation
Confirms legal entity name and EIN. Cross-reference against the subcontract to ensure you're contracting with the licensed, insured entity — not a related entity with different coverage.
Insurance Documents Required From Every Subcontractor
Insurance documentation is the area where compliance gaps are most financially dangerous. A GC who allows uninsured work to proceed — even unknowingly — can face direct liability for claims that would otherwise be covered by the sub's policy. The minimum standard is five separate insurance verifications, each with specific content requirements.
Phase 2: Insurance Documents (Items 9-13)
Verify coverage limits, endorsements, and expiration dates
Commercial General Liability (CGL) — $1M/$2M minimum
Per occurrence limit of $1M, aggregate of $2M is the standard commercial minimum. High-risk projects or owner requirements may demand $2M/$4M or higher. Products and completed operations coverage must be included for any scope with post-completion defect exposure.
Verify: Your company as Additional Insured, not just Certificate Holder. Request endorsement form.
Workers' Compensation — statutory limits
Required by law in virtually every state for any sub with employees. Sole proprietors may claim exemption — obtain the exemption certificate in writing. Verify the policy covers the project state specifically for out-of-state subs.
Verify: Policy covers the project state. Employer's Liability limits shown (typically $500K/$500K/$500K minimum).
Commercial Auto Liability — $1M minimum
Required for any sub operating vehicles on or to/from the project site. Combined single limit of $1M is the standard minimum. Verify coverage applies to hired and non-owned vehicles if sub workers use personal vehicles for project work.
Verify: Covers all vehicles operated on-site, including hired and non-owned auto if applicable.
Umbrella/Excess Liability — $5M minimum for high-risk scopes
Required for structural steel, roofing, demolition, crane operations, and mechanical/electrical on large projects. The umbrella sits above CGL, auto, and workers' comp. Confirm it follows form and applies to all underlying policies.
Verify: Follows form over all underlying coverages. Required for structural, roofing, demolition scopes.
Professional Liability / E&O (for design-build subs)
Required for any sub providing design services: MEP engineers, specialty designers, design-build HVAC, or design-build roofing. Claims-made policy — verify retroactive date covers the full project scope history.
Verify: Required for design-build subcontractors. Retroactive date must precede project start.
How Audit-Ready Are You?
Take our 30-second compliance check to see where your system stands. No email required.
Safety Certification and Training Records
Worker-level certifications are the most granular — and most commonly incomplete — part of the checklist. A sub company can have a perfect safety record and still have individual workers on your site with lapsed certifications. Under 29 CFR 1926, the GC is responsible for ensuring that every worker on the site has the training required for the hazards present, regardless of who their employer is.
Certification records must be collected at the individual worker level. A sub roster with certification status must be updated whenever workers are added or rotated. For a full guide to individual certification tracking across a rotating workforce, see how to track subcontractor credentials.
Phase 3: Safety Certifications (Items 14-21)
Track at the individual worker level — not just company level
OSHA 10-Hour Training Card (Construction) — all workers
Required on virtually all commercial construction projects either by project owner specification or industry standard. Issued by OSHA-authorized trainer. No formal expiration per OSHA, but many owners require renewal every 5 years.
Regulation: 29 CFR 1926 / Owner requirement
OSHA 30-Hour Training Card — supervisors and foremen
Required for any sub worker in a supervisory role: foreman, superintendent, safety coordinator. No OSHA-mandated expiration, but renewal policies vary by owner. Verify the card is in the worker's name and lists a completion date.
Regulation: 29 CFR 1926 / Owner requirement
Fall Protection Training Certificate — all workers at heights
Required for any worker performing tasks at 6 feet or more above a lower level. Training must cover: fall hazard recognition, fall arrest system use, and rescue procedures. OSHA does not specify expiration, but annual refresher is industry standard and required by most project owners.
Regulation: 29 CFR 1926.503
Forklift Operator Certification — all forklift operators
Certification specific to the type of forklift being operated. Issued by employer after evaluation by qualified trainer. Expires every 3 years or after observed unsafe operation. Each operator must have a card for each forklift type they operate.
Regulation: 29 CFR 1910.178
Aerial/Scissor Lift (MEWP) Certification — all lift operators
Mobile elevating work platform certification per ANSI/SAIA A92.22. Separate certifications for different MEWP types (boom, scissor, vertical). Renewal every 3 years recommended; most project owners require 1-3 year renewal.
Regulation: ANSI/SAIA A92.22
Confined Space Entry Training — applicable workers
Required for all workers who enter permit-required confined spaces. Covers entrant duties, attendant duties, entry supervisor duties, and rescue procedures. Annual refresher training is required by standard practice and most project specifications.
Regulation: 29 CFR 1926.1213
First Aid/CPR Certification — designated responders
At least one first-aid trained and CPR-certified worker is required on each shift and at each jobsite location where workers are not in close proximity to an infirmary or clinic per 29 CFR 1926.50. First Aid renews every 3 years; CPR renews every 2 years.
Regulation: 29 CFR 1926.50
Site-specific safety orientation completion records
Documented proof that each sub worker completed the GC's site-specific safety orientation before accessing the jobsite. Records must include: worker name, employer, date, topics covered, and worker signature. Digital orientation systems with electronic signature are preferred for audit-ready records.
Regulation: OSHA multi-employer policy / project spec
License and Registration Documents
Licensing requirements vary significantly by state and trade. A sub that is legally licensed in Texas may not be authorized to perform the same work in Florida without separate registration or licensure. Verify licensing in the project state, not just the sub's home state. State contractor licensing boards maintain online databases — use them, and document the date and result of your verification.
Phase 4: License and Registration (Items 22-25)
Verify in the project state through official board databases
State contractor license — verified through state licensing board
Verify: license is active (not expired, suspended, or revoked); license type matches the contracted scope; license is held by the legal entity executing the subcontract; license is valid in the project state. Document verification date and database used.
Trade-specific licenses (electrical, plumbing, HVAC, fire protection)
Many trades require separate licensure beyond a general contractor license: licensed electrician (state-issued), master plumber (state-issued), HVAC contractor (varies by state), fire protection contractor (state fire marshal). Verify for each applicable trade scope.
Specialty certifications (asbestos, lead, mold — if applicable)
Asbestos abatement requires EPA AHERA accreditation and state licensing. Lead abatement on pre-1978 construction requires EPA RRP certification. Verify that the sub's personnel hold current individual certifications, not just the company license.
Vehicle registrations and CDL licenses (if applicable)
For subs operating commercial motor vehicles over 26,001 GVWR, DOT number registration and CDL verification for drivers. Concrete delivery, crane, and heavy equipment transport subs routinely fall under DOT requirements.
Ongoing Compliance: What to Re-Verify Annually
Compliance is not a one-time event. On a 12-month commercial project, most insurance policies will renew at least once, worker certifications will expire on rolling schedules that don't align with the project timeline, and sub workers will rotate in and out. The GC's ongoing monitoring obligation is as important as the initial collection — and it is where the most compliance gaps actually occur.
For a formal audit schedule, set calendar reminders at project start for every item's re-verification date, and activate automated expiration alerts in your compliance platform at 90, 60, and 30 days.
Ongoing Re-Verification (Items 26-29)
Active monitoring required — not a collect-once-and-forget system
COI renewal — at every policy renewal date during the project
Track each sub's policy expiration date. Request updated COIs 30 days before expiration. Suspend site access if an updated COI is not received by the expiration date. Document every request, reminder, and reinstatement.
Frequency: At each annual renewal
Worker certification updates — when new workers are added or certs expire
Maintain the sub roster and individual certification records. Flag any worker whose certification expires during the project. Require updated certification records before that worker continues working. Run a full roster re-verification at each project audit checkpoint.
Frequency: Ongoing / at project audits
Contractor license re-verification — annually
State contractor licenses can be suspended or revoked mid-project for non-payment of fees, disciplinary actions, or other causes. Re-verify in the state database at least annually on long-duration projects and whenever you have a reason to question a sub's standing.
Frequency: Annually
Updated safety program — if sub changes scope or safety practices
Require an updated written safety program from any sub who expands their scope of work, adds a high-hazard activity (confined space, lead, asbestos), or has a recordable incident on your project. The original safety program submitted at prequalification may not cover the evolved scope.
Frequency: As needed / annually on long projects
Audit Binder: What Inspectors Request
When OSHA arrives on your jobsite — whether in response to a complaint, a serious incident, or as part of a targeted inspection — they will request specific documentation for any subcontractor involved. The time to organize this documentation is before the inspection, not during it.
The "audit binder" concept means maintaining a project-level file for each subcontractor that contains all documents organized for rapid retrieval. In a digital compliance system, this is generated on demand. In a physical system, maintain a physical or cloud-accessible binder updated throughout the project.
Documents OSHA Typically Requests for Subcontractors
An OSHA inspector who receives a complete, organized compliance binder within minutes of a request sees a different GC than one who says "we'll have to look that up." The former demonstrates a systematic compliance program — the definition of reasonable diligence. The latter demonstrates an ad-hoc approach — which OSHA interprets as inadequate oversight. See our guide to OSHA construction violations in 2026 for the full citation process and penalty escalation framework.
See FileFlo In Action
Try our interactive demo with real compliance scenarios. See exactly how FileFlo works. Takes 2 minutes, no signup required.
Red Flags: When to Reject a Subcontractor's Compliance File
A complete file is table stakes. A file with the following red flags should trigger either a prequalification rejection or a mandatory cure period before contract execution. These are the patterns that experienced GC compliance teams use to identify high-risk subs before they become a citation event.
EMR above 1.0 for standard scopes, above 0.85 for high-risk work
Above-average injury rate indicates unsafe practices that will follow the sub to your project. Request a written explanation of recent incidents and corrective actions.
Action: Reject or require written safety improvement plan
OSHA citations in the past three years — especially willful or repeat
Willful violations indicate the sub knew about the hazard and ignored it. Repeat violations mean they didn't fix a previously cited hazard. Both indicate systemic safety management failures.
Action: Reject (willful/repeat) or require remediation evidence
COI that lists you as 'Certificate Holder' only — not 'Additional Insured'
Certificate Holder status provides only notification rights — not coverage. This is a common error on generic COIs that subs reuse across multiple projects.
Action: Return for correction before accepting
OSHA 300A showing zero incidents across multiple years with a workforce of 20+
Statistically improbable. May indicate underreporting, which is itself an OSHA violation. Request to discuss their incident reporting process.
Action: Request explanation and verify through insurance carrier
Written safety program that is clearly a template — company name is the only customization
A safety program that was never implemented is worse than no safety program — it creates evidence of a paper compliance system that OSHA views as bad faith.
Action: Request evidence of actual implementation: toolbox talk records, training logs
License that is active but held by a different legal entity than the subcontract
The licensed entity and the contracting entity may have different insurance, different financial standing, and different legal obligations. A claim against the contracting entity may not be covered by the licensed entity's insurance.
Action: Require clarification of entity relationship or contract with the licensed entity directly
Insurance limits below project owner or contract requirements
A sub with $500K CGL limits on a project requiring $1M minimum is providing insufficient coverage. The gap falls on the GC if a claim exceeds the sub's limits.
Action: Require COI update with compliant limits before execution
How to Automate This Entire Checklist
A GC managing 15 active subcontractors with the full 29-item checklist for each is tracking 435 individual items — before accounting for individual worker certifications. When any of those items has a rolling expiration date, the manual monitoring burden becomes untenable. This is the practical reason why compliance software is no longer a nice-to-have for commercial GCs.
Self-Service Sub Portal
Subs upload directly — COIs, certifications, safety programs, EMR letters. Eliminates email collection. AI extracts dates and details automatically.
Automated Expiration Alerts
90/60/30-day alerts sent to both GC and sub before any document expires. No manual calendar management. Sub gets notified before they would ever think to renew.
Real-Time Compliance Dashboard
One view across all projects and all subs. Green/amber/red status at a glance. Drill down to individual workers. See exactly which items are missing or expiring.
OSHA Audit Trail
Every verification, alert, and corrective action is timestamped. FileFlo generates your reasonable diligence evidence automatically — the exact documentation OSHA needs to see.
For guidance on evaluating compliance software vendors and calculating the ROI for your specific project volume, see our subcontractor certification tracking software buying guide. For the full compliance management framework — not just the checklist — see the complete subcontractor compliance management guide.
What FileFlo Automates
FileFlo is the compliance document intelligence platform built specifically for GCs managing subcontractor compliance across multiple projects. The platform handles all 29 checklist items through three mechanisms: self-service sub portals that collect documents at the source, AI-powered document processing that extracts and verifies dates and coverage limits automatically, and automated monitoring that alerts both parties before any item expires.
GCs using FileFlo report reducing subcontractor compliance administrative time from 15-25 hours per week to 3-5 hours per week — a savings of $30,000 to $45,000 per year per project at typical loaded administrative labor rates. For multi-project GCs, the savings scale linearly while the liability protection compounds.
Automate Your 29-Item Sub Compliance Checklist
FileFlo collects, verifies, and monitors all 29 items automatically — with AI-powered document review, automated expiration alerts, and an OSHA-ready audit trail built in.
$299/month — 5-day free trial — Unlimited subcontractors — Cancel anytime
Subcontractor Compliance Checklist: FAQ
Common questions about subcontractor document requirements, insurance minimums, and compliance tracking.
A subcontractor compliance checklist is a structured list of documents, certifications, and insurance requirements that a general contractor must collect and verify from each subcontractor before allowing them to begin work and throughout the project lifecycle. It covers pre-hire documentation (insurance, licenses, safety program), worker certifications (OSHA 10/30, equipment operator cards), ongoing monitoring (annual re-verification, renewal tracking), and audit binder items (documents inspectors commonly request). The checklist serves two purposes: ensuring actual compliance and building the 'reasonable diligence' audit trail that protects the GC under OSHA's Multi-Employer Citation Policy (CPL 02-00-124).
At minimum, every subcontractor should carry: commercial general liability (CGL) at $1M per occurrence and $2M aggregate; workers' compensation at statutory limits for the project state; and commercial auto liability at $1M combined single limit if the sub operates any vehicles on site. For higher-risk scopes (structural, roofing, demolition, mechanical, electrical for projects over $5M), most project owners and GCs require an umbrella or excess liability policy at $5M or more. The GC must be listed as 'Additional Insured' on the CGL and auto policies — not just as 'Certificate Holder.' The additional insured endorsement must be confirmed on the actual policy endorsement form (CG 20 10 / CG 20 37), not just on the ACORD 25 certificate.
Retain all subcontractor compliance records for at least five years after project completion. OSHA's statute of limitations for citations is 6 months after a violation occurs, but construction defect claims can be filed for years or decades depending on the state's applicable statute of repose (often 6-10 years). Workers' compensation subrogation claims and third-party liability suits can arise years after project completion. Retaining complete records — including COIs, certifications, corrective actions, and audit trail documentation — protects the GC if any claim surfaces post-completion. Digital storage in a compliance platform makes long-term retention practical and ensures records are searchable when needed.
If a subcontractor's certificate of insurance expires without being renewed, the GC has an uninsured gap. The correct response is: immediately suspend the sub's site access, send a written notice specifying the lapse and requiring an updated COI within 24-48 hours, and do not restore site access until a new COI is confirmed. Do not rely on the sub's verbal assurance that they renewed — obtain the actual updated certificate. Some GCs include a provision in their subcontracts requiring the sub to provide 30 days' advance notice of any policy cancellation or material change. Document the lapse, your notice, and the reinstatement — this is evidence of active COI monitoring that protects you in the event of a claim during the gap period.
Yes, without exception. Workers' compensation coverage is required by law in virtually every state for employers with one or more employees. If a subcontractor does not carry workers' compensation, the GC can be held liable for injured sub workers' medical costs and wage replacement under several legal theories — including 'statutory employer' doctrine in many states. Some subs claim workers' comp exemptions as sole proprietors or single-member LLCs. Even when a sole proprietor exemption is legally valid, review your subcontract carefully — many GC subcontracts require workers' comp regardless. Obtain the exemption certificate in writing and retain it in the sub's compliance file.
The baseline for commercial construction projects governed by 29 CFR 1926 includes: OSHA 10-hour training for all workers; OSHA 30-hour training for supervisors and foremen; fall protection training per 29 CFR 1926.503 for all workers at heights of 6 feet or more; equipment operator certifications for forklift (29 CFR 1910.178), aerial lifts (ANSI A92.22), and cranes (NCCCO); confined space entry certification per 29 CFR 1926.1213; and first aid/CPR for at least one designated responder per shift. Trade-specific certifications include electrical (licensed electrician per state law), welding (AWS D1.1 for structural work), and asbestos/lead abatement (EPA AHERA accreditation). Project owners, particularly on federal projects, may require additional certifications beyond OSHA minimums.
Always verify contractor licenses directly through the state licensing board's online database — do not rely on a copy of the license provided by the sub. Most state boards have searchable databases by company name, license number, or license holder name. Verify: the license is active (not expired, suspended, or revoked), the license type matches the scope of work being contracted (a general contractor license does not automatically authorize specialty work like electrical or mechanical), the license is held by the same legal entity executing the subcontract, and the license is valid in the project state. Some subs are licensed in their home state but work in a neighboring state without the required reciprocal or separate license — verify in the project state specifically.
Yes — and for any GC managing more than 8-10 active subcontractors, it is essentially mandatory. Purpose-built compliance platforms like FileFlo provide: a self-service portal where subs upload documents directly (eliminating the email collection problem), AI-powered document processing that extracts expiration dates, coverage limits, and certification details automatically from uploaded documents, automated expiration alerts to both the GC and sub at 90/60/30 days, a real-time compliance dashboard showing every sub's status across all projects, and a complete timestamped audit trail that builds your OSHA reasonable diligence defense automatically. The ROI calculation is straightforward: if a project administrator spends 15-20 hours per week on sub compliance paperwork, automation reduces that to 3-4 hours — saving $30,000-$45,000 per project per year at typical loaded labor rates.
Related Articles
Continue learning about compliance and operational excellence
Subcontractor Compliance Management: The Complete Guide for GCs
The full pillar guide — covers prequalification, multi-employer liability, COI tracking, OSHA documentation, and ongoing monitoring from mobilization to closeout.
Subcontractor Certification Tracking Software: The GC's Buying Guide
What to look for in subcontractor compliance software, how to evaluate vendors, and how to calculate the ROI of automated certification tracking.
OSHA Construction Violations: The 2026 Complete Penalty Guide
Every major OSHA construction violation type, current fine amounts, how citations escalate to willful status, and the documentation that determines your penalty.