Who is the OSHA controlling employer on a shared contractor site?

When a contractor is cited on a shared site, the host that hired it asks whether the same inspection could reach its own door. Practitioners raise that question regularly in discussions on Reddit, and we follow those conversations to share what is being discussed and add to it.

This piece sets out what OSHA treats as reasonable care for a host: the factors that set inspection frequency, the three questions that decide the outcome and the points where the directive’s worked examples fall on either side of the line.

An OSHA controlling employer is an employer with general supervisory authority over a worksite, including the power to correct safety and health violations itself or require others to correct them. The policy behind that definition is US federal OSHA policy. State plans were not required to adopt it, so a site in a state-plan state may be treated differently, and a UK enterprise should confirm the position for each US site.

How a host becomes a controlling employer: contract wording or actual practice

Control can come from the contract or from what the host does on site. A contract that gives the host a specific right to require a contractor to follow safety requirements and to correct the violations the host finds establishes control. A contract that says nothing about safety, or disclaims it, does not settle the question.

Where the safety clause is missing or denied, a combination of other rights can still create control. The directive treats the authority to resolve disputes between subcontractors, set schedules and decide construction sequencing as particularly significant because each affects safety. Its example of a construction manager shows the effect. The contract said the manager had no right to require safety compliance, yet the manager was a controlling employer because it decided whether a subcontractor should wait until guardrails were installed.

Practice counts as well. A host with no explicit safety rights that exercises broad control over a contractor’s work, including the safety aspects, is a controlling employer. The directive says citations in both of these contract-silent situations should be issued only after consulting the Regional Solicitor’s office.

Limited roles do not create control. A firm that only reported on contractors’ compliance to the owner and made payments was not a controlling employer. Neither was an architect that pointed out hazards to the general contractor. For a UK enterprise, the lesson is that contract wording is not the only test. What site managers do day to day is part of it.

What reasonable care means for an OSHA controlling employer

A controlling employer must exercise reasonable care to prevent and detect violations on the site. That duty is lighter than the duty an employer owes to its own employees. The directive says a controlling employer is not normally required to inspect as frequently as the employer it hired, or to match that employer’s knowledge of the applicable standards or trade expertise.

The detail sits in OSHA’s multi-employer citation policy, which gives the regulator’s own wording on inspection frequency and enforcement. Lighter does not mean absent. The directive sets out what OSHA looks at, and the three parts below follow it.

What sets how often a host must inspect

Three factors affect how frequently and how closely a controlling employer must inspect:

The first is the scale of the project. The second is the nature and pace of the work, including how often the number or types of hazards change as work progresses. The third is how much the host knows about the contractor’s safety history, safety practices and level of expertise.

The third factor moves inspection frequency in both directions. More frequent inspections are normally needed where the host knows the contractor has a history of non-compliance. They may also be needed at the start of a project where the host has never worked with the contractor and does not know its record. Less frequent inspections can be appropriate where there are strong signs of effective safety efforts. The most important sign is a consistently high level of compliance. Others are an effective graduated enforcement system, regular jobsite safety meetings and safety training.

The three questions OSHA asks about reasonable care

OSHA evaluates reasonable care by asking whether the host did three things. It conducted periodic inspections of appropriate frequency, based on the factors above. It implemented an effective system for promptly correcting hazards. It enforced the contractor’s compliance with an effective, graduated system of enforcement and follow-up inspections.

Each question is answered from what the host can show. Intent and informal habits do not answer it.

Why graduated enforcement decides cases

Graduated enforcement is a stepped response to repeated non-compliance, with each step more serious than the last. The directive’s painting contractor example shows why it matters. The host inspected often enough and found fall protection violations during a number of inspections. It pointed them out each time and did nothing more. The host was citable because it had no graduated system of enforcement. Finding a hazard satisfies the detection duty. Requiring the contractor to correct it satisfies the other.

Worked examples: when the host was citable and when it was not

The directive’s examples show how the same questions produce different results on different facts.

• Not citable: a plant host and a sandblasting contractor. Five employees worked on site and the hazards did not change as the work progressed. The host had worked with the contractor for years, saw consistently high compliance, inspected weekly, reviewed the contractor’s own inspection reports and had applied graduated enforcement before. A respirator violation occurred two days before the next scheduled inspection and was not reported. The host had exercised reasonable care.
• Citable: a general contractor and a painting contractor. The host had never worked with the contractor before and inspected often enough. It found repeated fall protection violations, pointed them out and took no further action. The missing graduated enforcement made it citable.
• Not citable: a general contractor and an electrical subcontractor. An incomplete ground in a panel box was not visible on inspection. The host inspected at an appropriate frequency, asked whether the equipment was safe and knew the subcontractor was competent with an effective safety programme. It was not obliged to test the outlets itself.
• Citable: a construction manager that controlled scheduling and sequencing. Had it refused a subcontractor’s request to delay work until guardrails were in place, it would have been citable for the fall hazard.
• Not a controlling employer: the reporting and payments firm and the architect described above. Neither had enough authority or exercised control over safety.

The directive states that its examples cover common situations and are not exclusive. Each decision rests on all the facts found in the inspection or investigation.

Contractor safety management software for UK enterprises: building the evidence trail

Each reasonable care question comes down to evidence. A host that inspected, found, corrected and escalated needs to show that it did so, with dates, for each site and each contractor. For a UK enterprise with US contractor sites, the same four records are needed for every site and every contractor.

Four records answer the directive’s questions. The first is the inspection log, showing dates and findings set against the frequency factors. The second is the hazard record, showing when each hazard was reported and when it was corrected. The third is the enforcement record, showing each step taken on a repeat violation and the follow-up inspection that closed it. The fourth is the contractor profile, showing what the host knew about the contractor’s safety history when it set inspection frequency.

Contractor safety management software can hold these in one record for each contractor and each site, so the host can produce them without rebuilding them from email. Ideagen’s guide to contractor safety management software covers the software capabilities and the four employer categories in full.

Oversight patterns that weaken reasonable care and what closes them

What the host does	What the directive points to	What the host gains
Inspections run on a fixed schedule whatever the contractor or the project.	Set frequency from project scale, pace of change and contractor history, and raise it at the start with a new contractor.	An inspection rate it can explain on the facts of each site.
Violations are pointed out during inspections and then left.	Apply graduated enforcement and follow up with a further inspection.	A documented path from first finding to closure.
The contract disclaims safety control but site managers direct the work.	Treat actual practice as control and align site conduct with the contract.	A clear view of where its duty sits.
The contractor’s own inspection reports arrive and nobody reviews them.	Review them alongside the host’s own inspections as one input to monitoring.	A second source of detection that supports lighter on-site inspection where compliance is strong.

Reasonable care is shown by what the host can evidence

A controlling employer on a contractor site owes a lighter duty than a contractor owes to its own employees, but it is still a duty. OSHA looks at inspection frequency set by project scale, pace of change and contractor history. It looks at how quickly hazards are corrected. It looks at whether enforcement moves beyond pointing out a violation. Control can come from the contract or from practice, so site conduct matters as much as the clause in the agreement.

The directive is US federal OSHA policy, so UK enterprises should read it as guidance for their US sites only and check how the relevant state plan treats it. To continue the discussion with other practitioners, join Ideagen’s Reddit community.