How to Pass a Principal Contractor Audit: A Practical Guide for UK Contractors

A principal contractor audit is not a box-ticking exercise — it is a structured check that the site is being managed in line with the Construction (Design and Management) Regulations 2015 (CDM 2015) and the broader health and safety framework. Understanding what auditors look for, and having your evidence ready, is the difference between a smooth visit and an enforcement notice.

What a Principal Contractor Audit Actually Checks

Under CDM 2015, the principal contractor (PC) has specific legal duties: planning, managing, monitoring and coordinating construction phase health and safety. An audit — whether carried out by the client, a tier-one contractor, an insurer or an external body — tests whether those duties are being discharged in practice, not just on paper.

Auditors typically work through four areas:

1. Documentation and planning — is the Construction Phase Plan (CPP) project-specific, current and actually used?
2. Workforce management — are workers competent, inducted and supervised?
3. Site controls — do physical arrangements match what the CPP and RAMS say?
4. Monitoring and review — is the PC actively checking, not just hoping?

Get Your Documentation in Order First

Poor paperwork is the fastest way to fail. Before any audit, confirm you hold and can produce:

• A Construction Phase Plan that reflects the current stage of work — a generic template with the project name swapped in will be challenged immediately.
• Risk assessments and method statements (RAMS) for all significant activities, reviewed and signed off before work starts.
• F10 notification (if applicable) — check the thresholds: more than 30 working days with more than 20 simultaneous workers, or more than 500 person-days.
• Competence records — CSCS cards, certificates (IPAF, PASMA, asbestos awareness, etc.) and any trade qualifications relevant to the works.
• Induction records — signed evidence that every person on site has received a site-specific induction.
• Inspection records — scaffold tags, excavation inspections, WAH equipment checks under the Work at Height Regulations 2005.
• Accident, near-miss and toolbox talk logs — auditors look for genuine engagement, not a blank sheet.

Keep these accessible on site, not locked in a head-office filing system.

RAMS: Quality Over Volume

Auditors see hundreds of RAMS. What stands out — badly — is a method statement that could apply to any site anywhere. What passes is one that names the specific location, references the actual plant being used, identifies real hazards on that site (overhead lines, proximity to the public, ground conditions) and shows a genuine control hierarchy.

Under the Management of Health and Safety at Work Regulations 1999 (reg 3), every employer must carry out a suitable and sufficient risk assessment. "Suitable and sufficient" means proportionate to the risk, not a 40-page document that nobody reads. Auditors will ask workers what the method statement says — if the answer is blank stares, that is a finding.

Physical Site Standards Must Match the Paperwork

A common audit failure: the RAMS says edge protection will be installed before any operative approaches the roof edge, but on a walk-round there is none. The Work at Height Regulations 2005 require the hierarchy — avoid working at height if reasonably practicable; if not, use existing safe places of work; if not, use collective protection (guardrails, nets) before personal protection (harnesses). An auditor will observe and photograph.

Walk the site yourself before the audit with that question in mind: does what I can see match what my documents say?

Workforce Competence and Supervision

CDM 2015 requires the PC to ensure only competent people are appointed and that arrangements are in place to prevent unauthorised access. Auditors will:

• Spot-check CSCS cards on site against the register.
• Ask supervisors about their specific responsibilities.
• Check that subcontractors have their own suitable RAMS, not just adopted the PC's generic ones.
• Look for evidence that the PC has reviewed and approved subcontractor RAMS before work started — not after.

Substances, Welfare and Fire

COSHH 2002 assessments must exist for any hazardous substances in use — silica dust, solvents, diesel exhaust, adhesives. Auditors will check whether controls (LEV, RPE, exposure monitoring) match the assessment and that substitution was at least considered.

Welfare facilities are a basic CDM 2015 Schedule 2 requirement: toilets, washing facilities with hot and cold water, rest facilities, drinking water. Too many sites still fail on this.

For fire, the Regulatory Reform (Fire Safety) Order 2005 applies to common parts of construction sites — the PC is usually the responsible person. A site fire risk assessment, clear emergency plan, maintained escape routes and appropriate extinguisher provision are all auditable.

On the Day: How to Handle the Audit

• Brief your site supervisor and foreman in advance — they should know where documents are and be able to speak to site controls confidently.
• Do not hide problems. Auditors respect a contractor who has identified a hazard and recorded the corrective action. Concealment damages trust and, if something goes wrong, liability.
• Walk with the auditor rather than behind them. Answer questions directly and, if you do not know, say so and commit to finding out.
• Take your own notes. If a finding is raised, agree the corrective action and timescale on the day where possible.

After the Audit

Close out any findings promptly and in writing. Keep evidence of closure — photographs, updated documents, revised RAMS. A follow-up audit will go straight to the open items from the last visit.

Passing a principal contractor audit is ultimately straightforward: do what CDM 2015 requires, document it clearly, make sure your workforce knows what it says, and keep the site looking like the paperwork describes. The audit is not the standard — it is just the check.