How subcontractors prove compliance to principal contractors

What PCs actually ask for before your workers can access site

The list varies by principal contractor, project size, and client. But there is a consistent core. Get these wrong and your workers do not get through the gate.

CSCS cards

Every worker on a construction site managed by a principal contractor needs a valid CSCS card. The card must be appropriate for the work being carried out - a green labourer's card does not cover skilled trade work. A scaffolder needs a CISRS card. A plant operator needs a CPCS or NPORS card. An electrician needs an ECS card. PCs do not accept expired cards and site managers are not expected to make exceptions. See our complete guide to CSCS card management for a full breakdown of card types and trade requirements.

Site induction completion

The site-specific induction is the PC's responsibility under CDM 2015, but the worker cannot start until it is done. For new starters, this means completing the induction - often digitally via the PC's platform - before or on the first morning on site. For subcontractors with rotating workers, this means tracking who has done the induction and who has not. Learn more about how digital inductions work at AttendIQ site inductions.

Right to work evidence

As the worker's employer, you are responsible for verifying that each of your workers has the legal right to work in the UK before employment starts. The PC will ask for confirmation that this has been done, and may request evidence. On larger projects, this requirement is written into the subcontract. Full detail on right to work checks in construction is in our dedicated guide.

Insurance certificates

Employers' liability insurance is a legal requirement for any employer. Public liability insurance is typically required contractually. PCs ask for current certificates before mobilisation. An expired certificate is not acceptable. Many PCs require a minimum of £5 million employers' liability and £5-10 million public liability depending on the scope of work.

RAMS

Risk assessments and method statements must be task-specific, not generic. A principal contractor on a CDM-notifiable project is responsible for reviewing and accepting your RAMS before your trade starts. Generic RAMS downloaded from a template are routinely rejected. Your RAMS should describe your specific sequence of operations, the hazards associated with your trade on this site, and the control measures you will apply.

Trade-specific competency cards

Beyond the CSCS card, certain roles have additional card requirements. Scaffolders require CISRS cards at the appropriate level (Trainee, Operative, Advanced, or Supervisor). Plant operators require CPCS or NPORS cards. Electricians require ECS cards. Confirm what is required for each role before workers mobilise - do not assume CSCS is sufficient for your trade.

The 3 ways subcontractors currently manage compliance

Most subcontractors use one of three approaches. Each has genuine strengths and genuine weaknesses.

1. Paper folders and physical cards

The traditional approach. Photocopies of CSCS cards, insurance certificates, and RAMS kept in a folder, brought to site on request. It is tangible, requires no software, and survives any technology failure.

The problems: paper does not send you an expiry alert. On a site with 80 workers and rotating attendance, knowing which cards are about to lapse requires someone manually checking dates. Paper folders get left at the office when they are needed on site. During an HSE inspection, finding the right document in a folder under time pressure is not a good look.

2. Spreadsheets

A step up. A well-maintained spreadsheet can track CSCS card numbers, expiry dates, induction status, and RTW confirmation across a workforce. With conditional formatting, expiries can be highlighted automatically. The information is searchable and shareable.

The problems: spreadsheets rely on someone updating them consistently. When a worker joins mid-project, or transfers from another site, the spreadsheet needs updating immediately or the accuracy degrades. Spreadsheets do not block a non-compliant worker from clocking in. They do not automatically alert the PC. And they do not travel well to the site manager's phone at 7am when a question comes up.

3. Dedicated compliance software (Causeway, Donseed, AttendIQ)

Purpose-built platforms designed for construction workforce compliance. Worker records are stored centrally, accessible from any device, with automated expiry tracking and real-time compliance dashboards.

The honest tradeoff: there is a cost and a learning curve. Getting workers registered takes time upfront. If your PC uses a different platform, you may end up maintaining records in two systems. The counter-argument is that the time spent upfront is far less than the time lost managing a non-compliance incident on site.

AttendIQ removes the dual-system problem if your PC already uses it - your workers' records live in one place, visible to both you and the PC in real time. More on that below.

What happens when a worker arrives without the right documentation

The immediate answer is simple: they do not get on site. A gate operative or site manager who admits a worker with an expired CSCS card, no induction record, or no RTW confirmation is creating liability for the PC. Most gate processes are now firm on this.

The consequences do not stop at the gate.

Day rates lost immediately. A worker who travelled two hours to site and is turned away at the gate loses their day rate. If you are paying a groundworker £250-£350 per day, that is money you cannot recover and a conversation you do not want to have.

Programme impact. If that worker was part of a gang needed to pour concrete, lay block, or fix steelwork, their absence can delay a critical activity. On a programme with liquidated damages clauses, a delay that traces back to a compliance gap at the gate is expensive.

Relationship damage with the PC. Principal contractors keep records of non-conformances. Repeated gate failures put your company on an informal watch list. When the PC is selecting supply chain for the next project, a history of compliance failures influences the decision.

HSE liability for the PC. If a non-compliant worker is admitted and is involved in an incident, the PC faces scrutiny of their site access controls. A worker who should not have been on site is a significant aggravating factor in any enforcement action.

The cost of preventing all of this is a robust pre-arrival compliance check. Know your workers' status before they travel to site, not when they arrive at the gate.

How the AttendIQ supply chain portal works

If your principal contractor uses AttendIQ, you get access to the supply chain portal at no cost. There is nothing to negotiate. Your client uses AttendIQ. You get access free.

Here is how it works in practice:

1. The PC sends you an invitation link. You create an account for your company - it takes a few minutes.
2. You add your workers to the portal. Each worker gets a record: their CSCS card details and expiry date, their induction status, their RTW confirmation, and any trade-specific cards relevant to their role.
3. The PC sees your compliance dashboard in real time. Each worker shows a green, amber, or red status. Green means all checks passed. Amber means something is due to expire. Red means there is a compliance gap that would block site access.
4. When a worker's CSCS card is three months from expiry, the system alerts you. You have time to arrange renewal before the card lapses. The gate never sees the problem.
5. When the same worker moves to a different PC site that also uses AttendIQ, their record moves with them. You do not re-enter the same information twice.

From sign-up to your first compliance record in the portal: the same day. There is no implementation project. There is no data migration exercise. You add workers as you need to and the system tracks what matters.

For subcontractors who want their own standalone AttendIQ account - to manage compliance independently, regardless of which PC sites your workers are on - pricing starts from £4.50 per worker per month. See the supply chain compliance feature and time and attendance tracking for what a standalone account includes.

The prove-it-in-30-seconds moment: HSE visits and PC audits

An HSE inspector arrives on site. They want to see evidence that the workforce is competent, has completed inductions, and has the right to work in the UK. They are not going to wait while you call the office, find the right folder, and locate the right photocopies.

This is the moment that separates a compliance system from a compliance folder.

With a folder, a site manager has to physically locate the correct paperwork for the correct workers, confirm it is current, and present it in a way that an inspector can navigate quickly. Under pressure, this is where gaps get exposed - not because the records do not exist, but because they cannot be found or verified in time.

With a compliance dashboard, the site manager opens a screen and shows the inspector a real-time view of the workforce: which workers are on site today, their induction status, their CSCS card details and expiry dates, and their RTW confirmation. A worker can be searched by name in seconds. Any outstanding issues are visible immediately.

This also applies to PC audits. Many principal contractors now carry out periodic compliance audits of their supply chain during a project, not just at mobilisation. A subcontractor who can pull up a live compliance dashboard on a phone or tablet during a site walk, rather than promising to send paperwork later, builds confidence. It is the difference between being seen as a compliance risk and being seen as a well-run contractor.

CSCS expiry tracking across 100+ rotating workers

CSCS cards are valid for a fixed period - typically five years for most card types, though this varies. Renewal requires completing the relevant health and safety test and, for trade cards, maintaining the underlying qualification. Cards do not auto-renew.

For a subcontractor with 100 or more workers, many of whom rotate across different sites and projects throughout the year, manual expiry tracking is a genuine operational risk. Consider the maths: if 100 workers each have a CSCS card on a five-year cycle, that is an average of 20 renewals per year, roughly one every three weeks. Each renewal requires the worker to book and pass the appropriate CITB health and safety test. If you are not tracking expiry dates proactively, you will find out a card has lapsed when a worker is refused site access.

The right approach has three components:

• Centralised record. Every worker's CSCS card number and expiry date stored in one system, not across individual worker phones, paper files, and site folders. See our CSCS card management guide for what records to keep and how to verify card validity.
• Automated alerts. Alerts sent to the relevant supervisor or HR contact at a minimum of 90 days before expiry - longer for workers who need to book a test and complete the renewal process in time.
• Access enforcement. When a card expires, the worker is automatically blocked from clocking in to site. This prevents the problem reaching the gate and ensures the record in the system reflects reality on the ground.

For a workforce that rotates across multiple PC sites, centralised records are especially important. A worker who renewed their CSCS card last month should not need to re-prove it at every new site. When the record is held centrally and shared with the PC's compliance system, the information follows the worker.

Right to work: what documents, what retention, what penalty

As a subcontractor, you are the employer of your workers. The right to work checking obligation sits with you - not with the principal contractor. You must check every worker before their employment starts, not on their first day on site, and not after the fact. For the full process including how to use share codes and the online checking service, see our right to work checks in construction guide.

What documents are acceptable

Home Office guidance divides acceptable documents into two lists:

• List A confirms a permanent right to work and requires a one-time check only. This includes UK and Irish passports (including expired passports for British and Irish nationals), UK biometric residence permits showing unlimited leave, and certificates of naturalisation.
• List B confirms a time-limited right to work and requires a follow-up check before the permission expires. This includes current passports showing time-limited permission to stay, and EU Settlement Scheme pre-settled status verified via the online service.

For most workers who are not British or Irish nationals, the primary route is the online checking service at gov.uk/view-right-to-work. The worker generates a share code. You enter the share code and their date of birth to view their immigration status. Take a screenshot of the result at the time of the check and note the date. That is your record.

What records to keep and for how long

Keep a copy of the document checked, or the screenshot from the online service, plus the date the check was carried out. For time-limited permissions (List B), keep a note of the expiry date and set a reminder for the follow-up check.

Records must be kept for the duration of employment and for two years after employment ends. These records contain personal data and are subject to UK GDPR. Store them securely with access limited to those who need it.

The penalty for getting it wrong

From January 2024, the civil penalty for employing a worker without the right to work in the UK is up to £60,000 per worker. This applies even if you did not know the worker had no right to work, unless you can demonstrate a compliant check was carried out before employment started. Criminal prosecution is possible where there is evidence the employer knew or had reasonable cause to believe the worker was not entitled to work, with a maximum sentence of five years' imprisonment.

On a construction site with high workforce turnover, missing a right to work check is not a theoretical risk. A robust process for checking every new starter, before their first day, is not optional.

Related Guides