Why manual pre-qualification is the hidden risk in modern construction supply chains

1 Introduction
2 How legacy pre-qualification processes are failing to reflect today’s regulatory and operational realities
3 Why the real vulnerability sits deeper in the supply chain
4 The shift from point-in-time approval to continuous assurance
5 A practical framework for better compliance
6 Related articles on Designing Buildings

[edit] Introduction

The construction industry is navigating a compliance landscape that is more demanding than ever. With the introduction of the Building Safety Act in 2022, alongside existing CDM 2015 Regulations, clients are under growing scrutiny to demonstrate that the contractors they appoint are competent and appropriately managed. Prequalification and onboarding processes are no longer box-ticking exercises, but the foundation of safe, compliant and efficient project delivery.

Yet many organisations still rely on manual checks, spread sheets and inconsistent questionnaires to manage contractor compliance. This also risks company onboarding requirements not keeping pace with evolving standards, leaving compliance gaps in relation to duty holder requirements, trade-specific risks, and enhanced industry expectations.

While manual processes may have once been adequate, they are no longer sufficient in today’s compliance environment. Instead, outdated practices create a false sense of assurance, where businesses may believe they are compliant but lack practical evidence of competence, risk controls and legal alignment, particularly those introduced by the Building Safety Act.

[edit] How legacy pre-qualification processes are failing to reflect today’s regulatory and operational realities

Legacy processes often treat supply chain compliance as a one-off onboarding exercise, rather than a business risk that requires reviewing and updating as work activities, risks and regulations evolve. This means onboarding packs can miss crucial requirements, such as competency information or building safety considerations, if they are not regularly reviewed. Manual systems also make it harder to track expiring insurance, certifications, policies, risk assessments and changes in contractor scope.

Historically, prequalification processes focused on health and safety, but now this extends across a much broader range of compliance areas, including environmental management, financial stability, anti-bribery measures, modern slavery and information security. Keeping pace with this broader compliance remit via manual processes is both difficult and inefficient, in terms of time and resource commitment.

Added to this, traditional prequalification processes typically provide a snapshot showing that a contractor met a requirement at one point in time, but they do not demonstrate whether that contractor remains compliant, whether their scope of work has changed, or whether documents, such as insurance policies, have expired. This is where compliance gaps can begin to emerge, as the previously captured information no longer accurately represents the contractor status.

[edit] Why the real vulnerability sits deeper in the supply chain

Construction supply chains rarely stop at the first contractor appointed. Subcontracting across multiple tiers is a standard aspect of how projects are delivered. This provides organisations with flexibility, access to specialist skills and the ability to scale quickly. However, while subcontracting has become more complex, visibility of who is actually carrying out the work has struggled to keep pace. Many organisations believe they understand their supply chain due to their existing manual contractor approval process. However, in reality, most only have real visibility of their tier-one contractors. Beyond that point, work can often be passed down through several additional layers of subcontracting before it reaches the individuals physically carrying out works on site.

The business risk lies in subcontracting without visibility. If a hiring organisation approves a contractor, but the work is ultimately delivered by another business or individual further down the supply chain, the original pre-qualification process may no longer reflect the reality on site. This creates a gap between what the organisation believes it has assurance on and the reality on site. In practical terms, organisations may not be able to evidence who is working on site, whether they have been properly inducted, whether they are competent to carry out the work, or whether they are operating under the right controls.

[edit] The shift from point-in-time approval to continuous assurance

A modern contractor onboarding process must go beyond collecting paperwork. It should establish a consistent, evidence-based system for vetting, approving, and monitoring contractors at every stage of a project. Done well, onboarding becomes a compliance safeguard and a practical risk management tool, that provides both confidence and saves on resources.

For this reason, it is crucial that contractor onboarding is not treated as a one-off task. Risks change as projects evolve, and compliance monitoring should follow suit. Regular reviews, spot checks and updated risk assessments help ensure contractors remain compliant throughout the construction phase. Under CDM 2015, clients and principal contractors must make suitable arrangements to manage health and safety during a project. A system of ongoing monitoring helps close the gap between initial approval and day-to-day performance, reducing the risk of non-compliance.

Robust onboarding should also include verification of a contractor’s health and safety management systems. This can be streamlined through SSIP certification or, for broader organisational risk assessment, the Common Assessment Standard (CAS). CAS goes beyond health and safety, covering key areas of risk management including building safety, quality, environment, insurance, information security and anti-bribery. These industry recognised schemes can help clients assess core health and safety requirements alongside wider organisational risk controls consistently.

The same principle can be seen in the Golden Thread requirements for higher-risk buildings under the Building Safety Act 2022. This refers to the accurate and secure digital record of information about a building, maintained throughout its lifecycle. For contractor onboarding, this means capturing accurate data at the start of a project, storing evidence of competence, and retaining practical evidence of planning, managing and monitoring construction work in a secure, accessible format, and ensuring that information is updated as work progresses. This digital approach supports accountability, improves transparency, and makes it easier to demonstrate compliance during audits or regulatory inspections.

[edit] A practical framework for better compliance

For hiring organisations, the first step is to know who is in the supply chain. That means capturing a minimum dataset for every contractor, including company name, contact details, trade, scope of work, risk level, relevant certifications and other key information needed to assess suitability. Where subcontracting is involved, organisations need to have a clear view of how that is controlled and how lower-tier contractors are checked before reaching site.

Another important step is making sure pre-qualification questions remain current. Onboarding questions must be reviewed regularly, and sooner when legislation, standards, project requirements or risk profiles change. This ensures the process reflects the current compliance environment rather than outdated requirements.

Finally, organisations should consider how to build a stronger audit trail without adding unnecessary headcount. Digital contractor compliance solutions, such as Veriforce CHAS, can help by providing access to prequalified contractors and real-time information on contractor and supply chain compliance. This helps teams move from manual processes to a more digitised approach, giving them fuller visibility across their supply chain network.

While manual pre-qualification may record a decision, it cannot manage changing risk. To protect people, projects and regulatory compliance, construction businesses require compliance processes that are live and evidence-based. This way, they can have confidence in who is on site, who is carrying out the work, and whether they remain compliant.