Managing Psychosocial Risk Across Contractor and Subcontractor Workforces
A refinery goes into turnaround and the site population triples in a fortnight. Most of the arrivals do not work for the operator. They work for a scaffolding firm, an inspection contractor, a specialist valve outfit, a labour hire agency supplying general hands. They are inducted on day one, they work compressed shifts against a fixed end date, and they leave. The operator's wellbeing programme, its employee assistance line, its manager training, its pulse survey, covers roughly a third of the people on site during the highest-risk weeks of the year.
That is not an unusual arrangement. In safety-critical industries it is the normal one. And it is the reason psychosocial risk management, which is the work of identifying and controlling the harm that arises from how work is designed, organised and managed, tends to have a hole in the middle of it exactly where exposure is highest.
Most psychosocial risk frameworks were written for people on the payroll
Psychosocial risk applies to everyone doing the work, regardless of who signs their pay slip. Most frameworks built to manage it do not.
The reason is administrative rather than deliberate. Wellbeing programmes get scoped from the HR system, and the HR system holds employees. Survey distribution runs off the staff directory. Manager training targets people with direct reports on the same payroll. Every one of those decisions is reasonable in isolation, and together they draw a boundary around the workforce that has nothing to do with where risk actually sits.
Contract workers are not a marginal population in these industries. On a large construction project they are the majority. During a shutdown they outnumber the permanent crew. In shipping, a substantial share of the people aboard are engaged through third-party managers and manning agents rather than by the owner whose name is on the hull. The exposure is concentrated in the group the programme was never built to reach.
The duty does not stop at the employment boundary
Health and safety law in most developed jurisdictions attaches duties to the organisation that controls the work, not only to the one that employs the worker. Australia's model WHS legislation is the clearest example. A person conducting a business or undertaking owes duties to workers whose activities it influences or directs, including contractors, subcontractors, and labour hire staff, and those duties are concurrent and cannot be contracted away. More than one organisation can hold a duty to the same worker at the same time.
Other jurisdictions arrive at similar places by different routes, and the detail varies considerably. What matters commercially is the direction of travel, which is consistent. Regulators are moving psychosocial hazards into the same category as physical ones, and the question of who is responsible for a subcontracted worker's exposure to unmanageable demands is being answered the same way it was long ago answered for their exposure to a dropped object.
Accountability gaps persist anyway. The principal contractor assumes the subcontractor is managing it. The subcontractor assumes the site operator's systems apply to everyone on site. Neither assumption survives contact with a serious incident analysis.
Job insecurity is not a personal worry, it is a named hazard
ISO 45003 names job insecurity explicitly among the psychosocial hazards organisations should be managing. This is worth sitting with, because most organisations file insecurity under personal circumstances rather than work design.
For a contract worker, insecurity is not a phase. It is the engagement model. The next placement depends on this one going well, on the client being satisfied, on the supervisor's report, on not being remembered as difficult. That structure produces a predictable set of behaviours, and every one of them degrades safety.
People under employment insecurity report less. They raise fewer concerns. They are slower to stop work, slower to admit they do not understand an instruction, and more likely to absorb a problem quietly than escalate it. The rational calculation for someone whose next month of income depends on this week's impression is to be easy to work with. In an operation that depends on people speaking up about conditions they can see and the system cannot, that calculation is a live hazard.
The people most exposed are the ones excluded from the programme
Ask an operations leader whether contractors are covered by the wellbeing programme and the honest answer is usually a pause.
Access to support is the visible part of the gap. The employee assistance line routes on employee ID. Mental health first aiders are trained among permanent staff. Fatigue management standards apply, but the roster that produced the fatigue was set by another employer. The less visible part matters more: contract workers are usually absent from the measurement as well as the provision, so the organisation has no data on the population carrying the most exposure.
Inclusive design is less complicated than it sounds. It means scoping by site presence rather than by payroll, extending support access to everyone working under the operator's control, and writing the measurement to cover the whole population before deciding what to do with the findings. This is the same argument that applies to employee wellbeing consulting for high-risk industries generally, sharpened by the fact that the excluded group is the exposed one.
What "all workers" actually means under ISO 45003
ISO 45003 uses a broad definition of worker, consistent with ISO 45001. It reaches beyond direct employees to people whose work the organisation directs or influences: labour hire staff, contracted specialists, subcontractors at any tier, and workers on shared or multi-employer sites.
The practical consequence is that an assessment scoped to employees only does not satisfy the standard on a site where most of the work is contracted. The scope question comes before the assessment question. Decide who counts as a worker on this site, then assess that population, rather than assessing the population your systems can conveniently reach and calling it the workforce.
The standard itself, its clause structure and what compliance involves more broadly, is covered in our article on managing psychosocial risk under ISO 45003.
Where contractor risk concentrates
The pattern differs by sector, and the psychological hazards in oil and gas, mining and maritime are not identical to begin with.
In maritime, the layering is contractual and invisible from shore. Crew engaged through manning agents, technical management outsourced to a third party, riding squads joining mid-voyage, shipyard subcontractors during dry dock. The seafarer's employer, the vessel's manager and the owner may be three separate entities in three jurisdictions, which makes the question of who is managing their psychosocial exposure genuinely hard to answer.
In mining, contract crews often run the shortest rotations and the least favourable ones. Fatigue accumulates differently under short-rotation contracts, social connection on site is thinner for people who cycle through, and access to support is weakest for the group whose roster gives them least recovery. Fatigue behaves differently across high-risk environments, and contract rosters tend to sit at the harder end of whatever the local pattern is.
In oil and gas, risk concentrates in the surge. Turnarounds and shutdowns bring compressed schedules, unfamiliar crews, and a fixed completion date that applies schedule pressure to people with no history on the site and no standing to push back on it.
In construction, the layering is simultaneous rather than sequential. Dozens of subcontractors operate on the same site under different employment terms, different supervision quality, and different tolerances for raising a concern, with the principal contractor holding site control but not the employment relationship for most of the people on it.
Measuring across employment types without running three separate exercises
The instinct is to run something separate for contractors. Resist it, because separate exercises produce findings that cannot be combined, and a fragmented picture of a shared site is not much better than no picture.
The more useful approach is one instrument, applied consistently across the population present on site, with the scope decided up front. Our Six Drivers Diagnostic measures the system conditions that determine whether people are working at capacity or drawing on reserves, and those conditions are properties of the work rather than of the employment contract. Work design, supervision quality, role clarity and psychological safety exist on a site regardless of who is paying whom.
Where the organisation is also assessing management system maturity, the Psychosocial Risk Assessment runs clause by clause against ISO 45003, and scope is one of the things it examines. That is often where the contractor gap first appears in writing.
Both feed the Capacity Index, which combines organisational capacity with a human layer into a single measure. The capacity index concept is not ours. It comes from the 2022 work of Sidney Dekker and Michael Tooma. What we have added is the human layer, and on a multi-employer site that layer is precisely the part a headcount-scoped programme cannot see.
What good contractor governance looks like before anyone mobilises
Governance is cheaper than remediation, and most of it happens before the first contractor arrives.
The contract is the strongest lever. Psychosocial risk obligations can sit alongside the physical safety requirements already standard in a contractor management system, covering roster limits, incident reporting expectations, and access to support. Pre-mobilisation checks can confirm the subcontractor has something in place rather than discovering during an assessment that they do not.
The design constraint is that procurement teams will not absorb a parallel process. What works is extending the questions already asked rather than adding a new stage. Contractor management systems already collect safety documentation. Psychosocial requirements belong in that submission, assessed by the same people, on the same schedule. How this looks in day-to-day operations is covered in how psychosocial risk assessment shows up in operations.
An honest note on what this cannot do
Three limits worth stating plainly.
Anonymity thresholds constrain reporting. Any credible instrument suppresses results below a minimum group size, and many subcontractor cohorts on a real site are small. Findings for those groups have to be aggregated to be reportable at all, which means the picture gets less granular exactly where the population is most transient.
A principal contractor can measure exposure it cannot unilaterally fix. Rosters, pay, job security and career progression sit with the subcontractor's employer. The measurement is still worth having, because it converts an assumption into evidence you can put in front of the party who does control the lever, but it is influence rather than authority.
Short tenure limits what repeated measurement shows. A worker on site for six weeks will not appear in a longitudinal trend. For genuinely transient populations, the useful question is what the conditions on this site are doing to whoever is working in them, not how a given individual is tracking over time.
None of that argues for leaving the population out. It argues for being honest about what the numbers mean once you have them.
Where to start
Start with scope, not with an instrument. Establish who is actually working on the site, under whose direction, and which of them your current wellbeing provision and current measurement reach. The gap between those two numbers is usually the finding, and most organisations have never put it on paper.
If you want to see what that gap looks like in your operation, get in touch and we can talk through how an assessment gets scoped across a mixed workforce.
Frequently asked questions
Are principal contractors responsible for the psychosocial wellbeing of subcontractors on their sites?
In most jurisdictions, health and safety duties attach to the organisation controlling the work as well as the one employing the worker, and those duties are increasingly understood to include psychosocial hazards. Australia's WHS regime is explicit that duties are concurrent and cannot be contracted away. The detail varies considerably by jurisdiction, so specific obligations need local legal advice, but the direction of regulatory travel is consistent.
Does ISO 45003 apply to contract and labour-hire workers?
Yes. ISO 45003 uses the broad ISO 45001 definition of worker, which covers people whose work the organisation directs or influences, including labour hire staff, contracted specialists and subcontractors at any tier. An assessment scoped only to direct employees does not meet the standard on a site where most work is contracted.
How do you assess psychosocial risk for workers who are only on site for a short time?
Assess the conditions rather than tracking individuals. Work design, supervision quality, schedule pressure and reporting culture are properties of the site, and they can be measured at a point in time across whoever is present. This gives you a read on what the environment does to any worker in it, which is the actionable question for a transient population.
What are the most common psychosocial hazards facing contract workers in high-risk industries?
Job insecurity, unclear reporting lines across multiple employers, schedule and completion pressure, induction overload in the first days on an unfamiliar site, exclusion from support provision, and social isolation from the established crew. These compound. A worker who is new, uncertain of who to report to, and conscious that the next placement depends on this one is unlikely to raise a concern early.
Can one wellbeing assessment cover permanent staff and contractors at the same time?
Yes, and it is the better approach, because separate exercises produce findings that cannot be combined into one picture of a shared site. The practical requirement is deciding scope before deployment and setting up the instrument to reflect the population you have. Where reporting needs to distinguish employment types, that has to be designed in at the outset rather than added afterwards.
What does contractor wellbeing governance look like on a remote or offshore operation?
It is mostly contractual and mostly pre-mobilisation. Roster limits, reporting expectations and support access get written into the contractor requirements, checked before mobilisation through the existing contractor management process, and verified on site the same way physical safety requirements are. Once people are offshore, the options for changing conditions are limited, which is why the work happens before anyone flies out.