Supplier document management, including subcontractors, is one of the areas where the gap between what an organisation thinks it controls and what it actually controls can be widest. Indeed, when documents live in emails, shared folders and spreadsheets, nobody can confidently answer a simple question: do the suppliers working with us today meet the requirements we have set?
In brief
- Suppliers and subcontractors bring legal, safety and reputational risks into the organisation, and documents help to control them.
- The starting point is not the archive, but defining requirements in proportion to the risk of each supply or service.
- Documents expire: without ongoing control, a supplier that is compliant today may no longer be compliant next week.
- A centralised platform, with history and permissions, turns scattered documents into evidence that stands up to an audit.
Why supplier document management is critical
Every supplier and subcontractor adds value, but also adds risk. Consider a contractor without adequate insurance, a subcontractor with Social Security debts or a team without the required training. Any of them can expose the organisation to legal liability, accidents and operational disruption. In addition, the Portuguese Labour Code provides for joint liability of the contracting company and the project owner in certain cases. This applies to offences committed by subcontractors working on their premises.
As a result, documents are no longer an administrative formality. Instead, they become proof that the organisation required, checked and monitored the people who work for it.
Which documents to request: A three-level structure
| Level | Example documents | Purpose |
|---|---|---|
| Company | Company registration certificate, tax and social security status, insurance, activity licences, certifications | Confirm that the company exists, is in good standing and can provide the service |
| Worker | Identification, employment relationship, workplace accident insurance coverage, medical fitness, training and qualifications | Confirm that each person can perform the assigned role |
| Equipment | Declaration of conformity, periodic inspections, manuals and insurance, where applicable | Confirm that work equipment is safe and has been inspected |
However, not all suppliers justify the same level of scrutiny. For example, an office supplies vendor does not need the same process as a company doing electrical work on site. The organisation should therefore classify supplies by risk and set the requirements for each class.
The risks of scattered management
- Expired documents with no alert. The organisation only discovers the problem during an inspection or after an incident.
- Different criteria from person to person. The same document is accepted on one site and rejected on another, depending on who reviews it.
- Invisible subcontractors. The direct contractor is documented, but the companies it subcontracts to are not.
- No history. Nobody can prove what was valid on a specific date.
- Uncontrolled personal data. Workers’ documents circulate by email, without permissions or traceability.
Components of an effective process
1. Requirements defined and communicated before contracting
From the tender stage onwards, suppliers should know which documents they will have to submit, the accepted formats and the deadlines. In this way, documents are no longer a surprise after the contract award and become part of the contract terms.
2. Centralised collection on a platform
Instead of receiving documents by email, the organisation provides a platform where each supplier submits and updates its own documents. As a result, the collection effort shifts to those who hold the information, and the organisation can focus on validation.
3. Validation against written criteria
Each requirement should have clear acceptance criteria: which document is accepted, what information it must contain and what minimum validity it must have. Likewise, each decision is recorded with the name of the validator, the date and the outcome.
4. Ongoing expiry date control
Insurance, certificates, training and fitness assessments all have deadlines. Early alerts to the supplier and the organisation therefore allow timely renewal. In addition, automatic access suspension prevents anyone from working with expired documents.
5. Link to access and operations
Finally, document status must have consequences: only workers and companies that meet the applicable requirements can enter the premises, or the systems.
Supplier documents and data protection
A significant share of subcontractor documents contains personal data: identification, employment relationship, training and, in some cases, occupational health information such as medical fitness. The GDPR therefore applies fully to this process. Specifically, the organisation must define the lawful basis for each processing activity and request only the data needed for the purpose. It must also restrict access to those who need it and set retention periods.
In addition, it is best to avoid collecting full documents when a single piece of information is enough. For example, to confirm a worker’s fitness, the fitness certificate, without clinical data, is sufficient. In this way, the organisation reduces risk and complies with the data minimisation principle.
How to engage suppliers
A document process only works if suppliers understand it and can comply with it. So, a few practices help:
- provide a clear list of requirements by type of service, with examples of accepted documents;
- name a contact person for questions and respond quickly in the first few months;
- explain the reasons for rejections, so that the supplier gets it right the first time;
- reuse documents that have already been validated, instead of requesting them for every new contract.
On the other hand, suppliers who consistently miss deadlines or requirements should be identified and monitored, because this information is relevant for future contracting.
Indicators to track
- percentage of active suppliers with complete and valid documents;
- critical documents expiring in the next 30 days;
- first-submission rejection rate, by supplier;
- average time between submission and validation;
- subcontractors declared compared with those identified on site.
Taken together, these indicators show whether the process is working and, above all, where the risk lies.
Example: A subcontractor nobody knew about
On a refurbishment site, the main contractor is approved and its documents are in order. However, halfway through the works, a small painting company subcontracted by the main contractor arrives on site without submitting any documents. Nobody knows whether its workers have workplace accident insurance. With a structured process, the contract would require all subcontractors to be declared in advance. The platform would then require their documents before entry. Therefore, the situation would be detected before it became a risk.
Frequently asked questions
Which suppliers should go through the full process?
In general, those who work on the organisation’s premises, those who handle personal data or sensitive information and those who provide services that are critical to business continuity. The rest can follow a simplified process.
How long should we keep the documents?
For as long as needed to meet legal and contractual obligations and to defend the organisation. The retention periods should therefore be defined with legal support and comply with the GDPR, especially for documents containing personal data.
Implementing in 90 days
- First month: Design. Classify supplies by risk, define the requirements for each class and approve the validation criteria with the areas involved.
- Second month: Configure and test. Next, configure the platform, test it with a pilot group of suppliers and adjust instructions and deadlines.
- Third month: Roll out. Finally, invite the remaining suppliers in waves, starting with the highest-risk ones, and link document status to access control.
In this way, the organisation gets visible results within a few weeks, without trying to solve everything at once. In addition, the pilot reveals practical difficulties before the process reaches hundreds of companies, such as documents suppliers cannot obtain in the requested format.
What if the documents are incomplete at the start?
That is normal. It is therefore advisable to set a transition period with clear priorities: first the documents that are critical for safety and legal compliance, then the rest.
Questions for senior management
- Do we know how many suppliers and subcontractors are working on our premises today?
- Can we prove, for a specific date, that they were compliant?
- What happens automatically when a critical document expires?
Conclusion
In short, supplier document management, including subcontractors, is one of the most effective ways to reduce risks that the organisation does not directly control. With proportionate requirements, a centralised platform and a link to operations, documents stop being an archive and become a control.
The benefit is not only legal. Indeed, well-documented suppliers get on site faster, mobilisation delays decrease and audits no longer require days of gathering evidence. Consequently, supplier document management becomes an operational advantage, not just an obligation.
AISP-GEDOC supports companies in defining requirements, in the document approval of suppliers, workers and equipment and in ongoing compliance control.
See also: Document requirements in contractor approval: How to avoid failures and ensure compliance and The importance of contractor approval.
Further reading: Contractor and subcontractor management: Complete guide.