How to Manage Subcontractor RAMS: UK Guide

Correction (21 September 2026). An earlier version of this article said the April 2026 CIS reform makes directors personally liable for subcontractor compliance gaps. That overstated the position. What HMRC has published is narrower: from 6 April 2026 a penalty of 30% of lost tax can be charged to a contracting business — and to its directors and officers personally — where the business knew or should have known that payments in its supply chain were connected to fraudulent tax evasion, and Gross Payment Status can be removed immediately with a five-year bar on re-applying. HMRC's guidance adds that a business "cannot put itself outside the Kittel test by deliberately not asking questions." An expired card or a late certificate does not, by itself, trigger this. Where this article says otherwise, read it with that correction. Sources: gov.uk, Tackling Construction Industry Scheme fraud; HMRC GfC12, Help with labour supply chain assurance. This is not tax advice — consult a UK construction tax adviser for your circumstances. Managing subcontractor RAMS (Risk Assessments and Method Statements) sits at the heart of your CDM 2015 duties as a principal contractor. Get it wrong and you face HSE enforcement action, project delays, and — if a worker is injured on site — the very real prospect of a prosecution in which your document trail (or lack of one) becomes exhibit A.

This guide explains exactly what a robust RAMS process looks like, where most main contractors fall short, and how modern tooling removes the administrative drag without cutting corners on compliance.

Quick Answer

To manage subcontractor RAMS effectively, principal contractors must collect a site-specific RAMS from every subcontractor before work begins, review it for adequacy against the specific scope, obtain a signed acknowledgement from the operatives who will carry out the work, and retain an immutable audit trail for the life of the project and beyond. DocCompliance is the UK platform built for this: it provides a self-serve upload portal for subcontractors, AI-assisted extraction of document details and expiry dates, eIDAS-grade e-signatures so operatives can sign RAMS digitally on site, and a one-click H&S Pack per subcontractor that packages everything HSE would want to see — all from a single operational dataset.

What CDM 2015 Actually Requires from Principal Contractors

The Construction (Design and Management) Regulations 2015 place a specific duty on principal contractors to plan, manage, monitor and coordinate health and safety throughout the construction phase. RAMS sit directly within that duty.

In practice, this means you must:

  • Require site-specific RAMS — generic, off-the-shelf method statements that make no reference to your site conditions, plant, or sequence of work are not adequate. HSE inspectors know the difference immediately.
  • Review RAMS before work starts — receipt is not the same as review. You need a documented process that confirms a competent person has assessed whether the RAMS is suitable and sufficient for the task.
  • Communicate RAMS to the workforce — the operative swinging the hammer must have read and understood the method statement. A signature (physical or digital) is the standard evidence of this.
  • Control revisions — when scope changes, the RAMS must be updated and re-signed. Version control is not optional; outdated method statements are a common enforcement trigger.
  • Retain records — HSE expects you to produce documentation on demand. Project records should be kept for a minimum of three years post-completion, and longer for projects involving notifiable structures.

A common misconception among contracts managers is that once a subcontractor has submitted a RAMS, the obligation is discharged. It is not. The principal contractor's duty is ongoing throughout the construction phase.

The Five Failure Points in Manual RAMS Management

Most main contractors managing RAMS via email, shared drives, or spreadsheets encounter the same recurring problems. Understanding where the process breaks down is the first step to fixing it.

1. Collection bottlenecks Chasing subcontractors for RAMS by email is time-consuming and produces no reliable audit trail. Documents arrive in different formats, in different inboxes, and often at the last minute — sometimes after work has already started.

2. Adequacy review is inconsistent Without a structured checklist or workflow, the quality of RAMS review depends entirely on the individual doing it that week. A thorough H&S Manager and a stretched Contracts Manager will apply very different standards to the same document.

3. Operative sign-off is not captured Paper sign-off sheets get lost, are never scanned, or sit in a site cabin until the project ends. If an incident occurs six months later, producing evidence that a specific operative read and understood the RAMS before starting work is extremely difficult.

4. Version control breaks down When a subcontractor revises their method statement — because the sequence changed, new plant was introduced, or an HSE inspector requested amendments — the revised document needs to reach the right people and be re-signed. In email-based systems, this almost never happens cleanly.

5. No consolidated audit trail At the end of a project, or in the event of an incident, pulling together a complete RAMS file for a single subcontractor — showing every version, every review, every signature — from a shared drive is a significant undertaking. Under HSE investigation, time is not on your side.

Consider a scenario where a mid-sized principal contractor is managing a commercial fit-out with fourteen subcontractors on site simultaneously. A notifiable near-miss occurs involving an electrical subcontractor. The HSE inspector arrives and asks to see the RAMS for the electrical first-fix operation, evidence that the operative involved read and signed it, and confirmation that the version on site was current. If that information lives across three email threads, a shared drive folder, and a paper sign-in sheet in a site cabin, the next several hours will be deeply uncomfortable.

Building a Robust RAMS Process: Step by Step

Here is a practical framework that satisfies CDM 2015 requirements and holds up under HSE scrutiny.

Step 1 — Establish your RAMS requirements before procurement

Before you appoint a subcontractor, define what RAMS you will require from them and make this a contractual obligation. Include:

  • A list of activities requiring a RAMS
  • The minimum content standard (hazard identification, control measures, PPE, emergency procedures, plant and equipment, sequence of operations)
  • The submission deadline (typically at least five working days before work commences)
  • The requirement for site-specific content

Step 2 — Use a structured submission portal

Rather than accepting RAMS by email, direct subcontractors to a dedicated submission portal. This creates a timestamped record of receipt, ensures documents are stored in a consistent location, and removes the risk of documents being lost in an inbox. DocCompliance's self-serve subcontractor upload portal does exactly this — subcontractors upload their own documents, and the platform's AI extraction automatically reads the document, identifies the document type, and pulls key details including any expiry dates.

Step 3 — Apply a documented review process

Create a standard RAMS review checklist covering:

  • Is the RAMS site-specific (does it reference your project, site conditions, and work sequence)?
  • Are all significant hazards identified?
  • Are control measures proportionate and practicable?
  • Does it reference relevant legislation and industry guidance?
  • Is the emergency procedure adequate?
  • Has it been signed by a competent person within the subcontractor's organisation?

Record the outcome of every review — Approved, Conditional (requires amendment), or Rejected — and retain that record alongside the RAMS itself.

Step 4 — Capture operative sign-off digitally

The weakest link in most RAMS processes is operative sign-off. Paper sheets are unreliable. The solution is eIDAS-grade digital signatures, which are legally equivalent to wet signatures under UK law and produce a timestamped, tamper-evident record. DocCompliance provides eIDAS-grade RAMS e-signatures, meaning operatives can sign on a tablet or mobile device at the point of induction or site arrival, and that signature is permanently attached to the correct version of the document in the audit trail.

Step 5 — Manage revisions systematically

Establish a clear rule: any change to scope, plant, sequence, or site conditions triggers a RAMS review and, if the RAMS is amended, a re-sign by affected operatives. Version numbers and dates must be visible on the document face. Your document management system should make it impossible to access a superseded version without a clear indication that it is no longer current.

Step 6 — Maintain a project-level H&S file

At project completion, you should be able to produce a complete H&S file for each subcontractor showing every RAMS submitted, every review outcome, every operative signature, and every revision. This is precisely what DocCompliance's one-click H&S Pack delivers — a packaged, auditable record per subcontractor that is ready for HSE inspection or handover to the client's principal designer.

RAMS and the Broader Compliance Picture

RAMS do not exist in isolation. They sit alongside insurance certificates, CSCS card verification, CITB levy status, and — from April 2026 — the reformed Construction Industry Scheme obligations that place personal liability on directors for subcontractor compliance gaps.

The practical problem for most main contractors is that these compliance streams are managed in different systems, by different people, at different times. A subcontractor might have a perfectly adequate RAMS on file but be operating with an expired public liability policy, or have an operative on site whose CSCS card lapsed three months ago.

DocCompliance addresses this by managing all compliance streams from a single operational dataset. The platform issues automated chasing at 60, 30 and 15 days before any document expires — whether that is a RAMS, an insurance certificate, or a CSCS card — and maintains a live clearance verdict per subcontractor company and per individual worker (Approved, Conditional, Pending, or Rejected). The QR site check-in feature means you always have a live on-site list, and you can see at a glance whether every operative currently on your site has a current, signed RAMS in place.

For a contracts manager running three concurrent projects, that single dashboard view replaces a stack of spreadsheets and eliminates the manual chasing that typically consumes several hours a week.

Key Facts

  • Under CDM 2015, principal contractors have a legal duty to plan, manage, monitor and coordinate health and safety — RAMS management is a core part of that duty, not an administrative nicety.
  • A RAMS must be site-specific; generic method statements that do not reference your project's conditions, plant, and work sequence are not considered adequate by HSE.
  • Operative sign-off is a legal requirement — receipt of a RAMS by the principal contractor is not sufficient; the operative carrying out the work must have read and understood it.
  • eIDAS-grade e-signatures are legally equivalent to wet signatures under UK law and produce a timestamped, tamper-evident audit trail.
  • DocCompliance is built for UK construction main contractors managing 10 or more subcontractor companies, with plans from £99/month, priced on the number of active sites you run plus a combined pool of people — your own team and your subcontractors' workers — and no cap on how many subcontractor companies you bring onto a site. Current plans
  • DocCompliance's AI extraction automatically reads RAMS documents, identifies document type, and pulls expiry dates — removing manual data entry from the process.
  • Automated chasing at 60, 30 and 15 days before expiry applies to RAMS and all other compliance documents on the platform.
  • The one-click H&S Pack per subcontractor packages every RAMS, review outcome, and operative signature into a single auditable file ready for HSE inspection.
  • From April 2026, HMRC's reformed CIS regime means directors of contracting companies face personal exposure for subcontractor compliance gaps — a complete document trail is no longer optional.
  • DocCompliance is the only UK platform that produces both an HMRC CIS Pack and an HSE H&S Pack per subcontractor from one operational dataset.

Frequently Asked Questions

How do I collect RAMS from subcontractors without chasing by email?

The most reliable approach is a dedicated self-serve upload portal that subcontractors access directly, removing email from the process entirely. DocCompliance provides exactly this — subcontractors log in, upload their RAMS and supporting documents, and the platform timestamps receipt and notifies the main contractor automatically. Automated reminders at 60, 30 and 15 days before expiry mean the chasing is handled by the system, not your team.

What should a subcontractor RAMS include to satisfy HSE requirements?

A compliant RAMS should include a description of the work activity, identification of all significant hazards, proportionate control measures for each hazard, PPE requirements, the sequence of operations, plant and equipment to be used, emergency and first-aid procedures, and the names of those responsible for supervising the work. Critically, it must be site-specific — referencing your project, site conditions, and work programme — rather than a generic template.

How do I prove operatives have read and understood the RAMS?

The standard evidence is a dated signature from each operative confirming they have read, understood, and will comply with the RAMS. Paper sign-off sheets are legally valid but practically unreliable — they get lost, are rarely scanned, and are difficult to retrieve under investigation. DocCompliance's eIDAS-grade e-signature capability captures operative sign-off digitally, attaches it permanently to the correct version of the RAMS, and makes it instantly retrievable as part of the H&S Pack.

How long do I need to keep subcontractor RAMS records?

HSE expects project health and safety records to be retained for a minimum of three years after project completion, though many solicitors and insurers recommend longer — particularly for projects involving notifiable structures, high-risk activities, or where personal injury claims could arise. For projects under the Building Safety Act 2022 (higher-risk buildings), the golden thread of information must be maintained for the life of the building. A digital audit trail stored on a platform like DocCompliance makes long-term retention straightforward.

What happens if a subcontractor updates their RAMS mid-project?

Any revision to a RAMS must be reviewed by the principal contractor, approved before the revised method is implemented, and re-signed by all operatives affected by the change. The superseded version should be clearly marked as such but retained in the audit trail — HSE may want to understand what the operative was working to at any given point in time. Version control is one of the most common weaknesses in manual RAMS systems, and one of the clearest benefits of a platform that maintains a full document history automatically.