Templates and records · ISO 45001 · Clause 8.1.4.2

Record of coordination of business activities (CAE)

When a contractor comes on site, the risks of both companies add up. The coordination record shows that they have been shared, that measures have been agreed and that nobody gets in without verified documentation.

In one sentence

The record of coordination of business activities captures, for each contractor working at the site, the risk information exchanged, the instructions given, the coordination arrangements agreed and the checks on its staff’s training and medical fitness, because Spanish RD 171/2004 requires prevention to be coordinated between companies working at the same site and ISO 45001 requires their hazards and risks to be coordinated with contractors (8.1.4.2).

Content reviewed on 17 October 2026

Where the standard requires it: ISO 45001 · Clause 8.1.4.2 Clauses are cited using the numbering of ISO 45001:2018, the current edition, which includes the 2024 amendment on climate change.
Type of information: Good practice ISO 45001 requires coordination (8.1.4.2), not a record; the documentation duty comes from RD 171/2004
Who fills it in: Site owner and principal company Kept by the health and safety practitioner, with purchasing handling onboarding and the manager of the area where the contractor works
When: Before work begins And whenever activities change or an emergency or accident occurs
How long it is kept: Set by the organisation ISO 45001 sets no retention periods (7.5.3). Spanish Law 31/1995 also requires prevention documentation to be kept available to the labour authority (art. 23), so it is wise not to destroy anything while the role or risk it refers to still exists.

What the standard requires

What ISO 45001 demands and what it leaves to your judgement

The standard requires procurement processes to be coordinated with contractors in order to identify hazards and control the risks arising from their activities, from the organisation’s activities that affect them and from those that affect third parties. It also calls for health and safety criteria when selecting them and for assurance that they meet the system’s requirements.

RD 171/2004, which implements article 24 of Law 31/1995, spells out the obligations: companies working at the same site must inform one another of the risks that may affect the others, the site owner must inform and instruct the contractors, and the principal company must ensure that contractors carrying out work within its own core activity comply with prevention law.

The record is not just a pile of contractor documents: it must show the exchange in both directions and the coordination arrangements chosen, such as meetings, instructions or the appointment of a coordinator.

Read it in context: Operation, in the ISO 45001 Academy

Structure

Fields the template should include

Contractor, activity and whether it is part of the core activity
Site, area and period of work
Contractor risks that may affect others, and vice versa
Information and instructions provided by the site owner
Coordination arrangements agreed: meetings, on-site prevention officer, coordinator
Documentation verified: risk assessment, training, medical fitness, insurance
Workers authorised to enter and validity date of their documentation
Incidents and accidents during the work

Example

Example: roof maintenance by an external company

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Company	Cubiertas Lizarra (fictitious company) · repair of the roof of building 2
Period	13 to 24 April 2026 · 4 workers
Contractor risks	Falling objects onto the production area below
Site risks	Forklift traffic in the access yard; roof with fragile skylights that cannot be walked on
Measures agreed	Area below cordoned off during the work; lifeline and safety nets under the skylights
Coordination arrangements	Kick-off meeting on 10 April and the contractor’s on-site prevention officer present
Documentation verified	Work-at-height training, medical fitness and insurance for all 4 workers, all current
Access	All 4 authorised; one turned away on 13 April for expired training until the renewal was presented

At the audit

Mistakes auditors commonly flag

Plenty of contractor documentation is collected, but there is no record that the contractor was told about the site’s risks.
Contractor staff come on site with expired training or medical fitness.
Self-employed workers and the contractor’s own subcontractors fall outside the controls.
No coordination arrangements are defined for work whose risks interact.
Accidents involving external workers are not investigated because “they are not our staff”.

In Kimobox

How this record is kept in Kimobox

1Coordination with each contractor is managed from the CAE module, with information exchanged in both directions.
2The health and safety documentation of every external worker is verified before they enter the site, and access control checks it.
3Training, fitness and insurance expiry dates trigger an alert before they lapse.
4Incidents involving external staff follow the same investigation workflow as those involving your own.

Frequently asked questions

What people ask us before getting started

What are the site owner and the principal company?

Under RD 171/2004, the owner is whoever has the authority to make the workplace available and manage it; the principal is whoever contracts or subcontracts works or services within its own core activity that are carried out at its site. The same company can be both.

Is it enough to ask the contractor for documents?

No. Coordination also requires the site owner to inform contractors of the site’s risks and emergency measures, and coordination arrangements to be agreed when risks interact. Collecting paperwork covers only part of it.

How does it relate to ISO 45001?

Clause 8.1.4.2 requires hazards and risks to be coordinated with contractors and health and safety criteria to be applied when selecting them. In Spain, complying properly with RD 171/2004 is the natural way to demonstrate it.

Keep your ISO 45001 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

Royal Decree 171/2004 of 30 January implementing article 24 of Law 31/1995 on the coordination of business activities BOE-A-2004-1848 · BOE No. 27, 31 January 2004
ISO 45001:2018 — Occupational health and safety management systems — Requirements with guidance for use ISO · 2018 ed., with Amd 1:2024
Ley 31/1995 of 8 November on the prevention of occupational risks BOE-A-1995-24292 · Consolidated text