An HSE assessment that consists of a policy document and a certificate copy tells you almost nothing about whether a contractor can actually control risk on your site. The gap between "has a safety policy" and "runs a genuinely safe operation" is where most serious incidents involving third-party vendors originate. This checklist walks through what a real HSE vendor assessment should cover in the UAE, including the specific detail — heat-stress rules, incident normalization, equipment certification — that a generic prequalification form tends to skip.
What Is an HSE Vendor Assessment?
An HSE assessment evaluates whether a supplier can actually control the health, safety and environmental risks created by its work — not whether it has a policy that says it can. It combines policies and management systems, competency, past performance, task-level controls, and project-specific evidence, and it shouldn't stop at award: it needs to continue through induction, supervision, reporting and close-out for the life of the engagement.
Which Vendors Require HSE Prequalification?
Construction, maintenance, facilities management, manufacturing, logistics, transport, waste, cleaning, security and field-service vendors commonly require it. The real triggers are activity-based: work at height, lifting, confined spaces, energized systems, hot work, chemicals, heavy equipment, excavation, and outdoor summer work all raise the bar. A pure office supplier may need only a basic safety declaration unless their work involves attending your sites or introducing hazards you wouldn't otherwise have. Base the depth of assessment on inherent risk, workforce size, duration, location and how much of the work is subcontracted.
HSE Policies and Management Systems
Request an approved HSE policy, an organization chart, defined responsibilities, an audit plan, and evidence of management review actually happening. Check that the system genuinely covers the contracted activities and UAE operations, rather than being a parent-company template that's never been localized. Look for hazard reporting, corrective action, emergency response, worker consultation and document control — and confirm competent leadership and real resources behind the policy, not just a signature at the bottom of it.
ISO 45001 and Supporting Certifications
ISO 45001 is an occupational-health-and-safety management-system standard, usually voluntary in the UAE unless a specific tender, client, regulator or contract requires it. Verify the certification body and its accreditation, the legal entity covered, locations, scope, issue and expiry dates, and surveillance-audit status — a certificate whose scope doesn't actually cover the activity you're contracting isn't useful evidence. Supporting evidence can include ISO 14001, civil-defence approvals, first-aid and fire training records, and activity-specific competency certificates. None of this proves site-level implementation on its own; test it against actual records and observations.
Employee Competency and Safety Training
Review the role-based training matrix, induction process, toolbox talks, refresher schedule and how competence is actually assessed rather than just attended. Verify operators, drivers, riggers, scaffolders, electricians, first-aiders and other safety-critical roles specifically. Check language and literacy accessibility — training delivered in a language the workforce doesn't fully understand isn't effective training — and confirm attendance evidence and whether temporary and subcontracted workers are actually included, not just the permanent core team.
Risk Assessments and Method Statements
Require task-specific risk assessments and method statements (RAMS) that genuinely address site conditions, sequence, people, plant and emergency controls — not a generic template copied across every job. Ensure residual risks, responsible persons, and approval or briefing records are clearly stated. Generic, copied RAMS, missing interfaces between trades, and risk ratings that ignore controls already in place are all warning signs. Any change in scope, equipment, location or conditions should trigger a fresh review, not a retroactive update to the paperwork.
Incident, Injury and Near-Miss Records
Request three to five years of data where proportionate: fatalities, lost-time injuries, medical-treatment cases, restricted work, environmental events and near misses. Normalize using hours worked and consistent definitions, and ask for rates alongside the underlying counts — a raw number means little without exposure context. Examine regulator notices, root-cause investigations, corrective actions and whether the same issues recur. Low reported numbers can indicate either good controls or a weak reporting culture; comparing near-miss and observation activity levels helps distinguish the two.
Equipment Inspection and Certification
Maintain an equipment register covering ownership, identification, inspection, maintenance and certification status. Verify lifting appliances and accessories, pressure systems, electrical tools, vehicles and safety devices through competent inspection where required, and check operator competency, pre-use inspection routines, defect isolation and calibration. Expired or unverified equipment shouldn't be reaching site at all — this is one of the easiest controls to enforce and one of the most commonly waived under schedule pressure.
Working at Height and Confined-Space Controls
For working at height: apply the hierarchy of controls, engineered access, guardrails, scaffold inspection, fall restraint or arrest systems, a rescue plan, and dropped-object prevention. For confined spaces: identification, permit-to-work, atmospheric testing, isolation, ventilation, a standby person, communications and a genuinely feasible rescue plan — not just a permit form. Verify task-specific training and equipment inspection for both; a permit alone, without competent supervision and a workable rescue arrangement, isn't sufficient.
Heat-Stress and Worker-Welfare Compliance
MoHRE's 2026 Occupational Heat Stress Prevention Policy prohibits covered outdoor work in direct sun from 12:30 p.m. to 3:00 p.m., between 15 June and 15 September, subject to stated exceptions and controls. Assess water access, shade, cooling, rest, acclimatization, emergency response, supervisor training and heat-illness reporting. Review wages, working time, transport, medical cover and accommodation where relevant — MoHRE rules require accommodation for specified establishments, including the stated 50-worker/AED 1,500 wage conditions. Check the current year's policy specifically, since dates, exceptions and operational requirements can be updated, and the broader Federal Decree-Law No. 33 of 2021 on the Regulation of Labour Relations sits underneath these sector-specific rules.
Subcontractor HSE Management
Require pre-approval, risk assessment, and flow-down of HSE obligations to every subcontractor, not just the ones on the main contract. The prime contractor should disclose subcontracted scope, selection criteria and supervision arrangements, and subcontractors should be included in induction, permits, inspections, reporting and performance metrics on the same terms as direct employees. Prohibit unapproved substitution or further subcontracting without your visibility and sign-off.
How to Calculate a Vendor HSE Risk Score
Start with inherent exposure — activity severity, frequency, workforce size, site conditions and subcontracting depth. Score control domains — governance, competence, RAMS, incident history, equipment, emergency readiness and subcontractor management — and weight them by materiality to the actual work. Apply critical fail rules for missing legal approvals, falsified evidence, unresolved fatalities or serious enforcement history, or an inability to control genuinely high-risk work. Report inherent risk, control effectiveness and residual risk as separate figures rather than collapsing everything into one unexplained percentage that hides where the actual weakness sits.
Continuous HSE Compliance Monitoring
Track certificate and insurance expiry, audits, inspections, observations, incidents, corrective actions and leading indicators on an ongoing basis. Reassess after serious incidents, scope changes, poor performance, new subcontractors, or regulatory action — not just on a fixed annual cycle. Where feasible, connect access or permit controls to compliance status so a critical expiry actually affects work authorization instead of being a note in a spreadsheet nobody checks before granting site access. Vendoreye can track certificate and insurance expiry against your vendor master record and flag lapses before they become a site-access problem — see how this fits into the broader supplier prequalification process, or read more on how risk-based assessment routing works. Use trend analysis and contractor meetings to drive intervention — monitoring exists to change behavior, not just populate a dashboard.