SWMS Review Checklist: How to Review a Subcontractor's SWMS

Under the WHS Regulation 2025, the principal contractor on a construction site has a legal obligation to obtain a SWMS from every subcontractor before high-risk construction work begins. Obtaining it is only half the obligation. The PC must also review the SWMS for adequacy — and that is where most principal contractors fall short, and where regulators most often find the gap that turns administrative compliance into enforcement action.

The review obligation exists because a SWMS is only as good as its content. A generic SWMS downloaded from the internet and stamped with a different site address does not satisfy the legal requirements. A SWMS with vague controls like "use appropriate PPE" does not reduce risk. A SWMS that has not been signed by the person who prepared it has no legal standing as a formal document.

When an inspector visits a construction site, they do not simply check that SWMS exist — they check that the SWMS are adequate, site-specific, and being followed. If the PC has accepted a substandard SWMS without reviewing it, the PC shares liability for any incident that occurs within the scope of that SWMS. Australian courts have repeatedly held that the principal contractor's obligation to review SWMS is not a rubber-stamp exercise — it requires genuine assessment of the document's adequacy by a person competent to make that assessment.

This checklist gives PCs and site supervisors a systematic framework for reviewing every SWMS that lands on their desk. Use it to standardise your review process, reject inadequate SWMS before work starts, and build a defensible audit trail that proves you took your review obligations seriously. The checklist is also a useful tool for subcontractors to self-audit their own SWMS before submitting them, which reduces the back-and-forth and gets work started faster.

Here are the first six items on the review checklist. If any item fails, the SWMS should be returned to the subcontractor for amendment before work starts.

1. Is it site-specific? The SWMS must reference the actual site address, the specific scope of work, and the particular conditions of this job. A SWMS that says "various construction sites" or uses a different site address is generic and non-compliant. Walk the site with the document in hand — do the conditions you are reading match the conditions you are seeing?

2. Does it identify the correct HRCW categories? Check the HRCW categories selected against the actual work scope. If the subbie is installing scaffolding, the SWMS must identify heights and potentially the use of powered mobile plant for material hoists. Missing categories mean missing hazards, which means missing controls, which means exposure. Cross-reference the 18 HRCW categories in Schedule 1 of the WHS Regulation 2025 against the planned work activities.

3. Are hazards specific to this site, not boilerplate? Read the hazard list. If every hazard is generic — "slip, trip, fall", "manual handling", "noise" — without reference to the specific conditions on your site, the SWMS has not been prepared with genuine thought. Site-specific hazards include things like "overhead 11kV powerline 4 metres east of the work zone" or "adjacent excavation with unsecured edge 3 metres from the scaffold base." The level of specificity signals whether the preparer actually walked the site.

4. Is the risk matrix completed — before and after controls? Every hazard must have a risk score before controls are applied and a residual risk score after controls. A SWMS with no risk scores, or with only "after controls" scores, does not demonstrate that the risk assessment was genuine. A SWMS that drops every hazard from Extreme to Low after controls without meaningful discussion of how the drop was achieved is equally suspicious.

5. Are controls specific and actionable? "Use appropriate PPE" is not a control. "Hard hat (AS/NZS 1801), safety glasses (AS/NZS 1337), hearing protection (AS/NZS 1270) when operating drop saw" is a control. Every control measure must be specific enough that a worker can read it and know exactly what to do, and that an inspector can verify whether the control is actually in place.

6. Are responsibilities assigned to named roles? Each control must be assigned to a specific role — not "all workers" for everything. Who installs the edge protection? Who tests the RCD? Who conducts the gas test before confined space entry? Who maintains the exclusion zone during crane lifts? Named roles create accountability and make the document operationally useful rather than abstractly descriptive.

7. Is it signed by the person who prepared it? The WHS Regulation 2025 requires the SWMS to be prepared by the PCBU performing the work, in consultation with workers. The preparer must sign the document. An unsigned SWMS has no legal standing and provides no evidence that the PCBU accepted responsibility for its content. This is one of the easiest items to check and one of the most commonly missed.

8. Has worker consultation been recorded? The SWMS must show evidence that workers who will carry out the HRCW were consulted during preparation. This can be as simple as a section listing the workers consulted, their roles, the date of consultation, and a brief note of any concerns or changes that resulted from the conversation. A SWMS prepared entirely by the office safety manager without worker input fails the consultation test under section 47 of the WHS Act 2011.

9. Does it reference the correct legislation? The governing regulation varies by state. In NSW, QLD, WA, SA, TAS, ACT, and NT, the SWMS should reference WHS Regulation 2025. In Victoria, OHS Regulations 2017. A SWMS that references outdated legislation (for example, references to OHS Regulation 2001 in a NSW document, or references to superseded numbering in the model WHS Regulation) signals that the document is old and has not been reviewed for currency.

10. Are SDS referenced for hazardous chemicals? If the work involves hazardous chemicals — adhesives, sealants, paints, solvents, cleaning agents, epoxy coatings, concrete sealers, bonding agents — the SWMS must reference the Safety Data Sheet for each product and include controls consistent with the SDS requirements (PPE, ventilation, storage, spill response, emergency procedures). The 2-year SDS currency requirement applies: any SDS older than 5 years is invalid under the model WHS Regulations.

11. Is there a review trigger or date? A SWMS must be reviewed when conditions change, after an incident, or when a worker identifies a new hazard. The document should specify when and how it will be reviewed. Standard review triggers are listed in the SWMS text itself — after any incident, when conditions change, when a new worker joins the crew, at the request of an HSR, and on a specified periodic schedule for long-duration projects.

12. Is the SWMS a reasonable length? A one-page SWMS for complex HRCW is too brief to be adequate. A 30-page SWMS for a simple task is too long to be practical — nobody will read it and workers will sign on without comprehension. NT WorkSafe and other regulator guidance recommends a practical upper limit of around 6 to 8 pages for most trade SWMS. The document should be concise enough that workers will actually read it, but detailed enough that controls are specific and actionable.

After reviewing thousands of SWMS across Australian construction sites, the following are the six most common reasons principal contractors send SWMS back to subcontractors for amendment.

1. Generic — not adapted to this site. The single most common failure. The subbie has a master SWMS that they print for every job with only the site address changed. The hazards are generic, the controls are boilerplate, and there is no evidence anyone walked the actual site before writing the document. A SWMS like this is worse than useless — it creates a false sense of compliance while leaving site-specific hazards unaddressed.

2. No risk ratings or incomplete risk matrix. The SWMS lists hazards and controls but skips the risk assessment entirely. No likelihood scores, no consequence scores, no before-and-after comparison. Without risk ratings, the PC cannot demonstrate that controls are adequate or that residual risk is acceptable. This is a prosecution trigger because courts view the missing risk assessment as evidence that the preparer did not genuinely engage with the hazards.

3. Controls say "as required" instead of specifics. "PPE as required." "Barricading as required." "Training as required." These are not control measures — they are placeholders. An inspector reading "PPE as required" will ask: which PPE? Required by whom? Under what conditions? If the document cannot answer, the control effectively does not exist.

4. No evidence of worker consultation. The SWMS was clearly written by an office-based safety professional who has never visited the site. No workers' names in the consultation section, no evidence of a pre-start discussion, no worker signatures reflecting input on the document before sign-on. Section 47 of the WHS Act requires genuine worker consultation — not a document produced in isolation.

5. Wrong HRCW categories checked. The subbie has ticked "working at heights" but not "powered mobile plant" even though they are using a scissor lift. Or they have ticked "demolition" but missed "asbestos disturbance" even though the building was constructed before 1990. Missing HRCW categories means missing hazards and missing controls, and the PC is expected to notice.

6. Unsigned. The SWMS has no signature from the preparer, no sign-on from workers, or both. This is an immediate rejection — an unsigned SWMS is a draft, not a legal document. No inspector will accept it and no court will give it weight.

If you are a PC managing 20 or more subcontractors on a large site, reviewing SWMS becomes a significant administrative task. Here is how to standardise the process so it is consistent, efficient, and defensible.

Create a SWMS review register. A spreadsheet or database that tracks every SWMS received: subcontractor name, trade, SWMS title, date received, reviewer name, review date, status (accepted, rejected, pending amendment), expiry or review date, and a link to the stored document. This register is your primary evidence that reviews are happening systematically rather than ad hoc.

Use this 12-point checklist as a standard review form. Print it or build it into your WHS management system. Every SWMS gets reviewed against the same 12 criteria by a competent person. Tick pass or fail for each item, add comments where items fail, and file the completed checklist with the SWMS as part of the project records.

Set a turnaround time. Tell your subbies: submit your SWMS at least 3 working days before HRCW starts. The PC will review within 48 hours and return any document requiring amendment. This prevents the 6 AM situation where a subbie hands the supervisor a SWMS at the site gate and expects to start work in 10 minutes.

Reject — do not rewrite. If a SWMS is inadequate, send it back to the subcontractor with specific feedback on what needs to change. Do not rewrite it yourself. The legal obligation to prepare the SWMS sits with the PCBU performing the work — that is the subcontractor, not the PC. If you rewrite their SWMS, you are assuming their obligation and potentially their liability, and you are undermining the subcontractor's ownership of the safety plan.

Audit compliance on site. Reviewing the SWMS on paper is step one. Step two is checking that the work on site matches what is in the SWMS. Are the controls actually in place? Are workers actually signed on? Is the current version of the SWMS actually accessible on site? A perfect SWMS in a filing cabinet while workers operate without edge protection is compliance theatre and attracts the same penalties as no SWMS at all.

Record the review. The review itself should be documented — completed checklist, reviewer's signature, date, any comments returned to the subcontractor, the subcontractor's response, and the final acceptance decision. This audit trail is what you will need when a regulator asks "how do you know this SWMS was reviewed?" during an inspection or post-incident investigation.

The review is only as good as the person performing it. Australian courts have held that a competent person review is what the regulation requires, and a review performed by someone without sufficient construction or WHS expertise does not discharge the PC's obligation.

On smaller sites, the site supervisor or foreman often performs SWMS reviews alongside their other duties. This is acceptable provided the supervisor has genuine construction experience, understands the HRCW categories, knows the hierarchy of controls, and can identify inadequate documentation when they see it. If the supervisor has no formal WHS training beyond White Card, investing in a short course on SWMS preparation and review is reasonable due diligence.

On larger sites, the WHS manager or coordinator typically performs SWMS reviews. These roles often require tertiary qualifications in occupational health and safety or extensive field experience, and they bring structured review methodology to a busy site. On major infrastructure projects, multiple reviewers may share the load, with a senior WHS professional overseeing the consistency of the review standard.

Regardless of who performs the review, the reviewer must be independent enough to reject substandard work without organisational pressure to accept it. A reviewer who is told by management to "just approve it so we can start work" is being asked to breach the regulation, and any consequent incident exposes both the reviewer and the management chain to individual liability under the due diligence provisions.

Reviewer competence is not a one-time qualification. It requires ongoing learning as regulations evolve, HRCW categories are interpreted by courts, and construction methods change. A reviewer who was trained in 2018 and has not refreshed their knowledge since is working with outdated reference material, and any SWMS they approve inherits that outdated foundation.