General contractors can be cited for subcontractor training violations under OSHA’s Multi-Employer Citation Policy (CPL 2-0.124), even when their own employees aren’t exposed. Controlling employers must verify subcontractor training credentials before site access through QR code scanning or ATO contact, document verification, and maintain systems that demonstrate reasonable care.
Training verification isn’t optional. Under the Multi-Employer Citation Policy, general contractors, construction managers, and project owners with supervisory authority are classified as “controlling employers” legally responsible for detecting and preventing safety violations created by subcontractors.
OSHA does not maintain a central database for card verification. Fraudulent certificates are widespread, verification processes vary by card type, and missing a fake card leads to citations, insurance scrutiny, and project delays.
Why General Contractors Get Cited for Subcontractor Training Gaps
OSHA’s Multi-Employer Citation Policy (CPL 2-0.124) creates shared liability on multi-employer worksites. If you’re the general contractor, construction manager, or project owner with supervisory authority, OSHA considers you a “controlling employer” even when your own employees aren’t exposed to the hazard.
OSHA categorizes employers into four types:
- Creating Employer – Caused the hazardous condition
- Exposing Employer – Has employees exposed to the hazard
- Correcting Employer – Responsible for fixing the hazard
- Controlling Employer – Has general supervisory authority over the worksite
As a controlling employer, you’re required to exercise “reasonable care” to prevent and detect violations. That includes verifying subcontractors have properly trained their workers before they access your site.
Recent Enforcement Pattern: OSHA continues actively citing general contractors for subcontractor violations, though outcomes vary based on documented oversight. In Secretary of Labor v. Fama Construction (OSHRC No. 19-1467, March 2023), a GC was held liable for its subcontractor’s violations. The court ruled that stopping worksite safety inspections to avoid liability actually increased exposure under the controlling employer duty.
However, GCs have successfully defended citations where they demonstrated lack of knowledge through documented inspection programs: Summit Contracting Group (May 2022) and StormForce of Jacksonville (March 2021) had fall protection citations vacated when the Commission found the GCs lacked actual or constructive knowledge of violations given their limited site presence and documented safety protocols. Suncor Energy (February 2019) also prevailed by showing reasonable care through regular inspections that failed to reveal the specific hazard cited.
Documented verification systems demonstrating reasonable care provide defensible evidence, while reducing oversight to avoid liability backfires.
Courts evaluate reasonable care based on project scale, work pace, your knowledge of the subcontractor’s safety history, and your authority to correct violations. You can’t assume subcontractors are handling training, you need documented verification.
What Training to Verify
“They’ve got OSHA 10 cards” doesn’t cut it. Different trades need different training, and OSHA has specific requirements based on the work being performed.
The OSHA 10-Hour and 30-Hour Training for Construction or General Industry are baseline safety awareness courses, not certifications. These courses are required in certain states (New York City, Nevada, Massachusetts for public works) and by many general contractors as a contract requirement. But they’re just the starting point.
Competent Person Certifications (Task-Specific):
- Excavation & Trenching (29 CFR 1926.651)
- Fall Protection (29 CFR 1926.502)
- Scaffolding (29 CFR 1926.451)
- Confined Space Entry (29 CFR 1926.1203)
- Forklift/Powered Industrial Trucks (29 CFR 1910.178)
High-Risk Operations Training:
- Hazard Communication (29 CFR 1910.1200) for chemical handling
- Lockout/Tagout (29 CFR 1910.147) for equipment maintenance
- Respiratory Protection (29 CFR 1910.134) for respirator use
📘 For complete trade-specific requirements, see our guide on Subcontractor Training Requirements by Trade →
How to Verify OSHA/DOL Training Cards Are Real
OSHA does not maintain a central database for card verification. You’re responsible for confirming credentials are legitimate.
For Cards Issued After March 2016 (with QR Code)
OSHA cards issued after March 2016 include QR codes that verify in 15 seconds through the issuing ATO’s database.
- Open your smartphone camera
- Point it at the QR code on the card’s back
- Tap the verification link that appears
- Confirms legitimacy through the issuing ATO’s database
This takes 15 seconds and gives instant confirmation.
For Cards Issued Before March 2016 (No QR Code)
Older cards are paper-based. Verification requires:
- Locate the ATO name printed on the card
- Contact that Education Center directly
- Provide the student’s name and card number
- Wait for manual verification (24-48 hours)
If there’s no ATO name or contact information, that’s your first red flag.
🚩 Red Flags in Fraudulent Certificates
- Wrong card colors – Yellow stripe = OSHA 10 Construction, Orange stripe = OSHA 30 Construction, Light blue stripe = OSHA 10 General Industry, Dark blue stripe = OSHA 30 General Industry
- Missing ATO information – Every legitimate card includes the issuing Education Center’s name
- Typos or poor print quality – Professional cards are printed on durable plastic with clean fonts
- No trainer signature – The authorized trainer’s name must appear
- Impossible dates – Completing OSHA 30 in two days violates minimum hour requirements
If you suspect fraud, report it to OSHA’s fraud hotline: 847-725-7804 or email outreach@dol.gov. According to OSHA’s Outreach Training Program FAQs, trainers must issue cards within 90 days and maintain records for five years.
FAQs
1. Can OSHA cite me for my subcontractor’s safety violations?
Yes. Under the Multi-Employer Citation Policy (CPL 2-0.124), general contractors can be cited as “controlling employers” if they failed to exercise reasonable care in preventing or detecting violations even when their own employees weren’t exposed.
2. How do I verify an OSHA 10 or 30 card is legitimate?
For cards issued after March 2016, scan the QR code on the back with your smartphone. For older cards, contact the Authorizing Training Organization (ATO) listed on the card to request manual verification. OSHA does not maintain a central database.
3. What are the signs of a fake OSHA training card?
Red flags include wrong card colors for the course type, missing ATO information, typos or poor print quality, no trainer signature, and impossible completion dates (e.g., finishing OSHA 30 in two days).
4. Are general contractors liable for subcontractor training deficiencies?
Yes. Under OSHA’s Multi-Employer Citation Policy (CPL 2-0.124), general contractors can be cited for subcontractor training deficiencies even when their own employees are not exposed to the hazard. This includes missing Competent Person certifications, inadequate equipment operator training, and failure to verify credentials before site access.
Sources: OSHA Multi-Employer Citation Policy
