Contractor compliance documents every South African business must keep on file

Most South African businesses do not fail a compliance check because they are non-compliant. They fail because a certificate expired in March and nobody noticed until an auditor asked for it in September. The documents existed. They were just out of date, in someone’s inbox, or on a laptop that left with an employee.

The documents that get asked for

If you use contractors or suppliers, or you are audited by a larger client, this is the set that comes up again and again:

• B-BBEE certificate or sworn affidavit — affidavits are valid for 12 months from signature, and EMEs and QSEs use different instruments. Check which one applies before assuming the file is fine.
• COIDA Letter of Good Standing — issued by the Compensation Fund, and typically valid for a limited period. An expired letter is treated as no letter.
• Tax Clearance / Tax Compliance Status PIN — the PIN lets a third party verify your status in real time, which means yours can quietly go non-compliant without you being told.
• Public liability insurance — with the schedule, not just the certificate.
• Sector permits and registrations — CIDB grading, licences, professional registrations, depending on your industry.

OHSA Section 37(2): the one people miss

Section 37 of the Occupational Health and Safety Act makes an employer liable for the acts and omissions of its mandataries — contractors working on its premises. Section 37(2) allows that liability to be managed through a written agreement between the client and the contractor, setting out the arrangements for the contractor’s health and safety compliance.

Two practical consequences:

1. If you bring contractors onto your site, you want a signed 37(2) agreement on file for each one.
2. If you are the contractor, expect to be asked for it — and expect the work to stop until it exists.

It is a single document that is easy to produce and expensive to be missing.

Why spreadsheets lose this fight

A compliance spreadsheet is fine on the day it is written. It degrades because:

Nothing chases you. A date in a cell does not phone anybody. Expiry is only noticed when someone opens the file, which tends to be after the deadline.

The document and the date live apart. The spreadsheet says the letter is valid until August; the actual PDF is in an email thread. At audit you need the document, not the row.

It does not survive staff turnover. The person who maintained it leaves, and the file quietly stops being updated.

What good looks like

A workable system does four things:

• Stores the actual document against the supplier or contractor, not just a date.
• Knows the expiry date and counts down without being asked.
• Warns early — 60 and 30 days out, not the morning it lapses. Renewals take weeks.
• Reaches a human where they actually are. An email into a full inbox is not a reminder; a WhatsApp usually is.

Start with the ones that stop work

You do not need to digitise every document at once. Rank them by what happens when they expire. A lapsed Letter of Good Standing or an expired 37(2) agreement can halt you on site tomorrow. An out-of-date company profile cannot. Track the work-stopping ones properly first.

ComplianceGuard was built around exactly this: permits, supplier B-BBEE, COIDA and tax documents, contractor SLAs and OHSA 37(2) agreements in one place, with automated WhatsApp reminders before anything expires.

This is general information, not legal advice. Compliance obligations depend on your sector, size and contracts — confirm your position with a qualified advisor.