Three-tier subcontracting can make a workforce look simple on paper while being complex in operation. The principal employer needs visibility beyond the first vendor name.
Map the chain: principal employer, primary contractor, subcontractor and deployed workforce. Capture the site, work order, activity, headcount and period for each layer.
Then test evidence. Licences, wage records, attendance, statutory records and deployment lists should reconcile with the actual population. A contractor certificate cannot replace establishment-level verification.
Contracts should be read alongside performance. If operational instructions, attendance control or deployment decisions differ materially from the written allocation of responsibility, the gap should be identified rather than ignored.
Vendor scorecards should therefore include compliance evidence, not just commercial performance. Repeated late submissions, unexplained headcount movements or missing statutory evidence should trigger escalation.
The control framework should define what is checked before deployment, what is checked monthly and what requires immediate escalation. That makes contractor governance operational rather than documentary.
A defensible principal-employer file is one where the business can trace the workforce through the subcontract chain and explain the controls applied at each stage.