Colmworth University - Permit-to-Work, Subcontractors and Competence
Colmworth University occupies 31 buildings across a 40-hectare campus; 26 are maintained by a hard FM contractor, the rest by an in-house team of five technicians. In the last five months there have been two electrical near misses during contractor work in plant rooms. In the first, a subcontractor's fitter opened a distribution board that had been isolated under the university's permit-to-work; the lock had been removed by a university cleaner with no training on the process. The contractor has changed its permit-to-work supervisor twice, and its 11 subcontractors are listed only in a spreadsheet the FM office cannot access. Service records sit in the contractor's CAFM system; the university holds a monthly PDF summary. Nobody in the FM team has been formally assessed against the competence requirements of their role. The ISO 41001 implementation lead has drafted a work instruction for permit-to-work and circulated it by email, but sign-off is unclear and two versions are in circulation.
1. Explain how the outsourced hard FM service should be controlled under clause 8.1, and what the near misses reveal about the current controls.
Read the worked answer
Outsourcing does not remove the process from the FM system. Clause 8.1 requires the organisation to plan, implement and control the processes needed to meet requirements, and to control outsourced processes - the standard expects criteria for the processes, implementation of control in accordance with the criteria, and records demonstrating the controls worked.
The near misses show the controls exist on paper and fail in practice at the interfaces:
- Authority boundary: a university cleaner could defeat an isolation. The permit system has no physical or procedural control protecting locks, and no awareness training for non-technical staff who enter plant rooms.
- Subcontractor visibility: 11 subcontractors known only through an inaccessible spreadsheet means the university cannot verify who is competent, inducted or authorised before they work. Contractor control criteria should include a register the university can see, subcontractor approval, induction records and supervision ratios.
- Vertical chain: two changes of permit supervisor inside five months indicates the contractor's own competence management is unstable; the contract should require notification and re-verification of key safety roles.
- Evidence access: a monthly PDF summary is not control. The university needs read access to the CAFM records it relies on, or contractual requirements for defined data extracts.
Fix in this order: isolation and lock-off procedure with defined authority and physical control; plant-room access control; a university-visible subcontractor register with induction evidence; then contract amendments. Corrective action under 10.2 should address why the cleaner had no awareness training and why the subcontractor list was invisible - not just reissue the work instruction.
2. What should the university do about competence and awareness across the in-house team, the contractor and building users?
Read the worked answer
Clause 7.2 requires the organisation to determine the necessary competence of persons doing work under its control that affects FM performance, ensure they are competent on the basis of education, training or experience, take action to acquire competence and evaluate the effectiveness of that action, and retain documented information as evidence. Clause 7.3 requires awareness of the FM policy, relevant objectives, their contribution to effectiveness, and the implications of not conforming.
Three distinct populations, three distinct answers:
- In-house FM team (five technicians plus managers). Build a role-based competence matrix: for each role, the required competences (electrical authorisation, water hygiene, asbestos awareness, contract management, CAFM use), the evidence, and a review date. Assess against it now; where gaps exist, plan training and re-evaluate. The FM lead's own competence in ISO 41001 and in contract management should be included.
- Contractor and subcontractor personnel. Competence here is verified, not delivered: the university sets the criteria, the contractor evidences it, and the university samples it. Include induction, authorisation to specific systems, and a rule that no subcontractor works without a named supervisor.
- Building users and ancillary staff. The cleaner who removed the lock did not need technical competence; she needed awareness that the lock is a safety control and must not be touched. That is a 7.3 issue with a short, targeted briefing - and it is also a test of whether the organisation learned from the near miss.
Effectiveness evaluation is the part most often skipped: a signed attendance sheet proves training occurred, not that competence was acquired.
3. The permit-to-work instruction exists in two versions with unclear sign-off. What does clause 7.5 require, and what should be done?
Read the worked answer
Clause 7.5 requires the FM system to include documented information required by the standard and that the organisation determines is necessary for effectiveness, and it requires appropriate identification, format, review and approval for suitability and adequacy, control of distribution, access, retrieval and use, storage and preservation, version control, retention and disposition, and control of externally sourced documents.
The situation breaches several of these at once: two versions in circulation (version control), unclear approval (review and approval for adequacy), email as the distribution mechanism (access and retrieval), and no owner of the document (accountability). More seriously, the document in question controls a life-safety process, so the risk is not administrative.
Practical steps:
- Assign a single document owner and an approver with authority - the person accountable for electrical safety, not the implementation lead by default.
- Withdraw both versions formally, issue one controlled version with an identifier, revision status, approval signature and effective date, and record the withdrawal.
- Confirm how the instruction reaches the people who need it: contractor supervisors, technicians, and anyone who can affect an isolation. A controlled document nobody has read is not controlled in any meaningful sense.
- Define change control, including what happens when the contractor changes its own permit process.
- Keep the content proportionate. Clause 7.5 does not require a 40-page manual; it requires information that is necessary and controlled.
Expect the auditor to sample a live permit and trace it back to the controlled instruction and to the competence records of the signatories.