Building and Construction Sector
Hands-on support on site safety, public procurement and internal controls for construction companies, general contractors, building services and refurbishment firms: qualification of the subcontracting chain, tender and SOA requirements, the Decree 231 Model, ISO systems and sustainability reporting.
Sector challenges
Title IV of Italian Legislative Decree 81/2008 allocates duties among the client, the safety coordinators, the principal contractor and the executing contractors: the safety and coordination plan and the operational safety plans to be kept consistent, interfering activities, verification of the technical and professional fitness of subcontractors under Annex XVII.
The licence introduced by Italian Decree-Law 19/2024 into Article 27 of Legislative Decree 81/2008 is a condition for working on site: credits are deducted following accidents and established breaches, and the score has to be monitored for subcontractors as well as for the company itself.
SOA categories and classification bands, the general eligibility requirements and grounds for exclusion under Italian Legislative Decree 36/2023, contribution compliance and the congruity of labour input: one adverse finding, or one deadline left unmonitored, and the next tender is out of reach.
Serious accidents, waste management, dealings with public sector clients and the subcontracting chain are the areas from which charges against the company under Italian Legislative Decree 231/2001 arise, with financial and disqualification penalties that bear directly on sites and tenders.
Construction and demolition waste, excavated soil and rock, temporary storage, transport forms and registers: obligations fragmented across different sites, with traceability moving progressively into the RENTRI register on staggered deadlines.
CCTV covering working areas, access badges and attendance recording, tracking of plant and equipment, data on the employees of subcontractors: processing that calls for legal bases, privacy notices and roles defined between the companies involved.
Areas of work
We review the safety management system against Title IV and Article 30 of Italian Legislative Decree 81/2008, with audits on live sites: consistency between the safety and coordination plan, the operational safety plans and the work actually under way, training and fitness for work, management of equipment, inspection records and corrective actions.
We build a single qualification process for the supply chain: technical and professional fitness documents, the credit-based licence, contribution compliance, operational safety plans, training expiry dates and periodic checks, with a calendar that flags what is missing well in advance.
We map the sensitive activities of a construction company (tenders, subcontracts, purchasing, personnel, waste, safety) and build protocols, reporting flows to the Organismo di Vigilanza (the Supervisory Body) and a whistleblowing channel, reusing the controls already in place in the safety system.
We set up audit plans covering the areas that generate the greatest risk: verification of the requirements declared in tenders, authorisation of subcontracts, variations and claims, advances and payments to suppliers, management of plant hire and recurring supplies.
We design or reorganise ISO 9001, 14001 and 45001 as a single system with one audit programme: it is needed in the supplier qualification processes of large clients and in SOA qualification, and it gives access to the reduction of guarantees provided for by the public contracts code.
We map the flows between site, technical office, bid office and administration (progress certificates, variations, orders, labour records, subcontractor documentation), remove redundant steps and introduce controls and indicators that management can read.
We oversee waste classification and traceability, the management of excavated soil and rock and the minimum environmental criteria in tenders; we prepare the data for clients’ ESG questionnaires and, above the thresholds, for sustainability reporting.
We define legal bases, privacy notices and retention periods for CCTV covering working areas, attendance recording and the tracking of plant and equipment, following where necessary the procedure under Article 4 of the Italian Workers’ Statute (Statuto dei lavoratori); we also set down in writing the roles of the principal contractor, the executing contractors and the self-employed workers in relation to the data of the workers present on site.
The site puts a company’s organisation to the test every day: several firms and self-employed workers operating alongside one another, interfering activities, subcontracts, third-party plant and equipment. Title IV of Italian Legislative Decree 81/2008 sets out a chain of responsibility that runs from the client to the safety coordinators at the design and execution stages and to the principal contractor, which must verify the technical and professional fitness of the executing contractors and self-employed workers under Annex XVII, and the consistency of their operational safety plans with its own, before the execution-stage coordinator checks them against the safety and coordination plan. Since 2024 there has been a further requirement, the credit-based licence (Article 27 of Legislative Decree 81/2008, introduced by Decree-Law 19/2024): below the credit threshold set by the rule, work on site is not allowed.
Companies working for public sector clients also answer to Italian Legislative Decree 36/2023: SOA qualification by category and classification band, general eligibility requirements and grounds for exclusion, the rules on subcontracting, minimum environmental criteria and contribution compliance. For building works there is a further requirement: the attestation of the congruity of labour input issued by the Casse Edili, the construction industry funds. It is an obligation separate from the contracts code (Article 8(10-bis) of Italian Decree-Law 76/2020), required in public works and, in private ones, above the value threshold laid down. The outcomes of such checks feed into the computerised records (casellario informatico) kept by ANAC, the Italian anti-corruption authority, and into the economic operator’s virtual file: an adverse finding on one site weighs on later tenders.
At the level of corporate liability, Italian Legislative Decree 231/2001 captures the risks typical of the sector: manslaughter and serious or very serious injury through breach of workplace safety rules (Article 25-septies), environmental offences (Article 25-undecies), offences against the public administration in dealings with public sector clients (Articles 24 and 25), and unlawful labour intermediation and exploitation. The organisation and management model for safety described in Article 30 of Legislative Decree 81/2008 is the natural point of connection: the full picture is set out in Decree 231 compliance. Alongside safety sits the environment, with construction and demolition waste, excavated soil and rock (Italian Presidential Decree 120/2017) and traceability moving into the RENTRI register on staggered deadlines.
We do not simply deliver documents: we work inside the processes. A single point of contact who knows safety, public contracts and internal controls works alongside technical management, site managers, the bid office and administration, so that obligations become procedures and conduct that can be verified.
We start from the sites as they really are and from the data the company already produces: inspection reports from the enforcement authorities, accidents and near misses, findings raised by the coordinators, supplier non-conformities, complaints from clients. The order of priorities follows from there. Along the supply chain, the verification of technical and professional fitness required by Annex XVII becomes a step in supplier qualification rather than an obligation of the individual site: the same data then feed the internal audits and the flows to the Organismo di Vigilanza. The techniques of business process engineering serve to remove redundant steps between site, technical office and administration, not to add forms.
When the company has to demonstrate to clients, certification bodies and authorities what it actually does, the ISO 9001, 14001 and 45001 management systems become the backbone: one body of documents, one audit programme, evidence that also serves the Decree 231 Model and the ESG questionnaires of the supply chain.
The scope is defined together: a single topic, periodic oversight of obligations and indicators, or support during peak periods. The decisions remain with the company’s own people: we bring regulatory insight, method and the ability to deliver, with responsibilities and timescales agreed at the outset.
Frequently asked questions
With an assessment that looks at the live sites, not only at the ring binders: consistency between the safety and coordination plan, the operational safety plans and the work actually in progress, training and medical fitness of the teams, equipment documentation, reports from the coordinators and the enforcement authorities, handling of near misses. From there comes a plan with a few clear priorities, distinguishing what is missing as a matter of law from what is needed to make the arrangements verifiable over time.
By moving the check upstream, into the qualification stage, instead of discovering that documents are missing when the team is already at the gate. A list of qualified suppliers, a document set defined once and for all (technical and professional fitness, the credit-based licence, contribution compliance, the operational safety plan, training, equipment), deadlines monitored through a single calendar and sample checks on site make it possible to authorise entry quickly and to document the verifications carried out.
The rules under Article 27 of Italian Legislative Decree 81/2008 cover companies and self-employed workers operating on temporary or mobile construction sites, excluding those who merely supply goods or provide services of an intellectual nature; exemptions apply to companies holding an SOA attestation in a classification band equal to or above the minimum set by the rule, a single band that is not scaled to the value of the contract. The application is submitted online to the Ispettorato nazionale del lavoro (the Italian labour inspectorate) and rests on requirements the company must be able to demonstrate: risk assessment and training obligations, contribution compliance, registration with the chamber of commerce. Scope and exemptions have to be checked case by case.
Adoption is not mandatory as a general rule, but the offences to which a construction company is exposed do not depend on the nature of the client: manslaughter and serious injury through breach of workplace safety rules, environmental offences, unlawful labour intermediation and exploitation, tax offences along the supply chain. A model that is adequate and effectively implemented, built around the sites, integrated with the safety system and overseen by an autonomous Supervisory Body is the company’s main line of defence in proceedings, including against the disqualification penalties that bear on sites and tenders; in many of the qualification schemes run by large private clients, moreover, its adoption is required in practice.
In tenders they matter on two distinct levels: certification of the quality system is a requirement for SOA qualification from the classification bands indicated in Annex II.12 to Italian Legislative Decree 36/2023 upwards; by contrast, ISO 14001 and 45001, together with other certifications, reduce the amount of the guarantees to be provided in the tender, at different percentages and with limits on cumulation, under Article 106(8) of the same decree. The soundest reason, though, is internal: ISO 9001, 14001 and 45001, run as a single system, give defined responsibilities, records that can be reused for the Decree 231 Model and for client questionnaires, and an audit programme that catches problems before the enforcement authorities do.
By starting from the data the company already produces: site and fleet consumption, waste produced and sent for recovery, accidents and training, workforce composition, supplier qualification. The thresholds for mandatory reporting have been revised and need to be checked case by case, while for companies below the thresholds there is a voluntary standard published by EFRAG that makes it possible to respond to the supply chain within a proportionate scope. We set up the data collection once and then reuse it for questionnaires, tenders and banks.
Related services
Organisation, Management and Control Models under Italian Legislative Decree 231/2001, predicate offence risk assessment and support for the Supervisory Body (OdV).
Find out moreDesign, implementation and maintenance of certifiable management systems: ISO 9001, 14001, 45001, 27001, 37001, 50001 and the main sector and supply chain schemes.
Find out moreAn internal audit function delivered on an outsourced or co-sourced basis: risk-based audit plans, testing of controls and reporting to the board.
Find out moreMapping, analysis and redesign of business processes: we remove waste, reduce operational risks and prepare the ground for digitalisation.
Find out moreCompliance with EU Regulation 2016/679 and the Italian Privacy Code: assessment, record of processing, DPIA, policies and training.
Find out moreESG reporting under CSRD, ESRS, GRI and the VSME standard: materiality assessment, data collection, drafting and assurance readiness.
Find out moreLet’s talk
Tell us your business priorities: in a first meeting with no obligation we look at your context and propose a concrete way forward, with clear timescales and measurable results.