Knowing how to vet a roofing contractor is one of the highest-value skills an FM never gets trained for. A roof contract is among the most expensive and highest-risk things you will commission, yet most FMs are handed no checklist and quietly assume the contractor carries the risk. They do not.
In October 2023, a commercial client was convicted alongside the principal designer and contractor and fined as part of a combined 410,000 GBP penalty after a slate fell from a hotel roof and injured a child. Appointing a contractor did not make the client exempt. The duty stayed with them.
This guide walks you through nine sequential steps, from understanding your own legal duties to a signed contract, with the exact registers and portals you need to verify every claim a contractor makes. Vetting is a process you work through in order. Start at Step 1.
Step 1: Understand Your CDM 2015 Client Duties First
You can be prosecuted as the client even after appointing a principal contractor. CDM 2015 defines a commercial client as any organisation carrying out construction as part of a business, and that explicitly includes an FM commissioning roof work. Client duties apply to every project regardless of size.
The principle that catches FMs out is that client duties are non-delegable. You cannot pass your safety duties to the principal contractor. You appoint people to carry out the work, but the accountability stays with you.
Your client duties are specific:
- Make suitable management arrangements for the project.
- Appoint a principal designer and a principal contractor in writing.
- Provide pre-construction information to those you appoint.
- Ensure a construction phase plan exists before work starts.
- Ensure a health and safety file is prepared and kept.
- Ensure adequate welfare facilities are provided.
Fail to appoint a principal designer or principal contractor and you take on those duties yourself by default. The duty simply lands back on you.
You must also notify HSE using form F10 before works begin if the project exceeds either 30 or more working days with 20 or more workers on site simultaneously, or 500 or more person-days in total. You can delegate completing the F10, but not the accountability for it being done.
The enforcement record is real: 191 CDM prosecutions since 2015, over 16.3m GBP in fines, and 12 client prosecutions under Regulation 4 alone. Knowing your exposure is what makes the rest of this vetting non-negotiable.
Step 2: Require NFRC Membership and Verify It
One public register tells you in 30 seconds whether a roofer is genuinely accredited or simply self-declaring. Use it on every shortlisted contractor before you go further.
NFRC membership is not a logo you buy. It signals triennial site inspections every three years, compliance with the NFRC Code of Practice, a financial stability check, and independent verification of insurance. The NFRC has over 1,200 members and was established in 1892, which makes it the benchmark trade body for UK roofing.
Compare that with review-based directories like Checkatrade or MyBuilder. Those collect customer ratings, which is useful for a homeowner but gives you no procurement-grade assurance for a commercial building. A five-star rating tells you nothing about a contractor’s insurance or financial health.
To verify, do this:
- Go to the NFRC trade member directory at nfrc.co.uk/trade-member-directory.html.
- Search by the company’s exact registered name.
- Confirm the membership is live and current.
Do not accept a logo printed on a quote as proof. An NFRC accredited roofing contractor will appear on the register, and if they do not appear, treat the claim as false. For refurbishment work there is a second, more important NFRC register you also need to check, which is the focus of the next step.
Step 3: Check for NFRC CPS Registration if Replacing 50% or More of the Roof
Replacing more than half a roof quietly makes you, the FM, responsible for Building Regulations compliance. Unless one box is ticked, that liability sits with you and can surface years later.
Under Approved Document L, replacing 50% or more of a roof covering triggers a mandatory notification to Local Authority Building Control. This is not optional, and it is not the contractor’s problem by default. It is the building owner’s, which in practice means yours.
NFRC CPS registration solves it cleanly. NFRC CPS is the only government-licensed, UKAS-accredited roofing Competent Person Scheme in England and Wales. A registered contractor self-certifies the work, notifies LABC electronically, and you receive a Building Regulations Compliance Certificate automatically, usually within eight weeks. A 10-year Insurance-Backed Guarantee is auto-issued for qualifying jobs under 50,000 GBP.
Without a CPS-registered contractor, you pick up the burden: a LABC fee of roughly 200 to 400 GBP, a wait of two to five days or more for inspection, the paperwork to handle yourself, and a latent compliance liability that can resurface on a future sale or insurance claim.
To verify, search the CPS directory at crm.nfrccps.com. This is a separate register from NFRC trade membership, so check both. The scheme covers England and Wales only, applies to 50% or more refurbishment work, and excludes new builds and structural timber. With Building Regulations handled, move to health and safety prequalification.
Step 4: Verify SSIP, CHAS or SafeContractor Status on the SSIP Portal
One free portal confirms a contractor’s health and safety prequalification regardless of which scheme they hold. You do not need to learn every scheme, just where to check.
SSIP schemes assess a contractor’s health and safety capability through documentation review. CHAS is the largest, with over 70,000 members and established in 1997. SafeContractor has over 33,000. Both examine the health and safety policy, risk assessments and method statements, training records, accident reporting, and insurance.
CHAS runs tiers: Basic, Advanced which aligns to PAS 91, and Elite which adds GDPR, modern slavery and sustainability checks. For commercial procurement, require Advanced or Elite.
A point that trips up FMs is the deem-to-satisfy principle. Any SSIP-member scheme certificate is generally accepted in place of another, so do not reject a good contractor simply because they hold SafeContractor rather than CHAS. The schemes recognise each other.
To verify:
- Request the certificate showing company name, scheme, registration number and expiry.
- Search by company name at ssipportal.org.uk.
- Confirm it is current, as certificates carry 12-month validity.
- Confirm the scope covers roofing and work at height.
SSIP is a documentation review, not a site audit. It does not verify how the contractor performs on the roof, and it covers the principal contractor, not necessarily their subcontractors. Accreditation also does not confirm insurance limits, which is the next step.
Step 5: Verify Insurance Certificates With Commercial-Grade Limits
The 1m to 2m GBP public liability figure quoted on most roofing advice is a residential standard. For a commercial building, it is not enough, and accepting it leaves you exposed if a claim exceeds the cover.
Set commercial-grade limits as your baseline:
- Public liability: minimum 5m GBP, rising to 10m for high-value or high-risk buildings.
- Employers’ liability: minimum 10m GBP. The legal floor is 5m, but most policies default to 10m, so accept nothing less.
- Professional indemnity: required where the contractor advises on specification or materials.
If your contract specifies a limit the contractor cannot meet, keep them off site. The limit protects the building and its occupants, not the contractor’s convenience.
Verifying properly takes two steps. First, request a Certificate of Insurance showing the business name, the coverage period, and the PL and EL limits. Second, contact the insurer directly to confirm the policy is live. Fraudulent certificates exist, so direct insurer contact is the only definitive check.
Then lock it into the contract. Write the required insurance limits in as a term, which carries forward into Step 9. Employers’ liability certificates must be displayed by law, and you have every right to request proof of public liability. Insurance, though, is only as good as who is actually standing on the roof.
Step 6: Ask About Subcontracting and Verify CSCS Cards
The qualified, insured contractor who wins your tender is not always who turns up on the roof. Subcontracting is normal, but undeclared subcontracting can void the very insurance you just verified.
Understand the distinction. A bona fide subcontractor (BFSC) is independent, carrying their own insurance and tools. A labour-only subcontractor (LOSC) works under the main contractor’s supervision using supplied equipment, which makes them an employee in law and requires the main contractor’s employers’ liability insurance. If LOSCs are undeclared, an insurer can pro-rate a claim or void it entirely.
Ask these questions directly:
- Do you use directly employed operatives or subcontractors?
- Are they bona fide or labour-only subcontractors?
- Are all labour-only subcontractors declared on your employers’ liability policy?
Then verify the people. Use the free CSCS Smart Check app at CSCSSmartCheck.co.uk and on the App Store and Google Play. It scans the smart chip, verifies 2.3m cards across all 38 CSCS Alliance schemes, and detects fraud a visual check cannot. The CITB Online Card Checker is an alternative, using a surname plus card number.
Know the card colours so you can read a crew at a glance. Blue is NVQ Level 2, a skilled roofer. Gold is NVQ Level 3, a supervisor. Green is a labourer, not a qualified roofer.
Reject any crew that is Green-only, and spot-check cards whenever personnel change.
Step 7: Review the RAMS Before Any Work Starts
Roof work accounts for nearly one in five construction deaths, and falls through fragile surfaces cause 22% of all fall-from-height fatalities, more than any other single cause. The risk assessment and method statement is where that risk is either managed or ignored.
RAMS must be site-specific or they are worthless. Generic RAMS are non-compliant and routinely rejected by competent principal contractors. Each document must reflect the actual roof conditions, access methods, materials and hazards on your building. Accept a generic one and your failure to demand better becomes a factor in any HSE investigation.
A compliant RAMS contains five elements:
- Hazard identification: falls from height and fragile surfaces, asbestos, weather, proximity to electrical sources, manual handling.
- Control measures: specific edge protection, scaffolding or MEWP details, safety nets, permit-to-work arrangements.
- Method statement: the safe work sequence from access to completion, written for your specific site.
- Emergency procedures: first aid, emergency contacts, and a rescue plan for a worker who has fallen.
- Competency requirements: PASMA and IPAF certificates, a first aider on site.
Apply the fragile-roof rule throughout: treat every roof as fragile until a competent person confirms otherwise. The HSE hierarchy runs in order: avoid by working from below with a MEWP, control with stagings, nets and fall arrest, communicate with warning notices, and cooperate. Collective protection beats personal harnesses.
An asbestos-cement industrial roof needs a documented avoidance plan and rescue plan before any foot traffic. With safe work planned, verify the contractor’s track record.
Step 8: Check References From Comparable Commercial Projects
A handful of targeted phone calls to other FMs tells you more than any quote or testimonial page ever will. References are where the gap between sales pitch and site reality shows up.
Ask for three to five references from comparable projects, matched on size, building type and roofing system. Then speak directly to the FM or estates manager who managed the job. A website review is curated. A phone call is not.
Work through questions that surface real performance:
- Was the job delivered on time and within budget?
- How were unexpected problems handled when they came up?
- Was site supervision present daily, or only periodically? Absent daily supervision on a commercial site is a major risk indicator.
- Were CSCS cards and safety measures enforced throughout?
- Did the contractor use their own crew, or undisclosed subcontractors?
- Has the roof performed without leaks since completion?
- Did they respond promptly to defects during the defects liability period?
For a deeper safety signal, ask for RIDDOR reportable incident data over the past three years. A contractor confident in their record will share it.
A five-month-old roof with leaks and unflashed chimneys is exactly the kind of defect prior references would have surfaced before you ever signed. Once you trust the contractor, lock the deal in writing.
Step 9: Pin Down Contract Terms, DLP, Retention and Specification
All the vetting in the world is worthless if the contract gives you nothing to enforce when defects appear six months later. The contract is where your leverage lives or dies.
Write the defects liability period in expressly. A DLP has no automatic legal existence unless the contract states it. Set a minimum of 12 months from practical completion, during which the contractor must remedy defects. Notify them before engaging anyone else.
Statutory liability continues after the DLP: six years under a standard contract, 12 years under a deed, and up to 15 years for latent defects under the Latent Damage Act 1986. On high-value works, push for a deed.
Hold retention. The standard is 3 to 5%, typically 5% held until practical completion and 2.5% until the DLP expires. This is the single most effective lever for getting defects fixed promptly.
Specify the work in detail so there is no room for substitution:
- Materials by manufacturer and model.
- Insulation thickness and R-value.
- Fixing method, whether fully adhered, mechanically attached or loose-laid.
- Flashing and edge-condition treatment.
- Written warranty terms, separating workmanship from manufacturer cover.
Also build in the insurance limits from Step 5, the CDM duty-holder appointments from Step 1, and the Building Regulations route from Step 3. Walk the roof with the contractor at survey stage to catch specification gaps before award.
Want help structuring this for a live project? Talk to NSS at https://nssgroup.com/contact/ or look at our roof maintenance division.
Frequently Asked Questions
As an FM, am I responsible under CDM 2015 when I commission roofing work?
Yes. CDM 2015 makes you a commercial client with non-delegable duties the moment you commission roof work as part of a business. You must appoint a principal designer and principal contractor in writing and ensure a construction phase plan exists before work starts. Fail to appoint and those duties fall back on you personally.
What insurance should a commercial roofing contractor have?
A commercial roofing contractor needs public liability of at least 5m GBP, rising to 10m for high-value buildings, and employers’ liability of at least 10m GBP. Professional indemnity is required where they advise on specification. The residential standard of 1m to 2m is not enough. Confirm the policy is live by contacting the insurer directly.
How do I verify a contractor’s CSCS cards?
Use the free CSCS Smart Check app from CSCSSmartCheck.co.uk or the App Store and Google Play. It scans the card’s smart chip, verifies it across all 38 CSCS Alliance schemes, and shows the holder’s trade, qualification and expiry while detecting fraud a visual check misses. The CITB Online Card Checker is an alternative using surname and card number.
What does NFRC CPS registration mean when 50% or more of my roof is replaced?
Replacing 50% or more of a roof covering triggers mandatory Building Regulations notification to LABC, and that liability is yours as building owner. An NFRC CPS-registered contractor self-certifies the work and you receive a Building Regulations Compliance Certificate automatically, usually within eight weeks. Without one, you pay a LABC fee, wait for inspection, and carry the latent liability yourself.
Why does the lowest bid usually cost the most?
The lowest bid often omits edge protection, uses undeclared labour-only subcontractors, substitutes cheaper materials, or skips Building Regulations compliance. Those gaps surface as leaks, voided insurance claims, HSE liability and remedial costs that dwarf the saving. A correctly vetted contractor priced fairly is almost always cheaper over the life of the roof.
For help structuring your next roofing tender, talk to NSS at https://nssgroup.com/contact/ or explore our roof maintenance services.