Fined $230,000 for Someone Else’s Worker on Someone Else’s Plant

Most businesses treat contractor management as a filing job. Insurance certificate, licence copy, a signed safe work method statement, into the folder, tick. That is a procurement process. It is not a safety control, and the space between the two is where prosecutions live.

What happened at North Blackburn

In August 2023 a 25-year-old worker died at a construction site in North Blackburn, Victoria. He was working in a boom lift, installing safety mesh for future roofing works, and was crushed against an overhead steel frame.

On 24 August 2026 the Melbourne Magistrates’ Court sentenced two companies. Both had pleaded guilty.

WorkSafe’s investigation found that no spotter was being used for the task, and that the operator protection alarm fitted to the boom lift had been disconnected.

The charge that catches people out

Ridge Commercial’s charges are the ones anyone would expect. It owned the plant and it carried the primary duty.

Licojo’s charge is the one worth sitting with. It was convicted of failing to ensure that persons other than employees were not exposed to risks to their health and safety. A duty in that shape exists in every Australian WHS jurisdiction. Victoria runs its own Occupational Health and Safety Act rather than the model laws, but the principle is the same one the model Act carries in its primary duty of care.

What it means in practice is short and uncomfortable. If what your business does can hurt somebody, it does not matter whose payroll they are on.

“We did not own it” is not a defence

WHS duties overlap. They are not passed down a chain and they are not split into shares. More than one duty holder can hold a duty for the same thing at the same time, and each has to discharge it so far as is reasonably practicable.

The measures the court identified make the overlap concrete:

• For the owner: a system requiring employees to conduct and document daily pre-start inspections of the boom lift, to remove it from service where a safety malfunction or problem was found, and to arrange a licensed safety observer on site.
• For the service provider: to identify during the service that the operator protection alarm was not operational, and to keep the machine out of operation until the issue was rectified.

Neither company had to be solely at fault for both to be convicted. A contract allocating responsibility to the other party would not have changed either finding, because these duties cannot be contracted away. The code of practice for elevating work platforms makes the same point about hire arrangements: duties overlap rather than hand off.

The due diligence question for service and maintenance businesses

We have built management systems for service and mechanical businesses, and this is the conversation that lands hardest with them, because the exposure is invisible from inside the workshop.

If you service, repair, inspect, hire or maintain plant, your legal position is not set by the job you quoted. It is set by what your technician found, what they recorded, and what they did when the machine was not right.

That produces a short list of questions worth answering honestly:

• When a technician finds a safety device disconnected, bypassed or faulty, what happens? Is there a defined instruction to tag the machine out of service, and does the technician have the authority to do it without ringing the customer first?
• Where is that recorded? A service sheet listing what was replaced is not evidence that anyone assessed whether the machine was safe to return to use.
• What do you hand back? “She’ll be right” and a written statement that a machine was returned with a known fault are very different documents later.
• Who decides the machine goes back into service, and is that decision written down anywhere?
• If a customer instructs you to return a machine you believe is unsafe, what does your process require you to do?

That last one is the question businesses least like to think about, and it is the one that decides whether you were exercising due diligence or taking an instruction.

What ISO 45001 asks for

None of this requires certification. What a management system does is stop it depending on the judgement of whoever happened to be on the job that day.

Clause 8.1.4 is the relevant one, and its three parts map onto this case directly.

• 8.1.4.1 General. Controls over procurement, so that what you buy and what you supply does not introduce hazards.
• 8.1.4.2 Contractors. Coordination with contractors to identify hazards and control risks arising from their activities, and from your activities affecting them. The word coordinate is doing a lot of work there. It is not “collect their insurance certificate”.
• 8.1.4.3 Outsourcing. Where a function is outsourced, control over it is retained. Outsourcing the work does not outsource the duty.

Underneath that, clause 6.1.2 asks you to identify hazards arising from people in the workplace who are not your own workers, clause 7.2 covers the competence of the people making these calls, and clause 9.2 is the internal audit that tests whether any of it happens when nobody is watching. The general plant duties sit underneath all of it.

What an auditor asks for

If I were auditing your contractor arrangements tomorrow, this is the thread I would pull. It works as a self-test whether or not anyone is coming.

1. The list. Every contractor whose work could affect your people, and every client whose people your work could affect. Most businesses have the first list and have never written the second.
2. The interface. For each one, who identified the hazards where the two organisations meet, and when.
3. The instruction. What a technician or operator must do when they find something unsafe, in writing, including the authority to stop.
4. The evidence. A real example from the last twelve months where somebody found a defect, and what happened next.
5. The handback. What you issue when work is complete, and whether it records the safety status of the plant rather than only the parts fitted.
6. The loop. Did any of this reach management review, and did anything change as a result.

Points 3 and 4 are where most systems break. A policy saying unsafe plant is tagged out, with no instance of anything ever having been tagged out, tells an auditor exactly one thing.

The same shape as third-party cyber risk

If this feels familiar, it is because it is structurally identical to a problem information security has been having loudly. When a supplier loses your customers’ data, the notification obligation stays with you.

Safety and security are arriving at the same conclusion from opposite directions. Your duty follows your influence, not your org chart. A vendor questionnaire on file and a prequalification folder on file are the same control, and they fail the same way: they capture a moment, while the risk lives in the ongoing relationship.

Where this comes unstuck

Treating prequalification as the control. A folder of certificates proves somebody was compliant on the day they were onboarded, and nothing about the job they did last Tuesday.

Contract clauses instead of coordination. An indemnity protects a balance sheet. It does not discharge a WHS duty and it has never stopped an incident.

No project plan. On a certification build this is the one that quietly costs the most. Businesses decide to implement ISO 45001, start writing documents, and never produce a plan with dates, owners and dependencies. It matters because the plan is shared with the certification body so it can schedule Stage 1 and Stage 2. Without it, audit dates suit the certifier’s diary rather than your readiness, and a business that would have been ready in five months finds Stage 2 booked for a date it cannot meet.

Contractor management: frequently asked questions

Can we transfer safety responsibility to a contractor in the contract?

No. WHS duties cannot be contracted away or transferred. A contract can usefully allocate who does what, and it should, but it does not move the duty. Both parties still have to discharge theirs so far as is reasonably practicable.

We are a small service business. Does this really apply to us?

Yes. The duty attaches to the work, not to the size of the business. The $230,000 conviction described above related to one technician’s service visit on one morning.

What if the customer tells us to put a machine back into service?

An instruction from a customer does not discharge your duty. What matters is what you did with what you knew: whether you identified the problem, recorded it, communicated it in writing, and what your own process required you to do next.

Does ISO 45001 certification protect us?

Certification is not a legal defence and nobody should sell it as one. What a certified system gives you is the thing these matters turn on: evidence that you identified the risk, put a control in place, and can show the control operating over time.

How long does ISO 45001 take, and what does it cost?

For most small to medium Australian businesses, three to six months and a first-year investment of roughly $7,000 to $25,000. Built alongside another standard as an integrated management system, each standard runs at about 50 to 75 per cent of standalone cost.

Where Streamline fits

Streamline is run by a practising ISO Lead Auditor, so you get the view from the other side of the audit table. We have built management systems for service and mechanical businesses, where the contractor interface is the whole risk profile rather than one section of it.

We run independent gap analysis audits that tell you where your contractor arrangements, competence records and handback documentation stand against ISO 45001. We provide the independent internal audit your system needs under clause 9.2, we build ISO 45001 systems end to end, and ISO mentoring guides your own people if you would rather build in-house.

Start with one question. The last time one of your technicians found something unsafe on a customer’s machine, what did they do, and where is it written down? If that has no answer, get in touch.

Sources

• WorkSafe Victoria, “Two companies fined $630,000 after worker’s death”, media release, 24 August 2026.
• Occupational Health and Safety Act 2004 (Vic), duties to persons other than employees.
• Model Work Health and Safety Act, primary duty of care and the principle that duties are not transferable.
• ISO 45001, clauses 6.1.2, 7.2, 8.1.4.1, 8.1.4.2, 8.1.4.3 and 9.2.
• Safe Work Australia, model Code of Practice: Elevating work platforms, December 2025.

Facts about the North Blackburn prosecution are taken from WorkSafe Victoria’s media release of 24 August 2026 and are current as at that date. This article is general information from an auditing and management system perspective and is not legal advice.