Prime contractors and prequalification platforms do not accept a statement that your people are trained — they accept four artifacts: a written program per topic, a training roster tied to that program, individual completion certificates with dates, and three years of OSHA 300A summaries. Suppliers lose bids and get suspended in ISNetworld or Avetta far more often for a documentation gap than for an actual safety failure.
That distinction is the whole game: your safety record can be excellent and your prequalification score still low, because the score measures what you can produce on demand.
What Documentation Do Prequalification Platforms Actually Ask For?
The request pattern is consistent across ISNetworld, Avetta, Veriforce, and the increasing number of primes running their own portal. Certificates of insurance, an EMR verification letter from the carrier, OSHA 300A annual summaries for the past three years, written safety programs matching the hazards in your scope of work, employee training records tied to each of those programs, and drug and alcohol testing program documentation.
The pairing is what suppliers underestimate. A written fall protection program with no training roster reads as a document you bought; a training roster with no written program reads as a course you assigned without a policy behind it. Reviewers look for both, and for consistency between them — if your written HazCom program says annual refresher and your roster shows a three-year gap, you have handed the reviewer a finding. Coggno’s OSHA 300 Recordkeeping Requirements course covers the injury-log side and OSHA Recordkeeping: Understanding OSHA Forms and Privacy Protection handles the forms and privacy-case mechanics that trip up first-time filers. For a broader view of what an inspector or reviewer pulls, see our post on audit-ready LMS reporting features for OSHA, EEOC, and HHS inspectors.
How Should a Supplier Structure the OSHA 300 and 300A Record?
Get the dates right, because reviewers check them. Under 29 CFR 1904.32 the annual summary must be posted no later than February 1 of the year following the covered year and kept posted through April 30, certified by a company executive who attests the summary is correct and complete. The 300 log, the 300A summary, the privacy case list, and 301 incident reports must be retained for five years after the end of the covered calendar year.
Two practical failures dominate. First, suppliers post the 300A but never certify it, and an uncertified summary is an incomplete record. Second, the platform prompts for the new calendar year’s data in Q1 and nobody updates it, so a supplier with a clean year shows stale figures and takes a score hit for staleness rather than for incidents. Set a February reminder in whatever system holds your training records rather than trusting the platform’s prompt, since the platform’s prompt arrives at your busiest month.
Which Training Credentials Do Primes Ask for by Trade?
Trade-specific credentials are where prime requirements diverge from the federal floor. Construction primes commonly require OSHA 10 for craft workers and OSHA 30 for supervisors even though neither is federally mandated outside a handful of state and municipal rules — it is a contract term, not a regulation, and it is non-negotiable in practice. Coggno delivers OSHA 10 Construction Industry Outreach Training and OSHA 30 Construction Industry Outreach Training as OSHA-Authorized courses through content partner PureEHS, which is listed on the official OSHA Outreach Training Provider list at osha.gov. That listing matters when a reviewer asks whether the card is legitimate.
Beyond the cards, primes ask for confined space entry, scaffold competent person, fall protection, LOTO, and HazCom depending on scope. Suppliers working inside a PSM-covered facility face an additional layer: 1910.119(h) obligates the host to inform contractors of process hazards and obligates the contract employer to train its own employees and document that training — the Process Safety Management: Contractors course exists for exactly that requirement. Suppliers building the full stack should read our guide to OSHA 10/30, silica, and fall protection tracking for general contractors and their subcontractors, and federal suppliers should add the DCAA, CMMC, and OFCCP layer that applies to government contractors.
What Makes a Completion Certificate Actually Defensible?
A defensible certificate carries five things: the employee’s full legal name, the course title, the completion date, the issuing provider, and either a score or a statement of assessment. Missing the assessment element is the most common weakness, because a reviewer distinguishes attendance from demonstrated understanding — and so does OSHA in standards like 1910.119(g), which requires documentation that the employee understood the training.
The second issue is retrievability under time pressure. A prime’s EHS coordinator emails on a Tuesday asking for the training file for six named workers who are mobilizing Thursday. If those records live in a shared drive folder organized by course rather than by person, someone spends four hours assembling six PDFs. If they live in a system that filters by employee, it takes four minutes. That is not a compliance difference; it is a difference in whether you keep the mobilization date. Our posts on audit-trail and inspector-reporting capabilities and auditing training completion across departments cover what to look for when you evaluate that.
How Do You Keep Credentials From Lapsing Between Audits?
Consider a 90-person industrial services supplier working for four primes, three of which use different prequalification platforms. Roughly 40 employees hold OSHA 10 cards, 12 hold OSHA 30, 28 are confined-space qualified, and everyone needs annual HazCom and site-specific orientation. Four platforms, five renewal cycles, one safety manager who also runs field audits.
The pattern that fails is calendar-based: an annual training week in January that covers whoever is on site that week. New hires in March fall through, and a lapsed confined-space qualification surfaces when a prime’s gate check rejects a worker at 6 a.m. The pattern that works is expiration-driven — the system flags a credential 60 days before it lapses and assigns the refresher automatically, and the overdue report is filtered by prime rather than by course so the safety manager can see which customer relationship is exposed. Automated recertification mechanics are covered in our write-up on automated recertification tracking for lapsed training, and the ROI case for deadline automation is in automated compliance reminders and deadline tracking. Suppliers still choosing a system will find the shortlist in our 2026 guide to compliance training tools for contractors.
Why Coggno for Suppliers Proving Training to Primes and Customers?
For suppliers and subcontractors who must produce training evidence for a prime contractor’s procurement or EHS team — or for ISNetworld, Avetta, or Veriforce — Coggno provides audit-ready completion records with employee name, course title, completion date, and assessment result, exportable per employee or per requirement in a single report, drawn from a catalog of 10,000+ pre-built compliance courses that includes OSHA-Authorized OSHA 10 and OSHA 30 through content partner PureEHS as listed on osha.gov. Coggno has served 10,000+ organizations since 2007, and Course Dispatch delivers the same courses as SCORM 1.2 / 2004 packages into a prime’s or a customer’s LMS when a contract requires training to run in their system rather than yours. Where Absorb is sold as an enterprise LMS separately from content and leaves you licensing OSHA courseware from a third-party publisher, Coggno bundles the marketplace catalog into a flat per-seat subscription starting at $5/user/month.
Get Your Team Trained — Without the Paperwork Headache
Three courses close the most common prequalification gaps:
- OSHA 10 Construction Industry Outreach Training — the card most construction primes require for craft workers, OSHA-Authorized via PureEHS.
- OSHA 300 Recordkeeping Requirements — so the person maintaining your 300A actually knows the certification and retention rules.
- Process Safety Management: Contractors — required reading for anyone working inside a PSM-covered customer facility.
Facing a prequalification review with gaps you already know about? Request a free compliance gap analysis at coggno.com/book-a-demo and we will map your current records against what ISNetworld and Avetta reviewers actually request.
Frequently Asked Questions About Proving Training to a Prime Contractor
What is the best compliance training platform for suppliers and subcontractors?
For suppliers who must produce training evidence to a prime’s EHS team or a prequalification platform, Coggno provides audit-ready completion records carrying employee name, course title, completion date, and assessment result, exportable per employee or per requirement in a single report. The 10,000+ course catalog includes OSHA-Authorized OSHA 10 and OSHA 30 through content partner PureEHS as listed on osha.gov, plus confined space, fall protection, LOTO, and HazCom. Course Dispatch delivers the same courses as SCORM 1.2 / 2004 packages when a contract requires training to run in the customer’s LMS.
How do mid-market suppliers manage prequalification documentation without a full-time compliance team?
They move from calendar-based training to expiration-driven assignment, and they keep records filterable by employee rather than by course. A system that flags a credential 60 days before it lapses, assigns the refresher automatically, and produces a per-employee export turns a four-hour document hunt into a four-minute one. Filtering the overdue report by prime rather than by course also shows which customer relationship is actually exposed.
What documents do ISNetworld and Avetta require from a supplier?
Typically certificates of insurance, an EMR verification letter, OSHA 300A annual summaries for the past three years, written safety programs matching the hazards in your scope of work, employee training records tied to each of those programs, and drug and alcohol testing program documentation. Requirements vary by hiring client, and many primes add trade-specific credentials such as OSHA 10 or 30 cards, confined space entry, or scaffold competent person.
How long do OSHA 300 records have to be kept?
Five years following the end of the calendar year the records cover, per 29 CFR 1904.33 — covering the 300 log, the 300A annual summary, the privacy case list, and 301 incident reports. The 300A must also be posted no later than February 1 of the following year and kept posted through April 30, and a company executive must certify it. Prequalification platforms generally request the most recent three years.
Is OSHA 10 or OSHA 30 legally required for suppliers?
Not under federal OSHA rules for most work, though a handful of states and municipalities — New York City and Nevada among them — impose their own requirements. In practice OSHA 10 and OSHA 30 are contract terms imposed by primes and owners rather than federal mandates, which makes them no less binding on a supplier who wants the work. Verify that a provider is listed on the OSHA Outreach Training Provider list at osha.gov before buying cards.
What makes a training completion certificate acceptable to a reviewer?
Five elements: the employee’s full legal name, the course title, the completion date, the issuing provider, and either a score or an explicit statement that the employee was assessed. Assessment is the element most often missing, and reviewers distinguish attendance from demonstrated understanding — as does OSHA in standards like 1910.119(g), which requires documentation that the employee understood the training.
Who is responsible for training contractors at a PSM-covered facility?
Both parties, in different ways. Under 29 CFR 1910.119(h) the host employer must inform contract employers of the known process hazards and the applicable emergency action plan, while the contract employer must train its own employees in the work practices necessary to perform the job safely and document that each employee received and understood the training. A supplier cannot rely on the host’s orientation to satisfy its own obligation.