In this article we question the wisdom of customers seeking to outsource its duties under health and safety law. Companies cannot contract out of their duties and applicable HSE guidance stresses the importance of parties working together to manage risk. Indemnities transferring risk may prove to be unenforceable where the outsourcer itself has been convicted of an offence.

Outsourcing is generally understood as the engagement of a service provider to manage and perform services or functions which would normally be performed by the customer in-house.

A contract is required to set-out the terms of such engagement and to capture the agreed commercial terms including any transfer of risk from the customer to the service provider. In legal terms, for such arrangement to work, it is fundamental for the customer that the allocation of risk, and corresponding indemnities set out in the contract, are enforceable.

For most risks associated with facilities management (FM) services, this is not an issue. The service provider invariably provides indemnities for major risks associated with performance of the services, including death and personal injury, damage to property, infringement of third party intellectual property rights, specific employee liabilities arising out of TUPE and pensions, and fines and penalties arising out of failure to perform the services in accordance with applicable law.

The position becomes less clear however, where the customer and service provider have shared duties, including in particular, under health & safety legislation, where failure to comply can result in criminal liability. The problem becomes particularly acute where the customer seeks to outsource all or part of its health and safety functions to the service provider at the same time, as part of an FM building maintenance service.

Serious safety breaches now routinely result in six (or seven) figure sum fines. The Health and Safety Offences Act 2008 introduced imprisonment for individuals convicted of the majority of breaches of health and safety law. Ten years ago, prosecutions against individuals for safety breaches were rare. When investigating safety breaches, inspectors now routinely consider the role of individuals in workplace accidents.

In any FM outsourcing project, the customer should accept it is not possible, nor advisable, to seek to transfer all health & safety risks to the service provider. In particular, the customer cannot assume that a one-sided contract, with no duty to co-operate or to provide information, which seeks to transfer all risk to the service provider, through widely worded obligations and indemnities, will allow the customer to escape from its duties under health and safety law.

In recent projects we have seen customers imposing unqualified obligations on the service provider to “ensure” the building “remains safe” and in compliance with law, coupled with an indemnity for any claims arising including any claims due to failure to comply with law. These clauses ignore the customer’s statutory obligations and the fact that the service provider has no authority nor budget to carry out lifecycle works.

Furthermore, such clauses conflict with health & safety law which creates joint responsibility, where two or more employers are working on the same site. Indeed by engaging third parties to work on site, the customer assumes responsibility for its employees and others (including the third party service provider and its staff) affected by activities on site, as under the Health & Safety at Work Act 1974 (the Act), the customer has a duty to “conduct his undertaking in such a way as to ensure, so far as is reasonably practicable, that persons not in his employment who may be affected thereby are not thereby exposed to risks to their health or safety”.

Note the key word “undertaking” which was held (in R v Associated Octel Co Limited [1995] I.C.R. 281) to include all operations of the customer, regardless of who performed such obligations. In this case, the defendant Octel tried to avoid a criminal conviction on the basis that the accident was due to the failure of its third party contractor, Resin Glass Products Limited. Octel also argued it had taken all reasonably practical steps to avoid the accident through its permit to work system.

In law a person is not generally liable for the acts of a third party contractor it has engaged to perform work or services. Exceptions to this rule, were established via case law which included a series of cases (used as a model for Health & Safety law) which involved “extrahazardous” operations. In such cases the customer was held liable for the acts of its contractor for a range of reasons including: where the customer failed to co-ordinate the activities of subcontractors; or, where it exercised joint control over the contractor’s operations, in the sense of being able to tell the contractor’s men how they are to do the work and what safety precautions they were to take.

Where an accident occurs in any customer’s “undertaking” there will be a potential case to answer, under the Act, subject to the defence that all steps, reasonably practicable, have been taken to prevent the accident. The question of what is reasonably practicable is a question of fact and degree, in each case, having regard to the operations carried out by service providers, the nature and gravity of the risk, and the competence and experience of the workmen.

Despite any contract terms to the contrary, inevitably there will be some steps that only the customer can take to manage the risks. The Octel case and other case law, makes it clear that the customer’s duties under health & safety law do not end when the contract is signed. Taking all reasonably practical steps will include on-going obligations (some of which are set out in the Management of Health & Safety at Work Regulations 1999) such as, the duty to co-operate with service providers on-site, to co-ordinate measures taken by those on site to comply with health & safety law and to inform those on site of any risks to health and safety arising out of or in connection with the conduct of the customer’s “undertaking”. The customer also has to ensure that every person working in his undertaking is provided with appropriate instructions and comprehensible information regarding any risks to that person’s health and safety, which may arise out of the conduct of the customer’s undertaking.

FM services by their nature are complex. Service provision is not like works on a construction site where the contractor controls the site and owns the works and equipment. The FM service provider and customer (as well as any other contractors on site) need to co-operate, to ensure the smooth-running of services and the customer’s own operations on site. The parties’ respective staff are co-located on-site and will be interacting continuously on a daily basis. When and how work is performed will often involve joint decisions and compliance with customer policies. Rather than seek to artificially transfer risk to the service provider, the FM contract should be drafted to encourage communication and co-operation on all health and safety matters. Both parties need to be fully informed to be able to understand and manage risks and be certain that all reasonable steps are being taken jointly to prevent accidents.

Finally customers are misguided if they think they can avoid liability under the Act by outsourcing all obligations and then doing nothing and not getting involved. Such approach is likely to lead to conviction as, for any accident, almost certainly there will be some step the customer could reasonably have taken to prevent the risk occurring.

Although the point appears as yet untested in the courts, based on case law and the longestablished legal doctrine known as ex turpi causa, non oritur actio (from a dishonourable cause, an action does not arise) it seems that, in the event of an accident, the customer would have real difficulties in enforcing any contractual indemnity against the service provider, especially where the customer is itself convicted. The only likely exception would be where the accident was caused solely as a result of the service provider’s actions and the customer has taken all steps, reasonably practicable, to prevent the same. In this case, the customer (having been found not guilty) may be able to enforce the indemnity in respect of legal costs incurred in defending the claim. Such costs are often covered by corporate insurance so it is questionable whether such indemnity for legal costs is appropriate given the shared obligation to comply with applicable health and safety law.