What ISN and Avetta reviewers actually check, and where submissions stall

Contractor management platforms such as ISNetworld (ISN), Avetta, Veriforce and Highwire let a large client trust a supplier it has never met. The reviewer on the other side is not trying to fail you. They are working through a checklist built from the regulations and the client's own rules, and anything they cannot tick goes back to you as a deficiency.

Most of the delay is in that back-and-forth, not in the first submission.

This guide looks at prequalification from the reviewer's side: what they check, where submissions stall, how to answer a deficiency so it closes first time, and how grading turns all of that into the status your client sees. It's written mainly for North American work, where these platforms are most common, although multinational clients use them elsewhere too. If your problem is the sheer volume of renewals, read the prequalification treadmill alongside this; it covers the evidence library, answer bank and renewal calendar.

How the review works

The details differ by platform, but the shape is the same everywhere:

You complete the platform's baseline questionnaire. On ISNetworld this is the Management System Questionnaire (MSQ); on Avetta it's the prequalification form (PQF). It covers company details, safety management, policies and statistics.
You upload evidence: written safety programs, insurance certificates, injury and illness logs, your EMR letter, training records and anything the client specifically asks for.
Reviewers check the evidence against the answers, and against the regulation or client requirement that applies.
Each hiring client applies its own requirements and grading on top of the platform's baseline. That's why you can be in good standing with one client and flagged with another on the same platform.
Gaps come back as deficiencies, you respond, and the cycle repeats until everything required is accepted.

Two points follow. The reviewer only sees what you uploaded, so each document has to stand on its own. And consistency is checked as hard as content. A good program with numbers that don't match your logs will still stall.

What reviewers check, section by section

Written safety programs

On ISNetworld, written programs go through RAVS (Review and Verification Services). Reviewers check your programs against the regulatory requirements that apply to the work you've said you do, plus any extra requirements set by your clients. Other platforms run similar document reviews under their own names.

The key idea: a program is checked for required elements, not overall quality. For a hazard communication program, a reviewer looks for each element the standard requires: a list of hazardous chemicals, how labels and safety data sheets are handled, employee training, how non-routine tasks are covered, and how information is shared with other employers on a multi-employer site. A polished program missing one of those fails; a plain one covering them all passes.

Which programs you need depends on the scope you declare. Common ones in US work, with the OSHA standard they're reviewed against, include:

Program	Typical trigger	OSHA reference
Hazard communication	Any hazardous chemicals on site, which is almost everyone	29 CFR 1910.1200
Lockout/tagout (control of hazardous energy)	Servicing or maintaining machines and equipment	29 CFR 1910.147
Respiratory protection	Workers required to wear respirators	29 CFR 1910.134
Permit-required confined spaces	Entry into confined spaces	29 CFR 1910.146, or 1926 Subpart AA in construction
Respirable crystalline silica exposure control plan	Cutting, drilling or grinding concrete, masonry or stone in construction	29 CFR 1926.1153
Bloodborne pathogens exposure control plan	Workers with occupational exposure, such as designated first aiders	29 CFR 1910.1030

That's not a complete list, and clients often add their own, such as drug and alcohol or short-service employee programs. States with their own OSHA-approved plan add requirements too; California's Injury and Illness Prevention Program is the best-known example. In Canada, programs are reviewed against provincial legislation instead.

What reviewers flag most often in written programs:

The wrong standard. A program written for general industry when your work is construction, or the other way round.
A template that was never finished. Another company's name, blank fields, or "[insert responsible person]" still in the text.
No named responsibilities. "Management will ensure..." with no role or person named.
Missing frequencies. Required training, inspections or reviews without saying how often. Lockout/tagout, for instance, requires a periodic inspection of energy control procedures at least annually, and respirator users need fit testing at least annually. If your program doesn't say so, it fails.
Activities you've declared but not covered. If your questionnaire says you do hot work or work at height and there's no program or section for it, that's a deficiency.
Programs for work you don't do. Declaring every activity "to be safe" means you need a compliant program for each.

The fix is to declare your scope accurately and write to it. Add a short, specific section for each high-risk activity you actually perform, and remove the ones you don't.

Insurance certificates

In the US, insurance is usually evidenced on a certificate of liability insurance, most often the ACORD 25 form, issued by your agent or broker. Reviewers compare it against each client's requirements, which can differ a lot. They typically check:

Named insured. It must match the legal entity on your account exactly. A trading name, a parent company or a missing "LLC" can stop the review.
Policy dates. Current, and not about to expire. An expired certificate is a frequent reason an account drops out of good standing.
Coverage types and limits. General liability (per occurrence and aggregate), auto, workers' compensation, employer's liability, umbrella or excess, and sometimes pollution or professional liability. Limits are checked against each client's minimums.
Workers' compensation by state. Coverage needs to apply in the states where you'll work. In the monopolistic states (North Dakota, Ohio, Washington and Wyoming), workers' compensation comes from a state fund, so employer's liability is usually evidenced separately through stop-gap coverage.
Additional insured, waiver of subrogation, primary and non-contributory. Many clients require some or all of these. Ticking a box on the certificate is often not enough. Reviewers may want the actual endorsement pages from the policy.
The certificate holder. Being listed as certificate holder is not the same as being an additional insured, and reviewers know the difference.

Where insurance stalls: a certificate issued for one client uploaded for another, limits that meet the baseline but not one client's higher minimum, and a renewal that leaves an expired certificate on the account while you wait for the broker.

The practical fix is to send your broker the client's insurance requirements in writing and ask for a certificate and endorsements that meet them. Then put the policy renewal date in your calendar with enough lead time to upload the new certificate before the old one expires.

Injury and illness statistics

This is where small mismatches cause the most delay. Most US employers covered by OSHA's recordkeeping rule keep three forms:

OSHA 300: the log of work-related injuries and illnesses.
OSHA 300A: the annual summary, which also records the average number of employees and total hours worked.
OSHA 301: the incident report for each recordable case.

Platforms usually ask you to enter several years of hours and case counts and upload the matching 300A summaries or logs. Reviewers then check that the numbers you typed match the documents you uploaded.

Rates such as TRIR and DART are calculated as cases × 200,000 ÷ hours worked. Some platforms calculate them for you from the figures you enter; others ask you to enter them. Either way, if your hours or case counts differ from the 300A, the rates won't reconcile and the review stops.

Common reasons the statistics don't match:

Establishment versus company totals. The 300A is kept per establishment. If the platform wants company-wide figures and you have several establishments, you need to add them up, and say so.
Hours from different sources. Payroll, estimates and the 300A often differ slightly. Pick one source and use it everywhere.
Reclassified cases. If a case changed category after you filed, update the log and the platform together.
Year confusion. OSHA logs run by calendar year, and it's easy to put a summary in the wrong year's slot.
Exempt employers. Some small employers and some low-hazard industries are partially exempt from OSHA recordkeeping, but construction is not on the low-hazard list. If you are exempt, clients may still want figures. Check what the client requires rather than leaving the section blank.

Keep one statistics sheet that every submission copies from, as described in the treadmill post. That alone removes most statistics deficiencies.

EMR letters

Your experience modification rate (EMR) compares your workers' compensation claims experience with what's expected for businesses of your size and type. 1.0 is the baseline; below 1.0 is better than expected and above 1.0 is worse. Many clients set a maximum EMR as part of their grading. It's commonly around 1.0, although some are stricter and some look at a trend over several years.

Reviewers usually want the rating letter or worksheet from the rating bureau, which is NCCI in most states, or the independent bureau in states that run their own. Check what each client wants. Common problems:

A letter from the wrong year, or one whose effective date doesn't match the year you entered it against.
An insurance agent's letter where the client wants the bureau's worksheet, or the other way round.
No EMR at all. Smaller firms often aren't eligible for experience rating. That's normal, but you need to say so with evidence, usually a letter from your agent or the bureau confirming you're not rated, rather than leaving a gap or entering 1.0.
The wrong entity. If you have more than one entity, make sure the letter covers the one named on the account.

Training and competency records

"All operatives are trained" is not an answer. Reviewers want names, courses, dates and, where relevant, expiry dates. Some clients want evidence for every worker who will go on their site; others sample. Expect to show:

Training required by your own programs (if your fall protection program says workers are trained annually, the records should show it).
Role-specific qualifications, such as competent person designations, forklift operator evaluations, first aid and CPR, or operator qualification records in pipeline work, where Veriforce is common.
Client-specific training or orientation.

The most common stall is a training matrix that doesn't match the programs: the program says annual refresher training and the matrix shows dates two years old.

Client-specific requirements

On top of the baseline, each hiring client can add its own questionnaires, documents and thresholds. This is where people get caught out, because a submission that's fully accepted for one client can still be deficient for another.

Typical additions include site orientation, stricter insurance limits, drug and alcohol testing details, environmental or quality questionnaires, and lower EMR or incident rate thresholds. Read each client's requirements before you start, not after the deficiencies arrive. If you can't find them in your account, ask your client contact.

How grading works

Platforms turn the review into a status each client sees. On ISNetworld, each hiring client configures its own grading, so the grade a client sees reflects its requirements, not a universal score. Avetta shows a per-client compliance status, commonly as coloured flags. Highwire and Veriforce have their own scoring and status models.

What matters in practice:

Your status is per client. Check it for every client, not just the first one you see.
Some items weigh more than others. A client can make one item critical, such as current insurance or an EMR threshold, so that a single gap changes your status.
Statistics can count against you even when every document is accepted. If your incident rates or EMR are above a client's threshold, the grade reflects that. Clients sometimes accept an explanation or a corrective action plan, but that's their decision. Ask your client contact rather than assuming.
Status can drop between renewals. An expiring certificate or a new client requirement can change your standing mid-year without you touching the account.

Responding to deficiencies

A good response closes the deficiency in one round. A poor one starts another lap of the queue.

A response routine that works

Read the exact wording of the deficiency. Reviewers usually cite the specific requirement that wasn't met. Identify precisely what's missing before you change anything.
Fix the source document, not just the upload. If your lockout/tagout program lacks the annual periodic inspection, update the master program in your library, get it re-signed, and upload that. Otherwise the same deficiency comes back next year or with the next client.
Point the reviewer to the answer. Where the platform allows comments, say exactly where the requirement is met: "Annual periodic inspection is now covered in section 6.3, page 9." Reviewers handle a lot of documents. Make it easy.
Resubmit everything related at once. If a deficiency in one program reveals the same gap in others, fix them all in the same round.
If you think the reviewer is wrong, show why, politely. Quote the section and page. A "wrong" deficiency is usually one the reviewer couldn't find. If you're unsure what's being asked, use the platform's support channel; a short question costs less than a guessed resubmission.
Log it. Keep a simple list of every deficiency, what caused it and what you changed. Patterns show up quickly.

A worked example

An illustrative deficiency and two responses:

Deficiency: "Respiratory protection program does not address annual fit testing."

Weak response: upload the same program again with the comment "Fit testing is done."

Strong response: add a fit testing section to the master program covering frequency (before first use, at least annually and when a different respirator is used), method and record keeping, have the program re-signed and dated, upload it, and comment: "Fit testing requirements added in section 7, page 6. Revised program signed 14 October." Then check your training matrix shows current fit test dates, because that's the likely next question.

A pre-submission checklist

Declared scope of work matches what you actually do, and every high-risk activity has a program or section.
Every program names your company correctly, has no template placeholders, and is signed and dated within the last year.
Programs reference the right standards (construction or general industry, federal or state plan, or provincial).
Training, inspection and review frequencies are stated in each program.
Training records support what the programs say.
Insurance certificate names the exact legal entity on the account, is current, and meets each client's limits.
Endorsements (additional insured, waiver of subrogation, primary and non-contributory) are attached where clients need them.
Hours and case counts match the uploaded OSHA 300A summaries, year by year.
EMR letter is the right year and the right document type, or there's a letter explaining why you're not rated.
Each client's specific requirements have been read and addressed.

Two habits cause more stalls than anything on that list: uploading a generic safety manual unchanged, and answering the questionnaire from memory. Every answer should match a document. If it doesn't, one of them is wrong.

A deficiency is a question the reviewer couldn't answer from what you sent. Answer it before they ask.

Where software helps

Much of the work above is checking that documents say what your answers say. Tools handle that well: finding the current version of a program, checking it against a list of required elements, flagging hours or case counts that differ between a questionnaire and a log, and warning you before a certificate expires. Deciding what your programs commit you to, and signing them, stays with a person. If expiries are the main thing catching you out, see how to build an expiry register that doesn't depend on memory.

Start here

Pull up the deficiency history for your last submission on each platform and sort it into four piles: programs, insurance, statistics and client-specific. The biggest pile is where to start. If it's written programs, the fix is the same each time: declare your scope accurately, write a short specific section for each high-risk activity, check each program against the required elements, and get it signed. Do that once in your master files, and every platform and client benefits on the next renewal.