If a client has asked you to register with Cm3, Avetta, Pegasus or a similar system and you are not sure what you are supposed to produce, this is the list. Seventeen items almost everyone needs, the hazards that quietly add more, and the ones that expire while you are not looking.
Get the PDF ↓ 7 pages · A4 · print it and tick it off
The full checklist is on this page — free, nothing to enter. The printable PDF takes an email address.
There is no fixed list. Prequalification systems do not set the requirements — the hiring client does, and the system enforces them. Avetta's requirements are configured by the company that invited you. Cm3's come out of the business risk profile you build at registration, which is driven by the activities you tick.
So two contractors on the same portal, invited by the same client, can be asked for very different things. Any checklist claiming “Avetta requires these fourteen documents” is guessing.
What you can rely on is the overlap. Below is the common core that turns up almost every time, then the triggers that add to it.
Seventeen items. Six are things you hold or buy. Eleven are documents somebody has to write.
| Item | Where it comes from | Renews | Type |
|---|---|---|---|
| Insurance & registration | |||
| Public liability insurance | Your broker or insurer | Annually | Hold |
| Workers compensation insurance | State scheme or insurer | Annually | Hold |
| Motor vehicle insurance | Your insurer | Annually | Hold |
| Professional indemnity (where your scope needs it) | Your insurer | Annually | Hold |
| ABN and business registration | ABR / ASIC | Business name renewal | Hold |
| Trade, contractor and operator licences | State regulator or licensing body | Varies by licence | Hold |
| The management system | |||
| WHS policy | Written for your business, signed at the top | Review date | Write |
| WHS procedures or management plan | Written for your business | Review date | Write |
| Risk assessments / SWMS for your scope | Written per activity, per site | On change of work or site | Write |
| Risk register | Written and maintained | Ongoing | Write |
| Induction content and induction records | Written, then evidenced per worker | Per worker, per site | Write |
| WHS consultation and communication evidence | Toolbox records, meeting minutes | Ongoing | Write |
| Employee WHS monitoring | Your supervision and inspection process | Ongoing | Write |
| Records and registers | |||
| Training and competency register | Maintained by you, evidenced by tickets | Per ticket expiry | Write |
| First aid kit inspection records | Your inspection routine | Scheduled | Write |
| Electrical test and tag register | Licensed tester, recorded by you | By interval for the environment | Write |
| Incident and injury history | Your records | Ongoing | Write |
Why the split matters. The six you hold are a phone call to a broker or a regulator. The eleven you write are the ones that stall a registration — because a policy with your name pasted into it is not the same as a procedure that describes how your business actually works, and the assessor reading it does this all day.
This is the part that catches people. When you register, you select the activities your business performs. Every one you tick can pull in its own risk review, and each review wants evidence of how you control that hazard — procedures, not assurances. Cm3 alone publishes the hazard reviews below.
If you are appointed principal contractor, you pick up a separate review covering your risk register, site plans, plant, communication, consultation, SWMS review and compliance, and training. If you engage subcontractors, you pick up a subcontractor review — you now have to show how you assess them. And if you move freight, chain of responsibility adds fatigue, loading, speed, mass and dimension, and maintenance management.
The practical effect. A contractor who ticks six activities honestly can find themselves owing twenty-odd documents rather than the handful they expected. Ticking fewer to keep the list short is not a fix — it narrows what you are approved to do, and the mismatch surfaces the first time you are asked to do work you did not declare.
Four you are most likely to meet in Australia — though two of them are now the same company. They work differently enough that being approved on one tells you little about the next.
You build a business risk profile from the activities you perform, and Cm3's own assessors review the documents behind it. Requirements come from that profile plus whatever your client has set. Contractors on the platform get access to a template library through the help centre.
Where people get stuck: a real person reads the documents. Generic wording that does not match the declared activities comes back as an action rather than a pass.
Prequalification forms, insurance verification against the hiring client's specific limits and endorsements, and a document audit of your safety programmes. Upload once, share across multiple clients — but each client sets its own thresholds.
Where people get stuck: insurance. Limits and endorsement wording are set by the client, and a certificate that satisfies one can fail another.
Weighted toward the workforce rather than the business — verifying competencies and training, controlling site access, and managing inductions. Still common across Australian mining, and plenty of sites still call it Pegasus. The Pegasus brand has been folded into Avetta — pegasus.net.au now redirects to Avetta's Australian site.
Where people get stuck: individual worker evidence. Business documents can be in order while a crew still cannot get through the gate. Being prequalified on the company side does not carry across — same owner, separate evidence trail.
Contractor management, online inductions and credential tracking, configured to each client's requirements. Smaller footprint, same underlying pattern.
Where people get stuck: assuming approval elsewhere carries over. It rarely does — you are usually starting the evidence trail again.
You may also meet ISNetworld, more common in oil, gas and North American supply chains than in Australian mining and construction.
Most contractors get approved once and then quietly fall out of compliance, because the things above do not all renew on the same clock. A lapsed item can lock you out of invitations without anyone telling you first.
| What | Typical cycle | What happens when it lapses |
|---|---|---|
| Insurance certificates | Annually | Status drops immediately — usually the first thing to go |
| Trade and operator licences | Varies by licence and state | Work you are approved for narrows |
| Worker tickets and competencies | Per ticket, commonly 2–5 years | Individuals lose site access |
| Health monitoring and medicals | Per hazard and role | Blocks specific work, not the whole registration |
| Electrical test and tag | By interval for the environment | Register goes stale, flagged at audit |
| First aid and equipment inspections | Scheduled | Gap in the evidence trail |
| The documents themselves | Their own review dates | The one nobody diarises — and the one an assessor checks first |
A document with no review date is a document that has already expired in the eyes of most assessors. A review schedule, a revision history and a named approver are what separate a live management system from a folder of files — and they cost nothing to add if the documents were built with them in the first place.
Templates are a reasonable place to start, and several portals hand them out. What a template cannot do is be true about your business. It does not know your plant, your crew, your site, or the hazards you actually declared — and those are the things an assessor reads for.
The gap that stalls a registration is almost never a missing file. It is a document that exists but does not describe how the work is really done, carries no document control, and cannot be traced to the activities the business signed up for.
If you would rather not close that gap yourself, that is what we do — documents written around your operation, numbered and registered, and revised free for 90 days until they pass the review they were built for. If you would rather do it yourself, the list above is genuinely everything we would tell you to start with.
Twelve questions, an instant traffic-light score, and a gap list naming what a reviewer would flag — document control, site specificity, and whether anything is actually maintained. No email needed to see your result. Or send us one document and a person will tell you in writing what a reviewer would flag — free, usually within two business days.
Run the free check →Seven pages, A4, built to be printed and ticked off against a live registration — the seventeen-item core with Have it and Current columns, the 34 hazard triggers, and a renewal calendar you write your own dates into.
Compiled from the platforms' own published material, current at 4 September 2026. Requirements are set by hiring clients and change without notice — treat this as an orientation, not a compliance determination, and confirm against the standard your client names.
Cm3 — contractor prequalification and risk reviews · Cm3 — getting prequalified · Avetta — company prequalification · Avetta — worker management (formerly Pegasus) · LinkSafe