An RFP that says a facility may audit “all vendor records at any time” sounds protective but often produces poor bids and worse disputes. Qualified vendors cannot tell what data must be collected, how long it must be retained, who may see employee information, or what a failed audit means for payment. The buyer gets a clause broad enough to argue about and too vague to guide daily operations.
Useful audit rights are specific about purpose, fields, access, timing, correction, confidentiality, and escalation. They should let the facility verify that the contracted cleaning service was staffed and performed while leaving the vendor responsible for employment, payroll, supervision, and legal compliance. Procurement controls work best when the evidence requirement is measurable before a contract is awarded.
StockPoint can help a vendor supply building-level punches, photo and PIN proof, client status, exception review, payroll preparation, and audit logs through separate views. It cannot make a vague RFP precise. The facility must decide which facts are needed to administer its contract and which belong only in the vendor’s employment file.
Write the audit right around the decision it supports
Start with the audit question. If the buyer needs to confirm attendance, request an assignment-level time record tied to a building and service window. If the buyer needs quality assurance, request inspection results against the agreed scope. If the buyer needs invoice verification, request the fields that reconcile the invoice to the contracted unit, rate, or approved time. Do not request “all records” when three defined reports answer the question.
A contract can require the vendor to maintain accurate records under applicable wage, tax, safety, and licensing laws and to provide a reasonable attestation of compliance. It can also require cooperation with an agency inquiry, a customer incident, or an insurance claim, subject to confidentiality and legal restrictions. That is different from giving the facility an unrestricted right to inspect every worker’s pay stub, home address, medical information, or unrelated customer records.
The DOL’s recordkeeping materials explain the employer’s duty to maintain hours and wage information, but they do not turn a customer into the employer. The RFP should ask the vendor to demonstrate that it has a recordkeeping process and to provide contract-relevant extracts, not to transfer its payroll department to the facility.
Specify attendance records without demanding a surveillance feed
Attendance language should identify the minimum fields: building or contract area, scheduled window, worker or crew identifier as appropriate, arrival and departure event, task or checkpoint status, correction indicator, and supervisor review. If GPS is used, say that location is an estimate with stated accuracy and may be supplemented by a PIN, QR marker, photo, or other site evidence.
Avoid requiring continuous location tracking if a building-level event answers the contract question. Continuous data increases privacy, retention, security, and employee-relations obligations. A facility may need to know that the crew reached the building and completed the agreed checkpoint, not where each person traveled between personal errands or other accounts.
StockPoint’s honest-accuracy approach is useful contract language because it does not promise precision the device cannot provide. The buyer can require a review of outliers rather than an automatic invoice rejection. A missed scan should trigger a correction workflow, not a presumption that no work occurred.
Make quality evidence measurable
Quality audit rights should refer to the scope and inspection method. A vendor may provide a task checklist, supervisor inspection, sample results, response-time record, corrective-action note, or agreed photo. The RFP should say who may inspect, when inspections occur, how a failed result is communicated, and how the vendor gets a reasonable opportunity to correct or explain an access problem.
ISSA quality-management concepts emphasize a defined specification, inspection, evaluation, and corrective action. A buyer that asks for a quality score without defining the inspection basis is likely to receive inconsistent reports. Put the method in an exhibit, identify any sampling approach, and state that the parties may revise it through written change control when the building or scope changes.
A photo should be required only where it proves a defined condition. The contract should prohibit images of restricted rooms or personal information where appropriate and state who owns the operational copy, who may use it, and when it is deleted. A quality audit right should not quietly become a right to retain every image a cleaner takes.
Require corrections, not a perfect-looking dataset
Corrective-action language should preserve the original event. The vendor should record the issue, date, area, cause if known, immediate action, responsible supervisor, completion status, and customer acknowledgment where required. The facility should be able to see that a failure was addressed without demanding that the vendor overwrite the first report.
Include a process for disputed findings. The vendor can respond with a blocked-access record, a changed scope, a safety concern, an emergency response, or evidence that the inspection did not match the agreed specification. The buyer may still decide that a service credit or corrective visit is warranted, but the record should show the decision and its basis.
Per-worker payroll locking helps a vendor avoid double payment when a corrected time event is approved, and audit logs preserve who changed the event and why. Those controls support reliable administration; they do not authorize a buyer to edit employee time or instruct a worker to work unpaid. The vendor should own time corrections and payroll communication.
Use attestations for payroll without taking over payroll
A payroll attestation can be a useful middle ground. The vendor can attest that it maintains required wage, hour, tax, insurance, and workers-compensation records and that employees assigned to the contract are paid through the vendor’s payroll process where the vendor is the employer. The facility can request a summary of coverage, a compliance certificate, or a redacted sample where justified, rather than collecting every individual record.
If a public contract or law requires a particular certified payroll report, say so and identify the governing authority. A private facility should not borrow public-project terminology without knowing what it means. The RFP should also state whether the vendor or the facility bears the cost of producing an unusual report, a large historical export, or an on-site audit.
StockPoint can calculate or prepare 941, NYS-45, and W-2 data, while the employer files; bank-feed reconciliation is on the roadmap, not shipped. The facility should not represent a software record as a filed return or ask the vendor to certify something the vendor has not reviewed. Scope honesty is part of audit design.
Keep audit rights separate from employment control
Joint-employer concerns arise when a buyer moves from contract oversight into direct control of the vendor’s workers. The National Labor Relations Board’s joint-employer materials and standards focus on the relationship and the authority exercised, while the DOL analyzes employment under its own wage-law framework. A contract should preserve the vendor’s authority to hire, fire, pay, schedule, train, supervise, discipline, and correct employees, subject to the facility’s legitimate site and result requirements.
The facility can require that a worker be licensed where the law requires, follow building security procedures, use safe access routes, and meet the contracted service specification. It should route performance complaints to the vendor’s manager rather than writing up a cleaner, changing the worker’s schedule, or directing the worker’s break. The vendor can then investigate and document the response.
The records should reflect that boundary. A client exception says “restroom inspection found supplies missing at 7:10 a.m.; vendor supervisor notified,” not “cleaner must return at 8:00 and skip the break.” Clear routing protects the buyer’s service interest and gives the vendor an auditable management process.
A worked RFP example that vendors can actually price
Consider a worked RFP example. A facility hires a vendor for three buildings with nightly cleaning and weekly floor care. The contract can require a building-level arrival and departure record, one agreed checkpoint per building, a weekly supervisor inspection against the scope, exception notes with corrective status, an invoice reconciliation report, and a quarterly payroll-and-insurance attestation. It can permit a targeted audit on reasonable notice and an incident audit when access or safety is at issue.
That language gives procurement something to evaluate and gives vendors a costable workflow. It does not require continuous GPS, every worker’s personal file, or a client-side time edit. If the buyer later needs a report for a wage agency or insurance claim, the parties can define the lawful fields and confidentiality process instead of relying on a blanket clause.
The amounts, cadence, and fields in this example are illustrative. Use the facility-manager proof-of-work guide and the vendor audit guide to adapt the package to the building, risk, and contract price.
Make data governance part of the clause
State the request method, response deadline, authorized users, security controls, export format, retention, and deletion process. Define whether the facility may retain a copy or may only view the record. Require the vendor to notify the facility of a data incident involving the contract evidence, while recognizing that the vendor may have separate employee and legal obligations.
Set a change-control path. When the facility adds a building, changes the inspection standard, or asks for new photos, the parties should document the effective date and any price or staffing impact. Otherwise, an “audit right” becomes an unpriced expansion of the service and a source of resentment.
Give workers a way to correct time or assignment facts through the employer. A bilingual workflow can help a cleaner understand a missed punch or disputed correction. The buyer should receive the service result and escalation outcome, not pressure the worker into accepting an inaccurate payroll record.
Turn audit rights into an operating standard
A strong audit exhibit names the exact records, the purpose of each record, the review cadence, the exception path, the privacy limit, and the party that owns the decision. It gives the buyer enough evidence to administer the contract and gives the vendor enough certainty to staff, price, and operate it. It also leaves the employer’s payroll and management duties with the employer.
StockPoint’s features can support that exhibit with verified punches, per-building proof, client status, bilingual workforce surfaces, payroll locking, and audit-logged corrections. The software does not decide whether a clause creates joint-employer risk or whether a facility’s inspection is legally sufficient. Have procurement, operations, privacy, and counsel review the language before release.
Sign up at getstockpoint.com to give your cleaning program a shared record of attendance, task proof, exceptions, supervisor review, and contract-ready reporting. You get evidence that can make an audit narrower and fairer, without buying a vague promise of total surveillance.