PHEW DESIGN LIMITED

Online Audit Tool

Cloud-based audit management system for building, designing, distributing and reporting on compliance audits. Fully customisable platform enables organisations to conduct Section 175, Section 11, and bespoke audits with automated action plan generation, comprehensive reporting, and real-time progress tracking. Secure, GDPR-compliant solution with robust encryption and UK data hosting.

Features

• Customisable audit templates
• Automated action plan generation
• Comprehensive reporting suite
• Question hiding functionality
• Automated invitations and reminders
• Secure cloud-based access
• Progress tracking dashboard
• Offline PDF capability
• Knowledge Base Academy

Benefits

• Reduce audit administration time
• Improve compliance oversight from centralised dashboard instantly
• Streamline action planning. Automatically generate and track improvement actions
• Enhance data-driven decision making
• Simplify multi-site management, consolidated reporting capabilities
• Accelerate audit completion rates. Automated reminders, progress tracking
• Standardise questions across organisations while maintaining flexibility
• Share audit results and action plans seamlessly between stakeholders
• Support regulatory compliance with configurable frameworks
• Maintain revision history, timestamped records for accountability and evidence

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at accounts@phew.org.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

962906055697585

Contact

Matthew Burgess
01234779050
accounts@phew.org.uk

About your service

• Service categories:

  Applications

  Content workflow and management

  • Capture
  • Document
  • EDiscovery and forensics

  Content services

  • Content Sharing and Collaboration Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Planned maintenance windows: Monthly scheduled maintenance may require brief system downtime, typically conducted out of hours with 2 weeks' advance notice where service interruption is unavoidable.; Browser requirements: Requires Internet Explorer 11+, Microsoft Edge, Chrome, or Firefox with internet connection.; Question modifications: Once audits begin completion, only Phew can make question changes to maintain data integrity.; Training limitations: Standard package includes online training for up to 4 administrator users; additional or onsite training available at extra cost.; No data anonymisation: System cannot anonymise production data in live environments as this would negate the audit's value and contextual analysis.
• System requirements:
  • Internet Explorer 11+, Microsoft Edge, Chrome, or Firefox browser required
  • Stable broadband or mobile internet connection for accessing cloud-based platform
  • Valid email addresses required for user accounts and system notifications
  • No third-party software purchases or licenses required for operation
  • Zero software downloads or installations needed on user devices
  • Compatible with Windows, Apple, Linux, tablets, and mobile devices
  • Responsive design adapts to various screen sizes and device types
  • Browser must have JavaScript enabled for full system functionality
  • Browser cookies must be enabled for session management and authentication
  • PDF viewer required for downloading and viewing exported audit reports

User support

• Email or online ticketing support: Yes
• Support response times: Phew provides a 4-hour SLA response time for all support tickets raised during business hours (9am-5pm, Monday to Friday). Support is accessed via email or telephone through the Phew helpdesk.; Outside business hours and weekends, support requests are logged and addressed on the next business day.; All support is unlimited for trained administrator users and included within the license fee. Monthly support reports detailing tickets raised can be provided upon request.; Emergency critical infrastructure issues trigger automatic notifications for immediate remedial action outside standard hours.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Unlimited support for all trained administrator users with 4-hour SLA response time during business hours (9am-5pm, Monday-Friday). Access via email and telephone helpdesk. Includes full access to Knowledge Base Academy with video tutorials, how-to guides, and troubleshooting documentation.; Dedicated Account Manager:; Every client receives a dedicated Account Manager throughout their relationship with Phew, providing ongoing support, guidance, and escalation management at no additional cost.; Implementation Support (Included):; Dedicated project team assigned during implementation phase, supporting platform configuration, comprehensive training on configured system, and assistance during testing phases.; Complimentary Resources:; Regular Virtual Clinics, Lunchtime Learning sessions, and Focus Groups included, covering new releases, best practices, and peer networking opportunities.; Additional Support Services (Extra Cost):; ; Onsite training (standard package includes online training for 4 users); Extended training for additional users beyond initial 4; Bespoke consultancy or configuration services; Note: Critical infrastructure issues receive automatic notifications for immediate action outside standard hours. Monthly reporting available detailing license usage and support ticket analysis.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Phew provides a structured 8-12 week implementation with a dedicated project team guiding clients through planning, configuration, user acceptance testing, launch, and closeout phases.; Initial Training (Included):; Online training for up to 4 administrator users delivered by dedicated trainer on the fully configured platform. Sessions are tailored to client requirements and learning styles, typically lasting 2-4 hours covering core syllabus. All sessions are recorded for future reference and refresher purposes.; Knowledge Base Academy:; Full access to online documentation including detailed how-to guides, video tutorials, troubleshooting resources, and best practice articles available 24/7.; Ongoing Learning Resources:; ; Regular complimentary Virtual Clinics covering system updates and advanced features; Lunchtime Learning sessions for continuous development; Focus Groups for peer networking and knowledge sharing; New release notifications displayed within the platform; ; Additional Training Options (Extra Cost):; ; Onsite training available upon request; Extended training for additional users beyond initial 4; Bespoke training sessions for specific requirements; ; Quality Assurance:; Each training session reviewed by senior management team for feedback and continuous improvement of training delivery.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At Contract End:; • Full data export provided in Excel and PDF formats; • All delegate records, training history, certificates, evaluation data, and course information included; • Data export includes marketing consent status for GDPR compliance; • Reports can be filtered and downloaded by organisation grouping, event type, and date range; Data Ownership: All client data remains the property of the client throughout and after the contract. We provide 30 days' notice before contract end to ensure smooth data extraction. After contract termination, data is securely deleted in accordance with GDPR requirements.
• End-of-contract process: Upon contract termination, we provide a complete data export in Excel and PDF formats containing all records. ; ; Data export includes marketing consent status for GDPR compliance (if available). All client data remains the property of the client throughout the contract. Following data export delivery, all client data is securely deleted from our systems within 30 days in accordance with GDPR requirements and our data retention policy, unless alternative arrangements are contractually agreed. This access is standard within the product, so no additional costs are incurred. If there is a requirement for the data being procured in another format, this would be costed based on the specification at prevailing rates.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The mobile experience maintains full functionality with the same features available across all devices. The interface automatically adjusts layout and navigation to suit smaller screens, ensuring usability on tablets and smartphones.; No native mobile app exists - the service is browser-based across all devices. Users access the same cloud platform whether on desktop, tablet, or mobile, with consistent data and functionality. Screen resolution and touch-friendly controls adapt responsively based on device type.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The Phew Audit System provides a web-based user interface accessible through standard web browsers (Internet Explorer 11+, Microsoft Edge, Chrome, Firefox). Users interact with the system through this responsive web interface to build audits, manage responses, view reports, and access all system functionality.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The platform is tested against WCAG 2.2 AA accessibility standards using automated accessibility testing via Silktide. This testing covers key areas such as keyboard accessibility, content structure, use of alternative text, and support for browser zoom and responsive layouts.; Accessibility statements are published within the system, and accessibility is treated as an ongoing process. Regular reviews are carried out, with issues identified through testing addressed as part of continuous improvement to enhance accessibility for all users.
• API: No
• Customisation available: Yes
• Description of customisation: What can be customised: Organisational branding including logos and colour schemes. Course structures, learning pathways, and training categories. User roles, permissions, notification templates, and communication workflows. Registration forms, custom fields, and certificate templates. How users can customise: Administrators customise through the administrative interface using intuitive configuration tools. Branding elements are uploaded via settings panels. Course structures and workflows are configured using built-in management tools without requiring technical expertise. Who can customise: System administrators with appropriate permissions perform most customisations independently. Complex configurations receive support from the Phew implementation team during onboarding.

Scaling

• Independence of resources: We ensure customer independence through multiple controls:; Data Isolation: Data is segmented through strict client ID numbers enforced at codebase level, with robust access controls ensuring complete separation between customer environments.; Performance Monitoring: 24/7 real-time monitoring of CPU and RAM usage identifies resource constraints before they impact service, allowing dynamic scaling.; Infrastructure Resilience: Virtual Private Servers with spare capacity enable immediate resource allocation, preventing any single customer's demand from affecting others.; Service Guarantee: 99.9% SLA, inline layer3/4 DDOS protection. Performance issues are managed as critical incidents under our 24/7 support process.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics types ; ; System reporting: Audit Status Report, Rating Overview, Consolidated Overview, Response Overview, Action Plan, Questions Report, Summary Report, Full Response Report, Full response report, Email tracking, Contract usage.; Reports are filterable by several metrics including date, organisation categories.; All are exportable to either PDF, CSV or both.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Data Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Users can export all audit reports and data in PDF or CSV formats directly from the reporting suite. Reports are filterable by key metrics (organisation type, date ranges, etc.) before export.; Complete audits can be downloaded as PDFs for offline viewing, available both during completion and after submission by respondents and administrators.; All reports include individual responses, question-level analysis, action plans, progress tracking data, and trend analysis. Exports maintain data integrity and formatting for external use.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Data within our infrastructure is protected through multiple security layers beyond TLS encryption:; Physical Security: UK data centres with Level 3 DDoS mitigation and 7 layers of physical security. Only authorized personnel can access restricted areas.; Logical Isolation: Data segmented through strict client ID enforcement at codebase level, ensuring complete separation between customer environments.; Network Monitoring: 24/7 real-time monitoring with automated threat detection. Security measures immediately restrict problematic IPs and suspicious activity.; Secure Backup Transport: Backups encrypted during transport to geographically separate data centres, isolated from production infrastructure.; All operations comply with ISO 27001 and NCSC Cloud Security Principles.

Availability and resilience

• Guaranteed availability: We maintain 99.9% service availability with comprehensive monitoring and proactive incident management.; Performance Track Record: ; Our hosting infrastructure consistently achieves 99-100% actual uptime. We conduct 24/7 real-time monitoring across all platforms, with automated alerts to proactively identify and address issues, minimising downtime and maintaining service continuity.; Incident Response: Any unscheduled downtime is managed as a critical incident with 24/7 response capability, both within and outside business hours. Our 4-hour support response SLA during business hours (9am-5pm weekdays) ensures rapid attention to all service issues.; Service Resilience: We maintain robust backup and recovery capabilities including daily 28-day rolling backups with 2-hour restoration capability. Virtual Private Servers with spare capacity enable immediate resource allocation. Backups are stored in geographically separate UK data centres with Level 3 DDoS mitigation and 7 layers of physical security.; Availability Commitments: Service availability targets are defined in individual contracts. While we do not offer automatic service credits, we take service disruptions seriously and work with clients to resolve issues promptly and maintain service continuity.; Monthly support reports detailing incidents and resolution times are available upon request.
• Approach to resilience: Our service is designed with multiple resilience layers to ensure continuous availability and rapid recovery:; Infrastructure Resilience: Hosted in Telehouse South, a secure UK data centre with dual-redundant power feeds, 2N UPS configuration, and N+1 generator resilience. Infrastructure is delivered on scalable virtualised platforms with spare capacity, enabling rapid failover and removal of single points of failure.; The site benefits from diverse dark-fibre connectivity and multi-layer physical security including 24/7 guarding, biometric access control, CCTV, and perimeter intrusion detection. Operations align with ISO/IEC 27001, ISO 22301, and PCI-DSS standards.; Backup and Recovery: 28-day full file system and database backups stored in geographically separate data centres, isolated from production infrastructure. Backups are tested and can be restored to any server within 2 hours. Our backup system enables service restoration through an alternative provider if needed.; Proactive Monitoring: 24/7 real-time monitoring tracks system health, backup completion, and scheduled job execution. Automated alerts enable immediate response. Critical incidents receive immediate attention 24/7.; Data Protection: Strict client ID enforcement ensures customer separation. Encrypted backups provide additional protection.; Compliance: ISO 27001 certified and compliant with NCSC Cloud Security Principles. Recovery procedures are regularly tested.
• Outage reporting: We operate a 24-hour internal monitoring dashboard that identifies any outages immediately. Outages are managed via our critical incident process.; External client lead contacts are notified of incidents and receive regular updates throughout resolution. Our communication plan accommodates the severity and scope of the incident. The platform includes an alert system for users, and we communicate via regular email reports and phone calls to clients.; For planned maintenance requiring service to be taken offline, formal prior notice is provided to users.; Monthly support reports detailing incidents and resolution times are available upon request.; Our incident management process is ISO 27001 compliant.

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces is provided only to identified system administrators. Employee access for maintenance and support is restricted to authorised personnel with justified business need. Support is provided exclusively to designated administrators who have completed platform training.; All access is password-protected using strong password policies (minimum 8 characters) with one-way password hashing. Role-based access controls provide granular permission management.; High-privilege user activities are logged and retained for 12 months, providing a complete audit trail. Server-level access logs are retained for 90 days. All logged activities are continuously monitored to detect and respond to security incidents.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Software Security Code of Practice; ; Yes; ; Security governance certified; ; Yes; ; Security governance standards; ; ISO/IEC 27001; Other; Other security governance standards; ; Cyber Essentials Plus GDPR compliance UK Data Protection Act 2018 ICO registration
• Information security policies and processes: Phew Design Limited maintains comprehensive information security policies aligned with Cyber Essentials Plus certification requirements. Our security framework includes access control policies, data protection procedures, secure development practices, incident response protocols, and business continuity planning. Security governance reports to the Managing Director with oversight of all security policies and compliance. The development team follows a secure development policy reviewed annually during penetration testing cycles. All software releases are assessed against security principles before deployment. Annual penetration testing is conducted by an external CREST accredited provider with all identified vulnerabilities tracked, resolved, and retested until certification is achieved. Testing covers authentication, access controls, SQL injection, cross-site scripting, and other OWASP vulnerabilities. Data protection policies ensure GDPR compliance with defined retention schedules, secure data handling procedures, and documented sanitisation processes. Staff receive security awareness training and follow documented procedures for handling sensitive information. Regular security reviews ensure policies remain current and effective. All security incidents are logged, investigated, and remediated promptly with root cause analysis. Backup procedures including offsite storage to ensure data resilience and recovery capabilities. Cyber Essentials Plus certification demonstrates our commitment to maintaining robust security controls and protecting client data.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All approved changes are tracked in our work tracking system throughout their lifetime. Changes are assessed for potential security impact during development lifecycle testing and QA process before deployment. Released logs are retained and online notification provided to administrators within the platform. Changes are designed to minimize service disruption. When downtime is required, formal prior notice is provided with scheduling during off-peak hours. Monthly maintenance and update alerts are assessed on risk and deployed according to priority. Our ISO 27001-certified processes ensure systematic tracking of system status, location, and configuration of service components throughout their operational lifetime.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Threat Assessment: We identify, prioritize, and mitigate vulnerabilities through annual CREST-accredited penetration testing and monthly automated penetration reporting. Our 24/7 platform monitoring alerts on potential threats including brute force attacks and denial of service attempts. Information Sources: Monthly maintenance and update alerts from infrastructure providers, CREST penetration test findings, and automated security monitoring provide continuous threat intelligence. Patch Deployment: Identified vulnerabilities are assessed on risk and patches deployed according to severity. Automatic infrastructure notifications enable immediate remedial action via our critical support process. Security measures immediately restrict problematic IPs when threats detected. All processes maintained under ISO 27001 certification.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Identifying Compromises: 24/7 monitoring reports potential compromises via dashboard and email alerts. Platform monitoring tracks traffic patterns and automatically identifies threats, including brute force attacks and denial of service. Audit logs retained for 90 days enable prompt incident analysis. Response Process: Incidents receive immediate action to maintain security. Security measures automatically restrict problematic IPs when threats detected. Communication plan activated internally and externally upon incident identification. Response Time: Automated response for detected threats occurs immediately. Manual incidents receive prompt investigation with timely updates until resolution. Action taken to resolve and prevent reoccurrence. ISO 27001 certified processes.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Pre-defined Processes: ISO 27001-compliant incident management documented in our Secure Development Policy. Critical incident processes actively deployed for common events including service outages and security incidents. Unscheduled downtime triggers critical process with 24/7 response capability. User Reporting: Users report incidents via email or telephone to our support team during business hours (9am-5pm). Platform includes alert system for administrators. Incident Reports: Incident report created at identification. Client lead contacts receive timely updates via email and phone until resolution. Communication plan accommodates incident severity and stakeholder requirements. Monthly support reports available detailing incidents and resolution times.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 1%
• Between £250,000 and £500,000: 1.5%
• Between £500,001 and £1,000,000: 2%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 5%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: ISOQAR
• ISO/IEC 27001 accreditation date: Tuesday 30 June 2020
• What the ISO/IEC 27001 doesn’t cover: Annex A Control A.8.23 'Web Filtering' is excluded from our ISO/IEC 27001:2022 certification. We do not implement group web filtering policies due to the nature of web design work and the sensitive data on our systems. Risk mitigation is achieved through employees agreeing to Acceptable Use and Electronic Communications policies, which govern appropriate internet usage and data handling practices.; All other controls within ISO/IEC 27001:2022 Annex A are applicable and implemented within our Information Security Management System.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: ISOQAR
• ISO 9001 accreditation date: Wednesday 11 July 2012
• What the ISO 9001 doesn’t cover: Clause 7.1.5.2 'Measurement Traceability' is excluded from our ISO 9001:2015 certification. We do not use any measuring or monitoring equipment that requires calibration or verification against standards traceable to international or national measurement standards. Our business operations do not involve physical measurements requiring this level of traceability.; All other clauses within ISO 9001:2015 are applicable and implemented within our Quality Management System.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 90fe9f0c-72fc-494f-b5d1-814904a1c5e7
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at accounts@phew.org.uk. Tell them what format you need. It will help if you say what assistive technology you use.