Permit to work explained

A permit to work is a formal written authorisation to carry out a defined high risk task under specified conditions, for a limited time. It is not the safe system of work itself. It is the control that confirms the safe system has been put in place, that the people doing the job understand it, and that the job is formally handed back when finished.

Which jobs need a permit?

Permits are for work where the consequence of getting it wrong is severe and where the hazard is not obvious to someone walking past. The common categories are:

• Hot work. Welding, cutting, grinding or anything producing a spark or a flame in an area that is not a designated workshop.
• Confined spaces. Tanks, vessels, pits, sewers and any space where the atmosphere could be hazardous or escape restricted.
• Electrical work. Particularly work on or near live conductors, and any isolation others rely on.
• Work at height where the arrangements are non-routine, such as on fragile roofs.
• Excavation where buried services or collapse are credible.
• Breaking containment on pipework or vessels that carried hazardous substances.
• Isolation and lock-off of machinery where someone will be working inside the danger zone.

The judgement call is at the boundary. Permitting too little leaves serious work uncontrolled. Permitting too much is worse than it sounds, because a permit system that covers routine jobs trains everyone to treat permits as a formality, and the signature stops meaning anything.

The permit lifecycle

A permit is a sequence, not a form. Each stage exists because a specific thing has gone wrong somewhere before.

1. Request. The work is described precisely: what, where, by whom, for how long. Vague scope is the origin of most permit failures.
2. Assessment and preparation. A competent person identifies the hazards and specifies the precautions, then those precautions are actually put in place. Isolations made, atmosphere tested, area cleared, equipment provided.
3. Issue. An authorised person signs to confirm the conditions are as specified. This is a personal accountability, which is why the authorised person should have seen the site rather than signed at a desk.
4. Acceptance. The person doing the work signs to confirm they have read and understood the conditions and the limits. Not a formality: it is the point at which the worker takes on the constraints.
5. Work under the permit. Within scope, within time, under the stated conditions. Any change means the permit is suspended and reassessed.
6. Hand back. The worker confirms the job is finished or stopped, the area is safe, tools and people are clear.
7. Cancellation. The authorised person confirms hand back, removes isolations and closes the permit. Plant is not returned to service until this happens.

Hot work carries an additional stage that is often skipped: a fire watch continuing after work stops, commonly for at least an hour, because smouldering material takes time to become a fire.

What a permit must state

The details vary by hazard, but a permit that cannot answer these questions is not doing its job.

• Exactly what work is authorised, and by implication what is not.
• The precise location, specific enough that the wrong valve cannot be opened.
• The identified hazards.
• The precautions taken, and which are already in place versus required of the worker.
• Isolations applied, with their references and lock numbers.
• Any test results, such as gas readings, with the time they were taken.
• The valid period, with a defined expiry rather than “end of job”.
• Named individuals: who issued, who accepted, who cancelled.
• Any other permits or work in the same area that could interact.

That last one is the quietest killer. Two permits issued independently, each safe in isolation, become dangerous when the tasks are within a few metres of each other. Hot work above an open drain that another crew has just flushed with solvent is the textbook example, and the reason permits should be visible in one place rather than held in separate folders.

Why permit systems fail

Permit failures are rarely a missing form. They are almost always one of four things.

• Signature without inspection. The authorised person signs from an office based on what they were told. Everything the permit certifies is then unverified.
• Scope creep. The job turns out to need one more cut, slightly further along, and the permit does not cover it. Nobody stops, because stopping means starting the process again.
• Permits for everything. Over-application makes the system routine, and routine makes the checks perfunctory.
• Hand back left undone. The crew finishes and leaves. The permit stays open, isolations stay on or come off unrecorded, and the next shift inherits an unclear state.

The HSE’s guidance on permit-to-work systems, HSG250, is worth reading in full if you operate one, because it is largely a catalogue of these failures drawn from real incidents.

Paper permits and their digital replacements

Traditional permits are multi-part carbonised pads: one copy at the workplace, one with the issuing authority, one on a board. The system works, and it has three known weaknesses. Nobody can see the live picture without walking to the board. Expiry is not enforced by anything. And an open permit at shift handover is only as good as the conversation that accompanied it.

Digital permits address exactly those three points: a live list of what is open and where, automatic expiry and escalation, and a handover state that is recorded rather than remembered. They also make conflicting permits in the same area detectable, which is the failure mode with the worst consequences.

What they do not fix is the authorised person signing without looking, and it would be misleading to claim otherwise. A digital signature applied from an office is the same failure as a paper one, executed faster. The system helps with visibility and memory. Competence and culture remain the job of the organisation.

Logincident