A permit to work is a conversation with a signature on it. The moment it becomes a form issued from an office by someone who has not seen the job, it stops controlling anything.
A permit to work is a formal written authorisation for a defined high-risk task, issued for a stated period, listing the precautions that must be in place before work starts and the conditions under which it may continue. It is used where the ordinary controls are not enough on their own: hot work, confined space entry, work on live or isolated systems, excavation, work at height near live plant, breaking into pipework.
The permit is not the safety measure. The safety measure is the checking, the isolation and the agreement between the person authorising and the person doing the work; the permit records that this happened and defines its limits. Systems fail when that order reverses — when the form is issued from a desk, signed on trust, and the site never actually gets looked at.
Permits issued without anyone visiting the location. Permits that overlap — two crews working on the same system, each holding a valid permit, neither knowing about the other. Permits that expire during the job and get verbally extended. And permits never formally closed, so nobody knows whether the isolation was removed and the plant is safe to restart. Every one of those is a coordination failure rather than a paperwork failure, which is why buying a system does not fix it on its own.
A permit is issued for a period and a scope. If either changes — the work takes longer, the crew finds a second valve, the shift hands over — the permit is re-issued, not stretched. Handover between shifts is the single most common point at which the control quietly lapses.
What makes it work as a system is visibility: at any moment somebody should be able to see every live permit, on which plant, expiring when. On paper that means a permit board in the control room and a discipline about hanging permits on it. Electronically it means a live list — which is genuinely better, because expiry can prompt, overlaps can be detected against the same equipment, and a closed permit is closed everywhere rather than on one copy. Ettex Forms issues and receives the permits with the pre-start checks answered at the location, Ettex Board shows the live permits with their expiry times, and Ettex Records keeps the completed permits, the gas test results and the isolation records for the retention period.
Being direct: this is forms and records, not a safety-critical permit system, and none of it is safety advice. On a major hazard site the permit system is part of the safety case and belongs in software built and assured for the purpose, with the isolation controls that go with it. What is described here suits ordinary sites where the current system is a pad and a filing cabinet.
A formal written authorisation for a defined high-risk task, valid for a stated period, listing the precautions that must be verified before work starts and the conditions for continuing.
For work where normal controls are insufficient — hot work, confined spaces, isolated or live systems, excavation, breaking containment. The exact triggers are set by your regulator and your own risk assessment.
A competent authorised person who has checked the location and the precautions, and who is not the person carrying out the work.
The permit is re-issued after the conditions are rechecked. Verbal extension is one of the most common and most serious failures of a permit system.
An electronic medication administration record removes whole classes of error and introduces new ones. What it does not remove is the need for the paperwork around it.
A COSHH assessment is not a filed safety data sheet. It is a judgement about what happens when your people use that substance, in your process, at your quantities.
A DVIR is the driver’s record of a vehicle inspection. Enforcement rarely turns on the form itself — it turns on whether the defect somebody wrote down was ever repaired and certified.