Permit to work: the control that fails when it becomes a formality

A permit to work is a formal written authorisation for a defined high-risk task, issued for a stated period, listing the precautions that must be in place before work starts and the conditions under which it may continue. It is used where the ordinary controls are not enough on their own: hot work, confined space entry, work on live or isolated systems, excavation, work at height near live plant, breaking into pipework.

The permit is not the safety measure. The safety measure is the checking, the isolation and the agreement between the person authorising and the person doing the work; the permit records that this happened and defines its limits. Systems fail when that order reverses — when the form is issued from a desk, signed on trust, and the site never actually gets looked at.

What a permit to work contains

• A unique permit number and the type of permit, so a permit can be traced and cross-referenced.
• The precise location and equipment, identified so there can be no confusion with a similar item nearby.
• The work to be done, and explicitly the work not authorised by this permit.
• The hazards identified and the precautions required, each one checked as in place before issue.
• Isolations: what is isolated, how, by whom, and the lock or tag references.
• Atmospheric testing results where relevant, with the time they were taken — a gas test is valid for a period, not for a shift.
• The validity period, with a start and an end time. Permits do not run until somebody remembers to close them.
• Named issuing authority, named acceptor, and the people who will do the work.
• Cross-references to any other permit that overlaps the same plant or area.
• A hand-back and cancellation section: work complete or suspended, isolations removed, area left safe, plant returned to operations.

The failures are always the same four

Permits issued without anyone visiting the location. Permits that overlap — two crews working on the same system, each holding a valid permit, neither knowing about the other. Permits that expire during the job and get verbally extended. And permits never formally closed, so nobody knows whether the isolation was removed and the plant is safe to restart. Every one of those is a coordination failure rather than a paperwork failure, which is why buying a system does not fix it on its own.

A permit is issued for a period and a scope. If either changes — the work takes longer, the crew finds a second valve, the shift hands over — the permit is re-issued, not stretched. Handover between shifts is the single most common point at which the control quietly lapses.

A permit to work system, not a pad of forms

What makes it work as a system is visibility: at any moment somebody should be able to see every live permit, on which plant, expiring when. On paper that means a permit board in the control room and a discipline about hanging permits on it. Electronically it means a live list — which is genuinely better, because expiry can prompt, overlaps can be detected against the same equipment, and a closed permit is closed everywhere rather than on one copy. Ettex Forms issues and receives the permits with the pre-start checks answered at the location, Ettex Board shows the live permits with their expiry times, and Ettex Records keeps the completed permits, the gas test results and the isolation records for the retention period.

Being direct: this is forms and records, not a safety-critical permit system, and none of it is safety advice. On a major hazard site the permit system is part of the safety case and belongs in software built and assured for the purpose, with the isolation controls that go with it. What is described here suits ordinary sites where the current system is a pad and a filing cabinet.

Two permits deserve their own treatment rather than being folded into the general system. A hot work permit carries a fire watch and a defined period after the work stops, which nothing else does. And isolation is not a permit at all but a separate discipline — lockout tagout exists precisely because a permit signed by the right person does not by itself stop the machine.

The permit system sits inside a wider framework. A health and safety policy names who is responsible for issuing permits and what the arrangements are, and where people work without direct supervision, a lone working policy covers what the permit cannot — the check-in that confirms someone finished safely.