How to Run a Permit-to-Work Handover Before High-Risk Maintenance Starts

A permit-to-work handover is not the signature that closes a form. It is the moment the site transfers control from planning to the people who will face the energy, access and timing risks in the field.

OSHA 1910.147, OSHA 1926, ISO 45001:2018 and HSE guidance all point toward the same operational idea. High-risk work needs a clear control owner, a verified state and a stop rule that works under pressure.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture becomes visible in routine decisions, which is why the permit handover matters more than most permit systems admit.

What you need before starting

Before the handover begins, gather the permit template, task plan, isolation list, area owner, contractor lead, rescue plan, weather triggers, simultaneous work map, previous shift notes and the names of the competent people who can accept or reject the job. If the work includes electrical isolation or stored energy, keep the LOTO records beside the permit so the team does not treat verification as a separate document trail.

Across 25+ years leading EHS in multinationals, Andreza Araujo has seen that permit failures usually happen at the interface, not in the permit form itself. The form may look complete while the control transfer is still weak.

This guide is written for maintenance supervisors, EHS managers and area owners who need a field routine, not a compliance ritual. As Andreza Araujo argues in Safety Culture: From Theory to Practice, control only becomes real when it survives the pressure of the shift.

Step 1: Define the work boundary

Start by naming the job in one sentence. State the equipment, the line, the area, the tools, the crew size and the duration. A boundary like maintenance in Unit 4 is too vague because it hides which energy sources, access routes and nearby jobs are part of the same risk picture.

The verification test is simple. Could another supervisor read the sentence and know exactly what is included and what is excluded? If not, the handover is still incomplete. A common error is to approve the permit before the team has agreed on the real scope, which leaves room for the job to expand without a new review.

Step 2: Match the permit type to the hazard

Choose the permit that matches the highest credible exposure, then map any nested permits that may be needed. Hot work, line break, confined space, electrical isolation and working at height do not have the same control logic, even when they happen on the same job.

The verification test is whether one person can name the lead owner for the whole job and the owner for each interface. If the answer requires three departments to negotiate in the middle of the shift, the permit design is already too loose. When the job changes at shift change, pair the handover with How to Run a Shift Handover Safety Review in 15 Minutes so the control does not disappear between crews.

Step 3: Prove isolation and residual energy

Isolation is not a label. It is proof that the energy source is controlled, the stored energy has been released or restrained and the work crew understands what has been verified. That proof may include lockout, tagout, venting, draining, bleeding, blocking, testing, try-start or gas checking, depending on the hazard.

The verification test is physical evidence at the point of work, not trust in the system record. A tag alone does not prove zero energy, and a permit alone does not prove the line is safe to open. If the task includes electrical or mechanical isolation, use LOTO Verification: How to Prove Zero Energy as the field check before anyone proceeds.

Step 4: Control the area and simultaneous work

Define who may enter the work area, what nearby activity must stop and which vehicles, cranes, contractors or production tasks create conflict. A permit that ignores simultaneous work leaves the crew exposed even when the isolated equipment itself is correct.

The verification test is whether the area owner and the supervisor would draw the same boundary on the floor. If one person thinks the job owns the whole bay and the other thinks the barricade is only advisory, the handover has not transferred control. The common error is to approve a permit while access, line of fire and traffic control still depend on informal understanding.

Step 5: Brief the crew at the workface

The crew should hear the permit at the place where the work will happen, not only in the office. The briefing should cover the scope, the hazard, the isolation state, the area boundary, the stop rule and the condition that requires a fresh review. If the team cannot see the control, the team has not really received it.

The verification test is whether each worker can state what stops the job and who to call. A reading of the permit is not enough if nobody can connect the text to the physical site. Andreza Araujo has seen this pattern in more than 250 cultural transformation projects. People agree on the permit while no one owns the check that proves it.

Step 6: Assign one owner for each weak control

Every weak barrier needs a named owner. That includes isolation, fire watch, gas testing, rescue readiness, spotter position, access control and any verification step that can drift when production pressure rises. Ownership means the person who will physically confirm the barrier, not only the person whose name appears on the form.

The verification test is whether the named person is present, briefed and able to stop the work. A common error is to write a list of names and assume the permit is now safe. As Andreza Araujo argues in Safety Culture: From Theory to Practice, a culture of control lives in repeated ownership, not in polite agreement.

Step 7: Test the handover at the point of work

Before the crew starts, ask them to point to the barrier, the escape route, the isolation and the stop line. If they cannot point to those things, the handover has not yet become a usable control. This step is the fastest way to expose the gap between a signed form and a real transfer of authority.

The verification test is direct observation. The supervisor should walk the job with the crew and compare the permit to the field conditions. A common error is to accept the permit at a desk and trust that the field still looks the same an hour later. The site can change faster than the paperwork.

Step 8: Close the permit and feed the lesson back

Closure should confirm that the task is finished, the area is safe, temporary controls are removed and any deviation is recorded before the permit is archived. If the job changed during execution, the handover closeout should capture what was learned, because the next permit should not start from the same blind spot.

The verification test is whether the lesson changes the template, the checklist or the supervisor routine. As Andreza Araujo argues in Safety Culture: From Theory to Practice, a process that never changes after exposure is not learning. It is filing.

Final checklist

• The job boundary is written clearly enough for another supervisor to repeat it.
• The permit type matches the highest credible hazard in the task.
• Isolation and residual energy were verified at the point of work.
• The area boundary and simultaneous work controls are visible on site.
• The crew can say what stops the job and who owns each weak barrier.
• The handover was tested in the field, not only approved on paper.
• Closure captured any deviation and fed it back into the system.

Conclusion

A permit-to-work handover works when it makes the next decision visible. If the crew cannot point to the barrier, name the owner or say what stops the job, the handover is still incomplete.

For maintenance supervisors and EHS managers who want this turned into a simpler routine, Make The Difference: Be a Leader in Health & Safety and Andreza Araujo's advisory work provide a practical starting point.