LOTO Verification: How to Audit Isolation Before Maintenance

The lockout devices are on the valves, the tags are signed, and the maintenance crew is waiting beside the machine. Then a technician asks a question that changes the entire job: which energy source did we not test?

That question is the point of LOTO verification. A lockout procedure is not reliable because a checklist is complete. It is reliable when the isolation boundary matches the actual task, every exposed person understands the boundary, and the team can demonstrate that hazardous energy is absent or controlled. OSHA's control of hazardous energy standard, 29 CFR 1910.147, provides the regulatory anchor for this discipline, but the field audit still depends on the quality of the decision made before exposure.

Step 1: Define the maintenance boundary

Write the job boundary in terms of equipment, component, location, and work activity. "Repair the conveyor" is too broad to guide isolation. "Replace the drive coupling on Conveyor 3 between the head pulley and the transfer point" gives the team a boundary that can be checked.

Include adjacent equipment when its movement, pressure, temperature, electrical connection, or process flow can affect the people inside the boundary. The supervisor should compare the work order, the equipment drawing, and the physical asset because a copied boundary can omit a modification made after the last job.

Verification evidence includes a marked-up drawing or work package, a named work owner, and a clear statement of where people may and may not enter. If the boundary cannot be explained in one minute, the isolation review is not ready.

Step 2: Identify every energy source

List electrical, mechanical, hydraulic, pneumatic, thermal, chemical, gravitational, radiation, and process energy that could reach the work area. Do not reduce the review to the energy that starts the machine. A suspended load, a charged accumulator, a hot surface, or material trapped between valves can remain dangerous after the primary supply is disconnected.

Ask what can move, rotate, fall, pressurize, heat, cool, flow, discharge, or restart. The answer should come from people who operate and maintain the equipment, because each group sees different failure paths. James Reason's work on latent conditions is useful here. The missed isolation point is rarely just an individual memory failure; it can reflect drawings, labels, handover routines, and management-of-change gaps that allowed the wrong mental model to become normal.

Step 3: Map each isolation point to the boundary

Give every energy source a physical isolation point and connect it to the task boundary. Record the device identity, location, operating position, and the person responsible for applying the lock. When a single device controls several sources, the team should still show how each source is addressed rather than treating one lock as proof of total isolation.

Walk the route from the source to the worksite. Check disconnects, breakers, valves, blinds, blocks, pins, bleed points, and physical restraints against the equipment in front of you. A diagram can support the review, but it cannot replace field confirmation where labels are damaged, piping has changed, or the equipment is not configured as expected.

The audit passes this step when a second competent person can trace the source, isolation point, and exposed component without relying on verbal assumptions.

Step 4: Separate isolation from dissipation

Isolation stops new energy from entering the boundary. Dissipation removes or restrains energy that is already present. Keep these decisions separate in the work package, because a closed valve does not prove that downstream pressure has fallen and an open disconnect does not prove that a rotating mass has stopped.

Specify how the crew will bleed, drain, discharge, cool, block, secure, ground, restrain, or wait for stored energy to decay. Where dissipation cannot be completed, describe the residual energy and the physical control that keeps people outside its path. A strong plan names the condition that must be reached before the next step starts.

Step 5: Apply locks and tags to the actual control points

Each authorized employee should apply personal protection in line with the site's procedure. The tag should identify the person, the date, the work area, and the reason for the lock, using the site's required format. Group work needs a group-control method that preserves personal protection while giving one person clear coordination responsibility.

Do not treat a tag as a substitute for an isolation device. Do not accept a lock location that is convenient but outside the defined energy-control boundary. The supervisor should compare the installed devices with the isolation register before the crew enters the exposure zone.

For contractor work, align the host and contractor procedures before the task begins. The host still needs to know which equipment is protected, who owns the decision to stop, and how the two systems will communicate during shift changes.

Step 6: Test for zero energy

Testing is the decisive field check. Use the method specified for the energy type, confirm the test instrument or method is suitable, and attempt the normal start or movement command when the procedure requires it. Then return controls to the required neutral position and verify that the test result represents the condition of the equipment, not merely the condition of the instrument.

Electrical testing should follow the site's qualified-person requirements. Mechanical, hydraulic, pneumatic, and process systems need their own evidence, such as pressure readings, drain confirmation, movement checks, or a physical restraint inspection. A single electrical meter reading cannot validate every energy form in a complex asset.

Record who performed the test, what was tested, and what result allowed the work to proceed. If the team cannot explain the test in plain language, stop and bring in the competent technical authority.

Step 7: Confirm the people and the exposure

Review the isolation with the workers who will perform the task, not only with the person who prepared the permit. Ask each person to identify the boundary, the energy sources, the residual hazard, the action required if conditions change, and the person who can stop the work.

This conversation is not a ceremonial briefing. It tests whether the written isolation has survived translation into the worksite. In *Make The Difference: Be a Leader in Health & Safety*, Andreza Araujo places practical leadership close to the moment where workers must make a safe decision under operational pressure. That is why the supervisor should observe the explanation, listen for uncertainty, and correct the plan before exposure rather than after a near miss.

Step 8: Audit changes, handovers, and interruptions

Recheck the isolation whenever the job boundary, crew, equipment state, access route, weather, production interface, or work sequence changes. A shift handover deserves the same attention as a new task when the incoming team inherits locks, open equipment, or unresolved residual energy.

Use a short change trigger in the work package. Examples include a new contractor, a different component, a second isolation boundary, a break longer than the site's defined period, or any condition that makes the original test no longer representative. The trigger should lead to a defined action, such as a re-brief, a new test, a revised permit, or a complete restart of the energy-control process.

Step 9: Control the return to service

Restart is part of LOTO, not an administrative moment after the real work is finished. Before removing protection, account for tools, temporary blocks, guards, people, and materials. Confirm that the equipment is ready for operation and that affected operators understand what will change.

Personal locks should be removed by the person who applied them unless the site's documented emergency process allows a controlled exception. The work owner should verify that the boundary is clear, the responsible operator has accepted the equipment, and the first restart is observed when the risk justifies it.

Close the job with evidence of what was isolated, what was tested, what changed, and what the team learned. A completed record becomes useful when it improves the next isolation rather than simply proving that a form existed.

What a credible LOTO audit should leave behind

A strong audit produces more than a signed checklist. It leaves a traceable boundary, a complete energy map, identified isolation owners, test evidence, worker understanding, change triggers, and a controlled restart decision. Those records allow leaders to see whether the site is managing hazardous energy or only documenting the appearance of control.

Across 25+ years leading EHS work in multinational operations, Andreza Araujo has treated safety performance as a result of engineering, leadership, and care working together. Her book *Safety Culture Diagnosis: Learn how to do your own* is especially relevant when a site needs to determine whether field verification is changing decisions or merely adding another approval layer. For teams that want to turn this workflow into a repeatable system, Andreza Araujo's Safety School provides a practical path for developing supervisors and EHS professionals.

LOTO verification is complete only when the team can demonstrate that the isolation matches the work, the energy is absent or controlled, and the return to service is owned. That standard is demanding by design, because the cost of an untested assumption is carried by the person inside the boundary.