Permit-to-Work: 6 Signals That Show Control Has Drifted

A permit-to-work should prove that a high-risk job has a live control chain, not just a signed form. When the permit starts naming the job correctly, verifying the barriers in the field, and forcing the right escalation, it protects people. When it becomes a routine stamp, it stops being a control and starts being paperwork.

Across 25+ years leading EHS in multinational operations, Andreza Araujo has seen the same pattern repeat in maintenance, line breaking, working at height and energized work. The permit looks complete, the box is checked, and the crew still walks into exposure because the document never reached the real decision point. In Safety Culture: From Theory to Practice, Andreza's position is simple. Repeated decisions define culture, and the permit is one of those decisions.

This article is for supervisors, maintenance leaders and EHS managers who need permit-to-work to do more than protect the filing system. During the PepsiCo South America tenure, where the accident ratio fell 50% in six months, Andreza Araujo learned that field control improves when leaders change the way work is approved, not when they add another signature.

Why permit-to-work stops protecting people when it becomes a signature

A permit-to-work is supposed to connect the hazard, the control and the authority to start. That chain breaks when the permit is written as a generic form that can travel across jobs, shifts and crews without changing. The result is a document that feels serious while the work itself still moves under production pressure.

James Reason is useful here because latent failures often survive inside apparently normal routines. A supervisor may accept a permit that looks tidy, the operator may trust the paper, and the contractor may keep moving because nobody wants to challenge the schedule. The gap is not in the form. The gap is in the operating logic behind the form.

That is why a permit should be read the same way a leader reads a critical control. If it does not narrow the work, make the control visible, and define the stop rule, then it is not yet doing the job the system assumes. The article on pre-task risk assessment checks shows the same problem from another angle, because a weak pre-job review often becomes the permit's hidden defect.

Signal 1: the scope names the department, not the job

The first warning sign appears when the permit says maintenance, cleaning or intervention, but does not describe the exact work sequence. A department name can look official while hiding the actual exposure. The crew can then approve a broad label and still leave the real hazard unnamed.

A useful permit starts with the physical task, not the organizational bucket. Remove jammed material from conveyor discharge after isolation is different from maintenance support, even if both jobs sit in the same work order system. The more generic the scope, the easier it becomes for the team to miss the exact energy path that matters.

The supervisor should ask the crew to describe the first three physical actions in order. If the answer does not match the permit, the scope is not ready. In more than 250 cultural transformation projects supported by Andreza Araujo's team, that mismatch has often been the first visible sign that the field and the paperwork no longer mean the same thing.

Signal 2: yesterday's hazards were copied into today's permit

The second signal is repetition. A permit that copies the same hazards day after day may look efficient, although it often means the team is reading the old job instead of the current one. Work changes with weather, access, tools, adjacent activity, fatigue, contractor mix and sequence pressure.

As Andreza Araujo argues in A Ilusão da Conformidade, translated as The Illusion of Compliance, formal evidence can hide weak reality when the system rewards completion more than accuracy. A copied permit is one of the clearest examples. It proves that somebody repeated the text, not that somebody checked the site.

The supervisor should ask one simple question. What is different today from the last time we did this job? If the crew cannot name one difference, the site may still be relying on habit. That habit is dangerous because the permit should be a current judgment, not an archive entry.

Signal 3: controls are listed, but nobody verified them in the field

Listing a control is not the same as verifying it. A permit can name isolation, barricading, rescue, line break controls, or energy release steps, but unless those barriers were checked where the work happens, the permit only describes intent. Intent is useful. It does not stop a machine, a fall or a release.

The strongest supervisors treat verification as the point of truth. They confirm the lock, the valve position, the pressure state, the guard condition, the rescue arrangement or the barricade before anyone starts. If the control cannot be observed, it has not yet been earned as a control.

This is where permit-to-work connects with LOTO verification before restart and with line break permit controls, because both jobs fail when the field proof never happens.

Signal 4: production pressure changes the permit after approval

The fourth signal is drift after approval. A permit may be correct at the moment it is signed, and then become false when the schedule changes, a contractor arrives late, another crew enters the area or the supervisor gets asked to keep moving. At that point, the permit has not failed on paper. It has failed in the real job.

Production pressure is dangerous because it does not always sound like pressure. It often arrives as a reasonable request to keep the outage short, the line running, or the crew productive. The permit then carries a hidden update that never appears in the document. The work got bigger, but the approval did not.

This is where decision quality matters more than compliance theater. Across 25+ years of executive EHS, Andreza Araujo has seen that leaders who protect the permit boundary protect the worker. Leaders who let the boundary shift informally end up normalizing drift. A permit that can change after approval without revalidation is not a control. It is a polite suggestion.

Signal 5: the supervisor delegates authority to the form

The fifth signal appears when the supervisor believes the document owns the decision. That usually sounds like, "the permit is approved, so we can go ahead." The phrase sounds tidy, but it removes judgment from the field and gives it to paperwork. The form cannot see the crew, the route, the temperature, the pressure or the fatigue in front of it.

A supervisor still has to decide whether the job is ready. The permit supports that judgment, but it never replaces it. If the supervisor treats the form as the authority, the role becomes administrative and the work starts to manage itself. That is usually the moment when weak controls survive.

Andreza Araujo's book Safety Culture: From Theory to Practice is useful because it treats leadership as a series of repeated choices. The permit is one of those choices. When the supervisor refuses to hide behind the form, the team learns that the job starts only when the controls are real.

Signal 6: handover breaks the control chain

The sixth signal shows up at shift change, pause, or crew transfer. A permit can be solid when it is first issued and then weaken when responsibility moves to another person who does not have the same field picture. If the next supervisor or contractor lead is not shown the actual condition, the permit starts losing meaning before the job is done.

Handover should include the actual control state, the open issues, the temporary fixes, the hazards that are still live and the stop condition for restart. A written note is useful, although the real transfer happens when the incoming person sees the work area, hears the unresolved concern and accepts the same boundary. Without that, the new shift inherits a story, not the control.

In Sorte ou Capacidade, glossed as Luck or Capability, Andreza Araujo argues that good outcomes do not prove capability. The same logic applies here. A smooth handover may simply mean nothing has gone wrong yet. Capability appears when the next shift can re-check the permit and still agree that the controls are valid.

What a field-ready permit looks like

A field-ready permit is narrow, current and testable. It names the task precisely, captures what changed today, lists the critical controls in a way the crew can verify, and defines the authority that can stop the job when conditions drift. The purpose is not to create a long form. The purpose is to make the next irreversible step visible before anyone takes it.

A useful comparison is the one between a permit and a toolbox talk. The article on the toolbox talk that changes field risk shows why the conversation matters before work starts, while the permit proves that the site still agrees with the conversation once the job is ready.

What supervisors should do in the next 30 days

Start with one high-risk permit type, not the whole program. Choose the job that most often creates schedule pressure, field drift or contractor interface friction. Then walk the last three permits with the supervisor, operator and EHS lead, and ask where the paper and the field stopped matching.

Next, write three checks that every permit must pass before approval. The first check is scope. The second is field verification. The third is handover readiness. If one of those checks cannot be answered clearly, the permit should not proceed, because the job is still carrying an unresolved condition.

In more than 250 cultural transformation projects, Andreza Araujo has seen that the fastest improvement comes when leaders stop asking whether the permit was completed and start asking whether the permit controlled the work. That shift is not cosmetic. It changes who is allowed to say no, which is exactly why weak systems avoid it.

If your site still treats the permit as paperwork, the next improvement is not a bigger form. It is a tighter field decision. If you want help turning permit-to-work into real control, start with Andreza Araujo and the book Safety Culture: From Theory to Practice. That is the point where approval stops being ceremonial and starts protecting the worker.

FAQ

What is permit-to-work supposed to do?

Permit-to-work is supposed to connect a high-risk task, the current hazards, the controls, and the authority to start. It is not just a form for recordkeeping. If it does not change the work boundary or the stop rule, it is not doing its real job.

Why do permits drift after approval?

Permits drift when the task changes, the crew changes, the schedule changes or the supervisor allows production pressure to rewrite the plan informally. The paper may still look complete, although the field no longer matches what was approved.

What is the biggest permit-to-work mistake?

The biggest mistake is trusting the form more than the field. A signed permit can still leave a job exposed if the controls were never verified, the scope was too broad, or the handover broke the chain of responsibility.

How does safety culture affect permit-to-work?

Safety culture affects whether people feel free to stop the job when the permit no longer fits the work. As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture is visible in repeated decisions, especially when production pressure is present.

Which Andreza Araujo book fits this topic best?

Safety Culture: From Theory to Practice is the best starting point because it connects leadership behavior, field discipline and control verification. A Ilusão da Conformidade and Sorte ou Capacidade add the warning that paperwork can look good while the real risk remains alive.