Permit-to-Work Explained: 4 Checks Before a High-Risk Job Starts

F7 glossary and explainer for EHS managers and supervisors

A permit-to-work should answer a practical question before high-risk work begins. Can this team perform this task, in this place, under these conditions, with controls that someone has actually checked?

When the permit becomes a signature sheet, authorization is mistaken for readiness. The form may be complete while isolation, exclusion, atmospheric monitoring, rescue, or supervision remains uncertain.

A permit-to-work is a controlled authorization process for defined high-risk work. It identifies the task and conditions, confirms the safeguards that must be present, assigns authority for the decision, and states what will suspend or cancel the work.

Definition

Permit-to-work systems are used when routine procedures do not provide enough control for a changing or high-consequence task. Common examples include hot work, confined-space entry, line breaking, electrical work, excavation, work at height, and tasks that involve simultaneous operations.

ISO 45001:2018 supports operational planning and control, but a standard does not make a permit effective by itself. The permit has value when it connects the written plan to the physical conditions in which the work will occur. That connection is the difference between documenting a decision and controlling an exposure.

James Reason’s work on latent failures also explains why a permit cannot focus only on the person signing it. Weak planning, incomplete information, unclear ownership, and production pressure can create conditions in which the final authorization looks reasonable even though the system is not ready.

Four checks that make the permit meaningful

Work definition

The task, location, equipment, sequence, boundaries, and simultaneous activities are specific enough to test.

Control verification

The safeguards that prevent exposure are present, suitable for the task, and checked by a competent person.

Decision authority

The issuer, performing authority, and stop-work authority are named, understood, and available during the work.

Change response

The team knows which conditions require a pause, reassessment, reauthorization, or cancellation.

Check 1: Is the work defined precisely enough?

A permit should describe the actual job rather than a broad activity such as “maintenance” or “repair.” The description needs enough detail for another competent person to understand the energy sources, work area, equipment, sequence, and interfaces that could change the exposure.

Specificity matters because a control can be correct for one task and wrong for another. A hot-work permit for a clean workshop does not answer the same questions as hot work beside a process line, a tank, or combustible storage. If the work boundary is vague, the permit cannot establish a reliable boundary for control.

Check 2: Have the critical controls been verified?

Listing a control is not the same as confirming that it exists. The permit should identify the safeguard that must prevent the credible exposure, then record how that safeguard was checked. Verification may involve physical inspection, isolation testing, gas monitoring, equipment examination, a defined exclusion zone, or a rescue-readiness check.

A tick box saying “isolation complete” is weak evidence if nobody can identify the isolation point, test method, status indicator, and person who performed the verification. A permit should make the control observable enough that a supervisor can challenge it without relying on memory.

Check 3: Is decision authority clear?

Three roles should not be collapsed into one name. The issuer confirms that the conditions for authorization have been met. The performing authority leads the work team. The stop-work authority can pause the task when the conditions described in the permit no longer match the field.

The titles vary between organizations, but the decision rights cannot remain implicit. Workers need to know whom to contact when the plan changes, and supervisors need to know who can reject a permit without waiting for a management meeting. Andreza Araujo’s The Illusion of Compliance, known in Portuguese as A Ilusão da Conformidade, is relevant because a defined process does not guarantee protection when responsibility is only nominal.

Check 4: Does the permit explain what happens when conditions change?

High-risk work rarely unfolds exactly as planned. Weather changes, another crew enters the area, a gas reading rises, equipment behaves differently, a control is removed, or the sequence takes longer than expected. A useful permit states the trigger that stops work and the path for reassessment.

Reauthorization is not a bureaucratic delay when the original assumptions have changed. It prevents an old decision from being treated as evidence for a new exposure. The team should be able to say what changed, which control is affected, who reviews the condition, and what evidence is required before work resumes.

How to differentiate a permit from a risk assessment

A risk assessment identifies hazards, evaluates credible consequences, and selects controls for a task or activity. A permit-to-work authorizes a defined piece of work under current conditions, with named roles and explicit stop or cancellation triggers.

The two processes should support each other, but they answer different questions. The assessment asks how the work can be made safer. The permit asks whether this work can start now, in this location, with these controls and this authority. Treating the permit as a duplicate risk assessment creates paperwork without adding a decision gate.

When should a permit be stopped or cancelled?

Stop the work when a critical control is absent, degraded, misunderstood, or no longer suitable for the conditions. Stop it when the work boundary changes, a new simultaneous operation creates interference, the emergency response is unavailable, or the team cannot explain how the exposure is being controlled.

The decision should not depend on whether an incident has already occurred. A permit is a preventive control, so the loss of a required safeguard is enough to suspend the task. Make the change visible, route it to the person with authority, and restart only when the evidence supports a new decision.

For a related operational view, see how to build a temporary control plan before high-risk work and how to build a risk acceptance gate for frontline supervisors.

What a good permit leaves behind

A good permit leaves more than a completed form. It leaves a shared understanding of the task, evidence that the critical controls were checked, a clear route for escalation, and a record of the assumptions that made authorization reasonable.

Review the permit after the job, especially when work was paused, conditions changed, or a control failed. Ask whether it predicted the real exposure and whether the evidence required before work started was strong enough. If not, change the process, not just the wording.

Andreza Araujo’s work on safety culture supports the same practical test. A control is credible when people can use it under pressure, leaders can verify it in the field, and the organization can stop work without treating the interruption as failure.

Use the four checks before the next high-risk job starts, then test whether the permit changed the decision or only recorded it.