Permit-to-Work Handover: 5 Failures That Pass Risk Forward

Permit-to-work handover fails when the outgoing team passes a signed form but leaves the next shift to reconstruct the real risk from memory. In high-energy work, that gap is where drift enters.

Permit-to-work handover is the transfer of active controls, open exceptions, and field conditions from one shift to the next, so the next supervisor can decide whether the job may continue without inheriting blind spots.

Across 25+ years in executive EHS and more than 250 cultural transformation projects, Andreza Araujo has seen the same failure repeat: the form is complete while the field is not. In the PepsiCo South America case, where the accident ratio fell 50% in 6 months under a 180-day plan, the change came from tighter leadership routines, not from better handwriting. ISO 45001:2018 expects operational control to survive the shift boundary, and that expectation becomes real only when the handover captures what changed in the work, not just what was planned.

Why a signed handover is not enough

A signed permit records intent. It does not prove that the barrier still exists, that the next crew knows the exception, or that the job can continue without a new exposure. James Reason's work helps here because the visible signature is only the last point in a longer chain of latent conditions, active shortcuts, and missing verification.

This matters most in line breaks, hot work, LOTO, scaffolds, confined space entry, and other jobs where a shift change can separate the person who saw the hazard from the person who inherits it. The question is not whether the permit looks tidy. The question is whether the next supervisor can still control the job without guessing.

1. The outgoing crew describes the job, not the risk

The first failure is verbal overload. The outgoing crew explains what they did, who was present, and how far the task progressed, but the risk picture disappears inside that narration. The next shift hears activity, not exposure.

That difference matters because the next supervisor needs to know what can still hurt someone if the work restarts now. If the crew only reports completion status, the handover becomes a summary of motion rather than a transfer of control. A strong handover names the open energy, the isolation point, the temporary barrier, and the condition that makes the work unsafe if production pressure returns.

Use the same discipline that a LOTO verification check or a hot work permit review requires. The next person should not have to infer the critical control from a story told in a hurry.

2. The next shift inherits assumptions without a field walk

The second failure is the belief that reading the permit is enough. It is not. A permit can only tell the next shift what the previous team believed was true when they signed, which is a weaker claim than what the field actually needs at the start of the new shift.

A short field walk closes that gap because it forces the supervisor to compare paper with place. A route can change, a scaffold can be altered, a line can be reopened, or a neighboring crew can move into the same area. The permit does not update itself, and the job does not pause just because the shift changed.

Andreza Araujo's book Safety Culture: From Theory to Practice treats repeated decisions as the real culture signal. A handover walk is one of those decisions, because it shows whether the team still checks conditions or only trusts the document.

3. Temporary conditions disappear from the story

The third failure is selective memory. Temporary hoses, bypasses, cables, barricades, ventilation changes, and access restrictions are treated as if they were already part of the permanent system. They are not. If the next supervisor does not hear about them, the temporary condition becomes invisible and then becomes normal.

This is one of the biggest traps in occupational safety because temporary controls often hold the job together long enough for everyone to relax. When the boundary changes again, the team has forgotten that the control was temporary in the first place.

If the task involves open piping, compare the handover with a line break permit. If the task involves working around a structure, compare it with a scaffold handover. In both cases, the temporary condition is part of the risk, not a footnote.

4. Simultaneous work is omitted from the boundary

The fourth failure is silence about interfaces. Another crew arrives, a contractor starts nearby work, or a maintenance window overlaps with production recovery, and suddenly the permit is no longer the only active control in the area. The handover that ignored that overlap is now stale.

Simultaneous work matters because the hazard is often created by interaction, not by the original task alone. A clean permit can still sit beside a crowded area, a shared access route, or a new energy source that the first shift did not own. The next supervisor needs to hear who else is in the zone, which controls are shared, and which assumptions stop being true once other work starts.

That is also why the next shift should know whether the task now affects another active permit. If the answer is unclear, the handover has not yet transferred control. It has only transferred paperwork.

5. The supervisor gets paperwork, not decision memory

The fifth failure is the easiest to miss and the most expensive to keep. The supervisor receives a stack of forms, notes, and signatures, but no decision memory. That means the person who must decide whether the job continues does not know which risk was accepted, which risk was rejected, and which one was still waiting for a field check.

Decision memory matters because shift work creates discontinuity. A good handover says what changed, what remains open, what must not restart, and what the next supervisor must verify before the crew moves. Without that memory, the supervisor has to recreate the last decision under time pressure, which is how weak controls survive into the next shift.

Across more than 250 cultural transformation projects, Andreza Araujo has seen that sites improve when leaders make the decision explicit instead of assuming the permit itself will carry the logic. That is the difference between documentation and operational discipline.

What a clean handover must include

A clean handover is short enough to use and specific enough to trust. It should tell the next supervisor what is active, what is temporary, what changed, what is still open, and what must be verified before the task restarts. If the next shift cannot act on the handover without reinterpretation, the handover is incomplete.

Use the handover together with the job-specific control logic, not as a standalone ritual. A working at height rescue plan or a permit for hot work already expects active verification, and the shift boundary should be held to the same standard.

If you want a practical rule, keep it simple. The outgoing supervisor should be able to say what changed, the incoming supervisor should be able to repeat it, and the field should still match the story after the next walk.

FAQ

What is permit-to-work handover?

It is the transfer of active controls, open exceptions, and field conditions from one shift to the next, so the next supervisor can decide whether the job may continue without inheriting blind spots. That logic fits ISO 45001 operational control because the job must remain controlled after the shift changes.

Why does a signed permit not prove control?

A signature only proves that someone signed. It does not prove that isolation still exists, that temporary conditions were explained, or that the next crew saw the same field reality. James Reason's latent-failure lens is useful here because the paper can look complete while the system still leaks risk.

Which jobs need the strictest handover?

Start with line breaks, hot work, LOTO, scaffolds, confined space entry, lifting, and any task that crosses between crews or contractors. Those jobs change quickly, and the shift boundary is often where the most dangerous assumption sneaks in.

How should supervisors document exceptions?

They should name the exception, the reason it exists, the control that keeps it safe for now, and the condition that ends the exception. A vague note invites drift, while a specific note gives the next supervisor a real decision point.

Where should a team start if handover keeps failing?

Start with one high-risk task and one shift boundary, then compare the permit with the field and the next supervisor's understanding. The team can also read The Illusion of Compliance and Safety Culture: From Theory to Practice to see why a tidy form is not the same thing as a controlled job.

Conclusion

Permit-to-work handover only works when the next shift receives risk, control memory, and a clear decision, not just a signed form. If the field does not match the story, the handover is still unfinished.