A permit to work system controls how high-risk, non-routine work is authorized, coordinated and closed out so that the person doing the job, the person supervising the area and the energy sources involved are all verified before work starts — not just documented after the fact. This guide sets out how to design a permit to work system that stays operationally credible: permit types and their required certificates, authorization levels, the full lifecycle from application to close-out, isolation and gas-testing requirements, shift handover and suspension rules, and the audit checklist that tells you whether your PTW program is real control or paperwork.
A permit to work (PTW) system is a formal, auditable process that identifies hazardous work, verifies that specific controls are in place before work starts, names who is authorized to do what, and requires a documented handback before the work area returns to normal operation. It works only when it sits on top of a genuine risk assessment — the permit records that controls were verified, it does not replace deciding what those controls should be.
What a permit to work system controls
PTW exists to close the gap between a written procedure and what is actually happening at the job site at the moment work begins. A hot work procedure can be perfect on paper; the permit is what forces someone accountable to confirm, in that location, at that time, that the fire extinguisher is present, the gas test is current, and no incompatible work is happening twenty meters away. The system controls four things simultaneously: the physical and energy hazards of the job itself, interaction with hazards from other simultaneous work, the competency and authorization of the people involved, and the traceable record that all of the above was verified rather than assumed.
PTW is not a substitute for a job safety analysis (JSA), a hazard identification study or a documented safe operating procedure — it is the control point that confirms those upstream assessments were actually applied to today's job. A site that issues permits without a preceding task-level risk assessment has a paperwork system, not a control system.
When PTW is and is not required
Not every task needs a permit, and treating PTW as universal is what causes "permit fatigue" — where issuers stop reading permits carefully because most of what crosses their desk is low-risk routine work. A defensible scope rule is to require PTW for work involving an energy source that must be isolated, entry into a confined space, an ignition source near flammable material or atmosphere, ground penetration where buried services may exist, or work at height/lifting operations above a defined risk threshold that your site risk assessment sets. Routine, pre-risk-assessed tasks covered by a standing safe operating procedure — such as routine equipment operation within design parameters — typically do not need a fresh permit each time, provided the SOP itself was subject to a documented risk assessment. Where a site is unsure whether a task needs a permit, the safer default is to require one; the cost of an unnecessary permit is administrative, while the cost of a missing one is a live hazard with no verified control. Confirm your own PTW scope decision against your site risk assessment and any client or regulator standard that applies to your facility before finalizing the list.
Document the scope decision itself, not just the outcome. A written PTW applicability matrix — task type against permit type required — gives new supervisors and contractors a fast reference and gives an auditor evidence that the scope was a deliberate risk-based decision rather than an informal habit. Review the matrix whenever a new process, chemical or piece of equipment is introduced, since scope decisions made for the original plant configuration can quietly go stale as the site changes. GCC operators in particular often inherit a client or operator's PTW scope standard (for example a specific major operator's HSE management system requirement) that is stricter than a generic baseline — where a site works under a client contract, the client's scope rules govern and should be reconciled with the site's own procedure rather than run as two parallel systems.
Permit types and simultaneous operations
Most sites operate a small set of standard permit types, each triggering specific supporting certificates. The table below is a starting reference — actual certificate names and formats should match your site procedure.
| Permit type | Primary hazard | Typical supporting certificate |
|---|---|---|
| Hot work | Ignition source near flammable material/atmosphere | Fire watch record, gas-test certificate, fire-extinguisher verification |
| Confined space entry | Oxygen deficiency/enrichment, toxic or flammable atmosphere, engulfment | Atmospheric test certificate, rescue-plan sign-off, ventilation record |
| Electrical isolation | Electric shock, arc flash, unexpected re-energization | Isolation certificate, lock/tag register, proving-dead record |
| Mechanical isolation | Stored energy, unexpected movement | Isolation certificate, lock/tag register, blind/spade list |
| Excavation | Buried services, collapse | Utility clearance/service drawing check, shoring/battering record |
| Line breaking | Residual pressure, hazardous product release | Line-break certificate, depressurization/drain record |
| Work at height / lifting | Fall, dropped object, load control | Lift plan, anchor-point verification, rescue-plan sign-off |
Where two or more of these operations happen in the same area at the same time — for example hot work above an excavation crew, or a lift over an occupied walkway — the site needs a simultaneous operations (SIMOPS) review before either permit is issued, not a note added to one of the permits after the fact.
Hot work
Requires a pre-work combustible survey of the area within the applicable radius, continuous or periodic gas testing depending on the atmosphere risk, a dedicated fire watch for the duration plus a defined stand-down period after work stops, and confirmed extinguishing equipment at the location before the permit is signed. Where the task itself involves gas cutting or welding equipment, verify hose, regulator and flashback-arrestor condition against your welding and cutting with oxygen-fuel gas checklist before the permit issuer signs, since equipment-condition faults are a separate check from the area's combustible survey.
Confined space entry
Requires atmospheric testing before entry and at defined intervals during occupancy, a named standby/attendant who never leaves their post while anyone is inside, a rescue plan specific to that space's geometry and access, and continuous or periodic re-testing if the work itself can change the atmosphere (welding, use of solvents, disturbance of residue). Related training context is covered in our confined spaces safety training resource.
Electrical and mechanical isolation
Requires identification of every energy source feeding the equipment (not just the obvious one), physical isolation with a lock unique to each authorized person, a proving-dead or zero-energy verification step before work starts, and a documented isolation register showing who applied each lock and when it was removed. Our lockout tagout loto training page covers the underlying isolation discipline this permit type depends on.
Excavation and line breaking
Excavation requires a documented check against as-built service drawings and, where available, physical location of buried services before digging starts, plus a decision on shoring or battering based on soil condition and depth. Line breaking requires confirmed depressurization and drainage of the line section, verification that isolation points are holding, and identification of residual product hazard before the first joint is broken.
Work at height and lifting
Requires verified anchor points or a confirmed fall-arrest system appropriate to the task, a lift plan for any crane or mechanical lifting operation including exclusion zones beneath the load path, and a rescue plan for suspended-worker scenarios, not only a fall-prevention plan.
SIMOPS coordination
Requires a single accountable coordinator — often the area authority — who holds visibility of every active permit in a zone and has explicit authority to refuse or suspend a new permit if it conflicts with work already underway. Without this single point of coordination, SIMOPS conflicts are typically discovered only after an incident.
Roles and authorization levels
A permit system fails when the same person plays more than one accountable role on the same job, because the checks stop being independent. The table below sets out the standard role split.
| Role | Responsible | Accountable | Consulted | Informed |
|---|---|---|---|---|
| Performing authority (work team lead) | Executing work per permit conditions, stopping work if conditions change | Permit issuer | Area authority | |
| Permit issuer | Verifying controls in place before signing, setting validity period | Permit accuracy and completeness | Area authority, gas tester | Site HSE |
| Area authority (operations custodian) | Confirming area/process condition supports the work, SIMOPS check | Area safety during the permit's life | Shift supervisor | Permit issuer |
| Gas tester/competent verifier | Conducting and recording atmospheric or isolation tests | Test result accuracy | Permit issuer, performing authority | |
| Permit receiver | Confirming understanding of conditions before work starts, briefing the crew | Performing authority | Permit issuer |
Permit issuer, receiver, area authority and performing authority
The permit issuer is typically a trained, formally authorized supervisor or HSE-competent person with no direct execution role on the job being permitted. The area authority is the person who owns the process or plant area and confirms the equipment or zone is genuinely in the condition the permit assumes — for example, that a vessel is actually isolated and drained, not just scheduled to be. The performing authority (often a contractor supervisor) accepts the permit conditions on behalf of the work crew and is responsible for stopping work the moment a condition on the permit is no longer met. Keeping issuer and area authority as separate people wherever the site has the resource to do so is the single biggest structural safeguard against a rushed or incomplete verification.
Small sites sometimes combine the issuer and area authority role out of necessity, particularly on night shifts with reduced staffing. Where this is unavoidable, compensate with a second independent check — for example, requiring a control-room operator to verbally confirm isolation status over radio before the combined-role issuer signs — rather than accepting the single-person shortcut silently. Authorization itself should be a named, time-bound credential, not an assumed function of job title: a supervisor's authorization to issue confined-space permits should be recorded, refreshed on a defined cycle, and immediately suspended if their competency lapses, exactly as you would track a crane operator's license.
Step-by-step PTW lifecycle
The lifecycle below is the seven-stage backbone most functioning PTW systems use, whether paper or digital.
- Application. Performing authority or requester submits the permit request describing the job, location, equipment and duration, referencing the underlying JSA/RAMS.
- Risk verification. Permit issuer checks the referenced risk assessment covers the actual job as described, not a generic template mismatch.
- Isolation and testing. Required isolations are applied and verified; gas tests or other pre-work tests are completed and recorded with a timestamp.
- Authorization and issue. Permit issuer and area authority co-sign, setting the validity window and any special conditions.
- Receipt and briefing. Permit receiver reviews conditions with the work crew on site before tools are picked up, confirming everyone understands the boundaries and emergency arrangements.
- Execution and monitoring. Work proceeds within the stated boundary; periodic checks (gas re-test, isolation check) are logged at the required interval.
- Close-out and handback. Work area is verified safe, isolations are removed in the correct sequence, and the permit is formally closed and archived.
Each stage should have a required data field — permit number, job boundary description, validity start/end, identified energy sources, gas-test interval and result, and named signatories — so an auditor can reconstruct exactly what was verified and when without interviewing anyone.
Isolation, gas testing and supporting certificates
Isolation and gas testing are the two control points most often weakened under time pressure, so they deserve their own verification discipline separate from the general permit signature. Every energy source relevant to the job — electrical, mechanical, hydraulic, pneumatic, gravitational, stored chemical or thermal — should be listed individually on the isolation certificate with its own lock and its own verification step, since isolating the obvious source while missing a secondary feed is a recurring cause of serious incidents. Gas testing needs a stated test sequence (oxygen, then flammability, then toxicity, as applicable), a competent tester whose calibration record is current, and a defined re-test interval if conditions in the space can change during the work. Confirm your site's required gas-test intervals and calibration frequency against your own procedure and equipment manufacturer guidance rather than a generic industry figure.
Group (lock-box) isolation is worth designing deliberately for jobs with multiple trades working under one isolation — a single master lock secures a box containing individual keys, and each worker locks their own personal padlock onto the box before starting, so the master isolation cannot be removed while any individual is still on site. This avoids the common failure of one trade removing an isolation that another trade is still relying on. Where isolation certificates and gas-test logs are paper-based, keep them physically at the job location alongside the permit, not filed separately in an office, so anyone joining the crew mid-shift can verify status without hunting for the record.
Shift handover, suspension and revalidation
A permit that survives a shift change is one of the highest-risk moments in the system, because the incoming issuer and performing authority were not present for the original verification. Handover should require the outgoing and incoming permit issuers to jointly walk the job location, confirm conditions are unchanged, and both sign the handover record — a phone call or a note left on a desk is not an adequate handover for a live isolation or confined space entry.
A permit must be suspended immediately, not merely noted, whenever: the work scope changes beyond what was assessed, weather or process conditions change materially, an alarm or emergency affecting the area is raised, or a gas test result moves outside acceptable range. Revalidation after a suspension requires the same verification steps as original issue — re-checking isolation integrity and re-testing atmosphere — rather than a quick re-signature. A permit that lapses at the end of its stated validity period must be re-issued through the full application step, not extended by initialing the same form.
Permit close-out and return to service
Close-out confirms three things before the area returns to normal operation: the work described on the permit was actually completed as stated, the area is physically clear of tools, materials and temporary barriers, and isolations are removed in a sequence that does not create a new hazard (for example, verifying no one remains in a confined space before ventilation is stopped). The performing authority signs handback first, confirming the work is finished and the crew is clear; the area authority then signs to accept the area back into service. Closed permits should be retained per your document-retention procedure, since they are frequently the first document an auditor or investigator requests after an incident in a permitted area.
PTW audit checklist and KPIs
An audit of the PTW system itself — not just a sample of individual permits — should check for these:
| Audit question | Evidence to request |
|---|---|
| Are permit issuers formally authorized and current in that authorization? | Authorization register, training/competency records |
| Does every sampled permit reference a specific, matching risk assessment? | Cross-reference permit number to JSA/RAMS document |
| Are isolation certificates complete with every energy source listed individually? | Isolation register, lock/tag log |
| Are gas-test results recorded with timestamp, tester name and calibration status? | Gas-test log, calibration certificates |
| Were shift handovers jointly signed by outgoing and incoming issuers? | Handover log |
| Were any permits found active past their stated validity? | Permit register sorted by validity end date |
| Is there evidence of SIMOPS review where multiple permits overlapped in one area? | SIMOPS log, area authority sign-off |
| Are closed permits archived and retrievable within a defined time? | Sample retrieval test during the audit |
Useful leading indicators include percentage of permits with a complete isolation register at issue, percentage of gas tests completed within the required interval, and average time from application to issue (too fast may signal rubber-stamping; consistently very slow may signal workarounds). A lagging indicator worth tracking is the number of permits found suspended-but-not-revalidated during spot checks, since that gap is where real exposure hides.
The most common findings in a PTW audit are not dramatic failures but small, repeated shortcuts: an isolation certificate listing "main power off" without naming every secondary feed, a gas test recorded once at the start of an eight-hour shift with no re-test despite a changing task, a permit receiver's signature collected before the crew was actually briefed, or a closed-out permit missing the area authority's handback signature entirely. None of these individually causes an incident; together, over enough permits, they are exactly the pattern investigators find behind a serious isolation or confined-space event. An audit program that only counts "permit completed / not completed" will miss this pattern — sampling needs to check the quality of what is written in each field, not just whether the field has ink in it.
Use a weighted maturity score to track PTW system health over time rather than a simple pass/fail count, so improvement or drift is visible quarter to quarter. The worksheet below gives a starting structure.
PTW system maturity worksheet. Score each area from 0 (not in place) to 10 (consistently verified with evidence) based on your last audit sample.
This worksheet is a screening aid to structure an internal audit conversation. It does not replace a formal, competent-person-led PTW audit, and results should not be used as a stand-alone measure of statutory compliance.
Paper vs digital PTW
Paper-based PTW remains workable at a single small site with low permit volume and an engaged issuer, but it struggles at multi-site scale: cross-checking simultaneous permits across a large area, enforcing that a gas test was actually completed before a signature, and producing a fast audit trail all get harder as volume grows. A digital PTW workflow can enforce sequence (no issue without a completed and time-stamped gas test), flag overlapping permits automatically for SIMOPS review, and generate the audit-checklist evidence above on demand rather than through a manual file search. The tradeoff is that digital PTW is only as good as its configuration — a poorly configured digital form that lets an issuer skip a mandatory field is no safer than paper, and site connectivity in remote plant areas needs a genuine offline mode, not just a promise of one.
Frequently asked questions
What is a permit to work?
A permit to work is a formal, signed authorization confirming that a specific piece of hazardous work has been risk-assessed, that the required controls (isolation, gas testing, fire watch, etc.) are verified in place, and that named, competent people are accountable for issuing, receiving and closing the work safely.
How long should a permit remain valid?
Validity should be set to the shortest period that reasonably covers the task, typically a single shift, with revalidation required for any extension. Confirm the specific validity period against your own site procedure or client standard rather than assuming a fixed universal duration.
Who can issue and receive permits?
Only formally trained and authorized personnel with current competency records should issue permits; the receiver should be the person accountable for the work crew on site, typically the performing authority or a designated supervisor, who briefs the crew on the permit conditions before work starts.
Is JSA part of PTW?
A job safety analysis is the upstream risk assessment the permit relies on, not a substitute for the permit itself. The permit issuer's role is to verify the referenced JSA actually matches the job being done that day and that its controls are in place, not to re-do the risk assessment from scratch each time.
What makes digital PTW safer?
Digital PTW can enforce sequence and mandatory fields (no permit issue without a recorded, current gas test), automatically flag overlapping permits in the same area for SIMOPS review, and produce a complete, timestamped audit trail instantly — capabilities that are possible on paper only through manual discipline that is harder to sustain at scale.
A permit system is only as strong as its weakest signature. Himaya Prevention designs and audits permit to work procedures — including role definitions, isolation standards and SIMOPS coordination — for Indian and GCC industrial sites; request a PTW system audit to find out where your current process relies on assumption rather than verification.
Where paper-based PTW has outgrown your site's permit volume or multi-site coordination needs, HSEFQ's digital permit to work and isolation workflow module enforces the sequence described above automatically; request a digital PTW demo through HSEFQ.com to see how gas-test gating and SIMOPS flagging work in practice.
0 Comments