What is a Permit to Work?

A permit to work is a formal, documented authorisation to carry out a specific hazardous task, in a specific place, during a specific window, under conditions agreed in advance. It exists because some jobs are dangerous enough that starting them should require a deliberate act of permission rather than a supervisor saying go ahead.

Almost every industrial organisation has one. Far fewer have one that works, and the failure is remarkably consistent: the permit becomes a form to complete rather than a control that stops work. This guide covers the four types most sites need, why collapsing them into one document is the most common design mistake in the whole discipline, and what separates a permit system that prevents incidents from one that merely documents them.

One form cannot cover four different hazards

Most sites need four permit types, and they have almost nothing in common with each other. What makes each one useful is precisely the part that does not generalise.

Now consider what happens when those four are merged into a single permit form with a generic checklist. The specific prompts disappear. A box labelled safety checks complete does not ask anyone whether the atmosphere was tested, whether the anchor point was verified, or whether the fire watch is still there. The signature is collected, the record exists, and the control that would have prevented the incident was never actually performed.

This is not negligence. It is a predictable consequence of designing for administrative convenience. One form is easier to manage and easier to audit as a count. It is also the reason a permit system can show ninety-eight percent compliance while the specific checks that make each permit type meaningful go unperformed.

A permit that cannot stop the job is a record, not a control

Here is the test that separates the two. If the permit is refused, or expires, or has an outstanding condition — does the work stop?

In most organisations the honest answer is that it depends on whether anyone notices. The permit lives in a safety system. The job lives in a maintenance system. Nothing connects them except a person, and people under schedule pressure are exactly the wrong place to put a safety interlock.

A permit becomes a control when it is attached to the work order it governs, so the job cannot be started or closed while the permit is missing, expired or unapproved. That single structural change converts the permit from documentation into authorisation. It also removes the most uncomfortable conversation in safety management — the one where a supervisor has to physically stop a crew who are already standing there with tools in hand.

Where permit to work systems break

Notice that only the first is a design problem. The other five are lifecycle problems — issue, validity, handover, closure and competency — and they are what a paper or spreadsheet system handles worst, because none of those states has an owner once the form leaves the office.

What a digital permit to work should actually change

Digitising a permit system is often sold as faster approval. That is the least interesting benefit. The changes worth paying for are structural.

Each permit type carries its own signed checklist, so the confined-space form asks about atmosphere and the hot-work form asks about the fire watch after the job. Validity is a property of the permit rather than a date somebody reads, so expiry is enforced instead of noticed. Competency is checked at issue against live certificate status, which catches the contractor whose licence lapsed last month. Closure is a required step with its own verification, so isolation cannot be left in place by omission. And the permit is attached to the work order, so authorisation gates execution.

The audit benefit follows automatically. Instead of retrieving a folder and hoping the right form is in it, the question show me every hot-work permit issued in that area last quarter and who approved each one becomes a query. That is the seventh stage of the safety lifecycle — proving it happened — arriving as a by-product rather than a project.