- A permit to work is a formal, recorded process for controlling hazardous work and a communication tool between management, operations and the people doing the job, but issuing one does not by itself make the job safe.
- The system is meant for non-routine, higher-risk work such as hot work, breaking containment and confined space entry, and should not be applied to every activity or it loses its value.
- Most permit failures occur at shift handover, where simultaneous permits are not cross-referenced, and where plant is returned to service without a proper close-out.
This article is general guidance and does not replace the legal requirements of the competent authority where you work or the risk assessment for each job.
What is a permit to work system, and what does it not do?
A permit to work is a formal, recorded process used to control work identified as potentially hazardous, and it is also a means of communication between site management, plant supervisors, operators and those doing the work. It can be paper or electronic, authorises named people to carry out specific work at a specific place and time, and sets out the main precautions needed. [1]
HSE guidance stresses two points, though. A permit is not simply permission to carry out a dangerous job, and issuing one does not by itself make the job safe. [1] Nor does it replace risk assessment; it helps put the findings into practice where the risk is present. [2] The guidance also reminds readers of the part permit failures played in the events leading up to the Piper Alpha disaster in 1988. [1]
When is a permit to work needed?
A permit system should be considered whenever the intended work may affect the safety of people, plant or the environment, but it should not be applied to every activity, and it is not normally needed for site visitors or routine maintenance in non-hazardous areas. [1] It is most appropriate in four situations: non-production work, non-routine operations, jobs that need coordination between more than one group, and jobs that are transferred from one group to another. [1]
Work that HSG250 lists as a candidate for additional permits or certificates includes: [1]
- Hot work and any work that may generate sparks.
- Breaking containment of flammable, toxic or pressurised systems.
- High-voltage and other hazardous electrical work.
- Confined space entry.
- Work with hazardous substances, including radioactive materials and explosives.
- Work affecting evacuation, escape or rescue systems, and work at height.
Legal requirements differ between Gulf countries and between emirates. Sharjah’s code of practice OSHJ-CoP-34, issued by the Sharjah Prevention and Safety Authority, for example, sets out the work that needs a permit in the emirate, including hot work, work near hazardous substances and pressure systems, hazardous electrical work, work at height and lifting operations. [4] Check the requirements of the competent authority where you operate, and the site owner’s own system, before designing yours.
Who does what in a permit system?
Clear roles are a basic condition: HSE asks whether it is clear who is in charge and who does what, with no important gaps or overlaps. [2] HSG250 defines the main roles as follows: [1]
| Role | Main responsibility |
|---|---|
| Originator | Requests and describes the job |
| Issuing authority | Issues the permit and verifies isolations and precautions |
| Permit authoriser | Second check before issue for high-hazard work |
| Area authority | Controls the location and coordinates all permits there |
| Isolating authority | Carries out the physical isolations |
| Performing authority | Accepts the permit for the workers and leads the job |
One key rule: nobody issues a permit to themselves. [1] Sharjah’s code likewise requires the permit issuer and receiver to be different people. [4] The issuer is expected to visit the site to check the permit conditions are being met, at least at the start and completion of the task, with further visits depending on the hazard, complexity and duration. [1]
What should a permit contain?
HSG250 lists the essential elements of a permit form, including: [1]
- A reference number, with links to related permits and isolation certificates.
- The job location and precise plant identification, plus a description of the work and its limits.
- Hazards, including residual hazards and those created by the work itself.
- Precautions, emergency actions and protective equipment.
- The issue signature with date, time and duration, followed by the performing authority’s acceptance signature.
- Sections for extension and shift handover, then hand-back and cancellation.
The guidance recommends short, clear wording and quantified limits rather than general phrases, and gives an example of colour coding by permit type. [1] An organisation moving to electronic permits needs protected signatures, no remote issue without a site visit, printed copies for display, training to discourage copy-and-paste, and a backup system. [1] HSE also warns that training during the switch may cover only the software, not the permit process itself. [2]
How is the permit life cycle managed?
- 1Plan and requestDescribe the job and assess its risks
- 2Isolate and prepareComplete and verify before issue
- 3Issue and acceptIssuer signs, then the performing authority
- 4Display and monitorCopy on site, inspection visits
- 5Suspend or hand overWhen work stops or shifts change
- 6Hand back and closeReturn plant to service, cancel permit
Precautions are completed before the permit is issued, not after, including isolation, draining, flushing and environmental monitoring. [3] Once issued, copies are displayed at the work site, in the control room and with the issuer, [1] so everyone can see which equipment is isolated or under maintenance. When the job is finished, the performing authority confirms completion, the issuer confirms the plant is safe and isolations have been removed unless they are cross-referenced to other permits, and the area authority acknowledges that the plant is back under operational control. [1] Before equipment returns to service, the permit originator declares it ready for normal use. [5]
Shift handover, suspension and simultaneous operations
Handover: if work runs into another shift, the incoming team must know which permits are outstanding, their status and the condition of the plant, and HSE recommends that the incoming issuer signs to allow the permit to continue. [1] In Sharjah, the code says a permit should not run beyond one working shift, and any extension needs fresh approval from the issuer. [4]
Suspension: work may be suspended because of an alarm, a wait for spare parts or a change of scope. A suspended permit remains live until it is cancelled, and work does not restart until the issuer has verified it is safe. [1]
Simultaneous operations: work under one permit must not endanger any other activity, so the issuer checks current and planned work, interacting permits are cross-referenced, and shared isolations stay in place until every linked permit is closed. [1]
Hypothetical example: during a planned maintenance shutdown of a process unit, one contractor needs to weld a support near a fuel line while another needs to open a pump on the same line. If the two permits are issued from different offices without a link, fuel could be reintroduced once the pump work ends while welding is still under way. The fix: the area authority sees both permits together, the line isolation certificate is cross-referenced to both, and isolations are removed only after both are closed.
HSE also points to permit overload at the start of a shift, which can lead to non-compliance; the remedy is planning work in advance or adding issuers at peak times. [2]
Where do permit systems usually fail?
HSE material identifies recurring failure patterns: [1, 2, 3]
- The wrong permit type is used, or incorrect work information is recorded.
- Hazards such as flammable substances are not recognised, or ignition sources are brought into classified areas.
- Permit conditions are ignored, such as failing to isolate or drain hazardous lines.
- Plant is not handed back in a safe state when the work ends or the permit is cancelled.
- Unauthorised people carry out permit roles.
- Permits are complex or ambiguous, and end users are not involved in designing them.
HSE notes that failures during the isolation and reinstatement of plant are one of the main causes of loss-of-containment incidents. [2]
How do you monitor and review the system?
- Job and its limits precisely defined
- Task-specific hazards and precautions
- Signatures and times complete
- Linked to related permits and certificates
- Copy displayed at the job
- Isolations in place as described
- Workers know the precautions
- No work outside the permit scope
- Log of live and suspended permits
- Competent issuers on record
- Regular independent audit
- Full review at least every 3 years
The issuing authority keeps permits, certificates and risk assessments on site for at least 30 days after completion and then archives them; supervisors monitor permits day to day; and periodic audits are preferably carried out by competent people from outside the site. [1] HSG250 recommends a full system review at least every three years, involving site and corporate management. [1]
Training is part of the system: it starts at induction, and competence is tested, recorded and retested periodically. [1] Sharjah’s code requires training in a language and format that trainees understand, [4] a critical point on sites with a multilingual workforce.
Conclusion
A successful permit to work system is measured not by the number of permits issued, but by whether everyone on site knows what is isolated, what is allowed and who is responsible. Define which work needs a permit, separate the roles, cross-reference simultaneous permits, and never close a permit until plant is safely back in service.
Frequently asked questions
Does every maintenance job need a permit to work?
No. HSE guidance says permits are not normally needed for routine maintenance in non-hazardous areas, and applying them to every activity weakens their effectiveness. [1]
Can someone issue a permit to themselves?
No. HSE guidance says a person should not issue a permit to themselves, and Sharjah's OSHJ-CoP-34 requires the permit issuer and receiver to be different people. [1, 4]
How long is a permit to work valid?
Each organisation sets this in its own system. In Sharjah, for example, the code says a permit should not exceed one working shift, and any extension needs fresh approval from the permit issuer. [4]
What is the difference between suspending and cancelling a permit?
A suspended permit remains live until cancelled, isolations may still be in place, and work does not restart until the issuer has verified it is safe. A cancelled job is treated as new work when it restarts. [1]
Are electronic permits better than paper ones?
Both are acceptable, but an electronic system needs safeguards such as protected signatures, no remote issue without a site visit, printed copies for display and a backup system. [1]
References
- Health and Safety Executive (HSE). Guidance on permit-to-work systems: A guide for the petroleum, chemical and allied industries (HSG250) (2005)
- Health and Safety Executive (HSE). Why are permit to work systems important?
- Health and Safety Executive (HSE). Permit to Work Systems (COMAH technical measures)
- Sharjah Prevention and Safety Authority (SPSA). OSHJ-CoP-34 Permit to Work for Hazardous Activities (2024)
- Health and Safety Executive (HSE). Permits to work (COSHH basics)
Recommended programmes
