A permit to work (PTW) is a formal, written system for controlling high-risk work: hot work, confined space entry, work on live or isolated electrical systems, work at height, breaking into pressurised lines. Its job is simple to state and hard to do well: make sure the hazards are identified, the controls are in place, the right people have agreed, and the job is handed back safely when it's done.
Most permit failures aren't failures of the form. They're failures of sequence and accountability: work starting before isolation was confirmed, a permit closed without anyone checking the area, two permits overlapping on the same equipment without anyone noticing. Treating the permit as a process, with steps that genuinely depend on each other, is what fixes that.
The permit to work process, step by step
1. Request. The person who needs the work done describes the job, the equipment, the location and the planned time window.
2. Hazard assessment. A competent person reviews the task and records the hazards and the controls required, often referencing a job safety analysis or risk assessment.
3. Isolation and preparation. The equipment is isolated (electrical, mechanical, process), drained or purged where needed, and gas tested if the work requires it. Each isolation is recorded.
4. Authorisation. The permit issuer, someone with authority over the area, confirms the controls are in place and issues the permit. The performing authority accepts it.
5. Work execution. Work proceeds within the permit's scope and time limit. Any change in scope stops the job and goes back to step 2.
6. Hand-back and close-out. The performing authority confirms the work is complete and the area is safe; the issuer inspects, removes isolations in the right order and closes the permit.
Where permit systems usually break
The common gaps are almost always in the handoffs. Isolation recorded on paper in one place while the permit sits somewhere else. A permit authorised verbally because the issuer was on another part of the site. Close-out signed at the end of a shift by whoever was still there. None of these show up until something goes wrong.
Two design rules prevent most of them. First, a step can't open until the step before it is signed off by its owner, so authorisation genuinely waits for isolation. Second, the sign-off itself carries evidence: a photo of the lock and tag, the gas test reading, a timestamp and, for field work, a location.
Making the permit traceable
When the permit is modelled as a process, each step has one named owner and a target time, and the record of who signed what, and when, builds itself. Isolation and gas testing can run in parallel and must both be complete before authorisation opens. Anything that runs past its target is flagged automatically instead of waiting for someone to notice.
That record is what an incident investigation, an audit or a regulator will ask for. It's far easier to produce when it was captured at the moment of work rather than reconstructed afterwards.
Check your local requirements
Permit requirements vary by country and industry. In the UK, the HSE's guidance on permit-to-work systems (HSG250) is a widely used reference; oil and gas, chemicals and utilities often have sector-specific rules on top. Use this structure as a starting point and align it with the standards that apply to your site.