Permit to Work (PTW): A Complete Guide

Ask ten maintenance and facilities teams what a permit to work is and most will describe a piece of paper. Ask what it does and the answers get vaguer: it makes the job safe, it covers us, it is what the client requires. The gap between those answers and the real one is where permit systems go wrong. A permit to work is a formal, documented authorisation that a specific piece of work may proceed, at a specific place, at a specific time, under specified conditions, granted by somebody who has both the knowledge and the authority to grant it. Everything useful about permit systems follows from taking that sentence seriously, and almost everything that fails about them follows from treating the document as the safety measure.

The message up front: a permit is a communication and authorisation control, not a physical one. It does not isolate anything, guard anything, ventilate anything or extinguish anything. What it does is make certain that the right people have agreed what must be true before work starts, that those conditions have actually been put in place, and that everybody affected knows the work is happening. The most damaging misunderstanding in permit systems is treating the signature as the protection.

1. What a permit to work actually is

Strip away the forms and the sign-off boxes and a permit to work is an agreement, recorded in writing, between a person who controls a plant, system or area and a person who wants to carry out work on or near it. The agreement says: this particular work, in this particular place, may go ahead between these times, provided these conditions are in force, within these limits, by these people. The written record exists because memory, corridor conversations and radio calls are not reliable enough to carry that agreement across shifts, trades and contractors.

Three words do the heavy lifting. Formal means the process is defined in advance rather than negotiated case by case, so everyone knows who decides what. Documented means the agreement survives the conversation that created it. Authorisation means somebody with the standing to say no has said yes, on stated conditions, and has accepted responsibility for having checked them.

The paperwork is the evidence of a control, in the same way that a calibration certificate is evidence that an instrument was calibrated. Nobody thinks the certificate calibrated the instrument. Plenty of organisations behave as though the permit made the job safe.

2. Why permit systems exist at all

Most workplace hazards come from the task. You are working with a rotating tool, so you guard it and train the operator. You are handling a chemical, so you assess the substance and control the exposure. That style of hazard is well served by a risk assessment, a method statement and competent supervision, and it does not need a permit.

Permit systems exist for a different category of hazard: the hazard that comes from interaction rather than from the task alone. Somebody else's work in the same space. A system that is still live, or that somebody else can make live. An adjacent operation that changes the atmosphere or the energy state around you. A shared route, roof or electrical supply. A contractor who is highly competent at their trade and knows nothing about your plant. In every one of those cases the work itself may be routine, and the danger comes from what else is true at the same time.

That is why permits are concentrated in complex, multi-party, high-hazard environments: process plant, utilities, oil and gas, hospitals, data centres, airports and large campuses. A permit is fundamentally a coordination control. It forces a conversation between the people who know the work and the people who know the plant, and records the outcome so that a third party arriving on a later shift can tell what was agreed.

Read that way, the permit answers a question no risk assessment of the task can answer on its own: given everything else happening on this site right now, may this work proceed, and what must be true first? Understand permits as the control for interaction hazards and the rest of the system, the roles, the isolations, the time limits, the handback, stops looking like bureaucracy.

3. When a permit is appropriate, and when it is not

This deserves more honesty than it usually gets, because over-permitting is a real failure mode and it is badly under-discussed. The instinctive response to a safety incident is to widen the permit net. The instinctive response to an audit finding is to widen it again. Nobody is ever criticised for requiring a permit, so the scope ratchets in one direction only.

The consequences are predictable. If everything needs a permit, permits become a clerical ritual. The authorising person becomes a bottleneck, and because they are a bottleneck they start processing rather than assessing. Technicians learn that the permit is the thing standing between them and the job, so it becomes an obstacle to be cleared rather than a briefing to be understood. Worst of all, the discrimination that made the system valuable is lost: when every job carries a permit, the permit stops signalling "this one is different, pay attention".

The opposite failure is just as real. Under-permitting leaves genuine interaction hazards uncontrolled, usually because a job looked small. A ten minute task on a live system, a quick look inside a tank, one person on a roof for a single measurement: the duration of the work has very little to do with the severity of the interaction.

The test is the nature of the hazard and the interaction, not the size of the job. Useful questions: does the work require a system to be made safe by somebody other than the person doing it? Could it introduce a hazard to people who are not part of it? Does it depend on a condition that could change while it is underway, such as an isolation, an atmosphere, or the state of an adjacent plant? Is the person working relying on a state of the plant they cannot themselves verify? If several answers are yes, a permit is doing real work. If they are all no, a risk assessment, a method statement and competent supervision are the right level of control, and a permit adds paper rather than safety.

Where that line falls is a decision for the competent person designing the scheme, and it should be deliberate, documented and reviewed rather than an accumulation of additions nobody ever removes. The single most valuable permit system review is the one that asks what can safely come out of scope, and it is almost never the review that gets commissioned.

4. The roles, and why separation matters

A permit system is a set of relationships between defined roles. Titles vary by site and sector, and the labels below are generic descriptions rather than any particular scheme's terminology, but the functions are consistent.

The essential principles are worth stating before the detail. First, the person authorising the work must have the knowledge to know what conditions are needed and the authority to impose them, and must be a different person from the one carrying out the work. Self-authorisation removes the independent check that is the entire point of the control. Second, the person accepting the permit must actually understand what they are accepting, not merely sign for it. Third, competence and authorisation must be defined and recorded rather than assumed. "Everyone knows the shift engineer signs permits" is not an authorisation scheme.

Contractors are where role separation is most often blurred. A contractor's supervisor can reasonably act as the accepting person and the person in charge of the work. A contractor should not be authorising work on a client's plant unless the client has formally delegated that authority with a defined competence scheme behind it, because the authorising role requires knowledge of the plant and of concurrent activity that a visiting party usually does not have.

5. The lifecycle, explained by purpose

The stages below are the logic of a permit, not the layout of a document. Each stage exists to settle something that the next stage depends on, which is why skipping one tends to surface as a problem two stages later.

• Identify and assess the work. Establish what is actually going to be done, where, and what hazards arise both from the task and from its interaction with the plant and with other activity. This is where the risk assessment and method statement feed in. If this stage is vague, everything downstream is decoration.
• Define the precautions and conditions. Decide what must be true before and during the work: what must be isolated, drained, depressurised, purged, tested, barriered, covered or stood down. These are the substance of the permit. The isolations in particular are physical controls that the permit records and depends on, not controls the permit provides.
• Authorise. The issuing person satisfies themselves that the conditions are appropriate and in place, then authorises the work within stated limits. Authorisation is an act of verification, not of administration.
• Accept and brief. The person in charge of the work accepts the conditions and limits on behalf of the work party and briefs the people who will actually do the job. A permit that has been accepted but not briefed is a permit that exists only for the auditor.
• Display where it governs the work. The permit is kept at the place it applies to, so that anybody arriving, a supervisor, another trade, an emergency responder, can see what has been authorised and what limits apply. A permit filed in an office governs nothing.
• Carry out the work within scope and time. The work stays inside what was authorised. If the scope, the method, the people or the conditions change, the permit no longer describes reality and the work should stop and go back to the issuer.
• Hand back. The most neglected stage, and the one I would put most effort into. Handback confirms that the work is either complete or has been left in a safe, defined suspended state; that the site is clear of tools, debris and people; that temporary measures such as blanks, blinds, covers, bypasses and barriers have been removed or are deliberately retained and recorded; and that the plant or system is fit to be returned to service. Handback is a verification step performed by somebody who checks, not a signature collected at the end of the shift.
• Cancel and retain the record. The permit is formally closed so it cannot be reused or mistaken for live authorisation, and the record is retained. The retained record is what lets you investigate an incident, review whether the scheme is working, and see how permits are actually being used rather than how the procedure says they are.

Two stages carry disproportionate weight. Briefing, because it is where the permit turns from an agreement between two managers into knowledge held by the people at risk. And handback, because it is where a hazard created by the work gets left behind for somebody else to discover.

6. What a permit must actually settle

A permit works when it removes ambiguity about a specific set of questions. Below are those questions and, more importantly, why each one matters. This is deliberately not a form layout: how they are recorded, in what order, on what medium, and with what wording is part of the scheme design for your own site.

• What work. Described precisely enough that a reader can tell whether what they are watching is the permitted work. "Maintenance on pump" settles nothing; the description must make scope creep visible.
• Where exactly. A specific location and a specific item, identified the way the site identifies things, so that nobody isolates or opens the neighbouring unit. This is where a clean asset register pays for itself.
• What hazards. The hazards that the conditions are there to control, stated explicitly, so that the work party understands what they are being protected from rather than only what they are being told to do.
• What precautions and isolations. Specific, verifiable measures. Specificity here is the single strongest predictor of whether a permit system is real, for reasons covered in the failure section below.
• What the limits are. What the permit does not authorise. Limits are what make scope creep a breach rather than a judgement call.
• Who may do the work. Named people or a defined competent party, so that authorisation is tied to competence rather than to whoever turns up.
• What time window applies. A defined validity, so that the permit expires rather than drifting. The appropriate duration is a matter for the scheme designer and the hazard, and is not something an article can set for you.
• Who to contact, and what to do if conditions change. Because the whole system depends on the work party being able and willing to stop and escalate.

7. The main permit types, in a sentence each

Most schemes define several permit types so that the conditions can be tailored to a class of hazard. The catalogue varies considerably by site and sector, and the names vary more than the substance. For the full breakdown, see the dedicated guide to types of permit to work.

Two observations about the catalogue. Types should exist because a class of hazard genuinely needs different conditions, not because a new form felt like a response to an incident. And a single job often needs more than one type at once, which is precisely the situation in which somebody must hold the overall picture.

8. How permits relate to the rest of the safety system

A permit is not a standalone document and it is not a substitute for anything else. It sits at a junction between several other controls, and each of those relationships is worth being precise about.

• Risk assessment and method statement feed the permit. The assessment identifies the hazards and the method describes how the work will be done. The permit then authorises that work at a place and time under conditions. The permit does not replace either of them. See the risk assessment guide and the RAMS guide.
• Isolation and energy control are conditions inside the permit. Lockout tagout is a physical control on the energy source; the permit records that it is required and confirms it is in place. They are complementary rather than alternatives, which is a common enough confusion to deserve its own comparison: see LOTO versus permit to work.
• Toolbox talks brief the permit. The talk is where the conditions and limits become knowledge held by the crew rather than text on a form. See the toolbox talk guide.
• The permit scheme sits inside the wider management system. It is one element of how an organisation controls operational risk, alongside competence management, contractor management, emergency arrangements and incident investigation. For the wider frame, see what HSE means in practice.

9. Where permits come from in law and guidance

Permit to work is a widely used industry practice shaped by sector convention and regulator guidance. It is not a single global legal scheme, and it is not established by any international standard I am aware of. In some jurisdictions, though, specific permit requirements are codified for specific hazards, so the correct answer is always jurisdictional.

• United States (federal). 29 CFR 1910.146, "Permit-required confined spaces", codifies a permit requirement for confined space entry in general industry. Its scope excludes construction, agriculture and shipyards; construction is covered separately by 29 CFR 1926 Subpart AA, "Confined Spaces in Construction", at sections 1926.1201 to 1926.1213. 29 CFR 1910.147, "The control of hazardous energy (lockout/tagout)", governs energy control in general industry. Note also that many US states operate their own OSHA-approved plans, whose requirements can differ from the federal text, so the applicable rule depends on where the work is.
• Great Britain. There is no single permit to work regulation. The duties arise under general health and safety legislation, principally the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999 (SI 1999/3242), whose risk assessment duty sits at Regulation 3, with hazard-specific instruments on top, for example the Confined Spaces Regulations 1997 (SI 1997/1713) and its Approved Code of Practice L101, "Safe work in confined spaces", 3rd edition, December 2014. Note that Northern Ireland has separate instruments with different years, and the confined spaces instrument there dates from 1999. The most widely cited permit reference is HSE guidance HSG250, "Guidance on permit-to-work systems: A guide for the petroleum, chemical and allied industries", 2005, available free. It is guidance rather than law, it creates no duties itself, and it was written for the process industries and largely around paper systems, which is worth remembering before lifting it wholesale into a facilities context.
• Management system standards. ISO 45001:2018, "Occupational health and safety management systems", as amended by Amd 1:2024, is certifiable and requires the hierarchy of controls at clause 8.1.2, which is where a permit's place as an administrative control comes from. ANSI/ASSP Z10.0-2019 requires the same hierarchy at section 8.4 in the US. Neither standard is law anywhere by itself; they bind through certification and contract.
• Sector documents. For hot work specifically, the relevant US private-sector document is NFPA 51B, "Standard for Fire Prevention During Welding, Cutting, and Other Hot Work", current 2024 edition. NFPA documents are not law by themselves, adoption is edition-specific, and the requirements that apply to you are those in the edition your authority having jurisdiction has adopted.
• United Arab Emirates, as a worked example of why jurisdiction matters. US OSHA rules and UK HSE law have no legal force in the UAE. The binding law for the private sector is Federal Decree-Law No. 33 of 2021 on the Regulation of Employment Relationships, administered by MOHRE, with occupational safety and health duties in Article 13, applying including free zones but excepting DIFC and ADGM. In Abu Dhabi the applicable framework is ADOSH-SF, the Abu Dhabi Occupational Safety and Health System Framework, Version 4.0, administered by the Abu Dhabi Public Health Centre; "EHSMS" and "OSHAD" are legacy names for it. ISO 45001 is the usual international reference layered on top.

The practical consequence is that you cannot design a permit scheme from an article or another site's folder. You establish which instruments bind the work, in which jurisdiction and sector, and the scheme is built against those. Primary sources are worth going to directly: osha.gov , hse.gov.uk and iso.org .

10. How permit systems fail

Permit systems rarely fail by being absent. They fail while fully operational, fully documented and passing audits. The pattern is almost always the same: the paperwork continues and the thinking behind it stops.

• Generic conditions. "Isolate as necessary." "Use appropriate PPE." "Ensure area is safe." These look like conditions and are actually an abdication: they transfer the decision back to the person least able to make it, usually the technician standing in front of the job with no knowledge of the wider plant. A condition that does not name the isolation, the test or the measure has decided nothing. This is the single most reliable tell of a permit system that has become clerical.
• Remote issue. Permits issued from an office by somebody who has not seen the job, the location or the state of the plant. The signature then certifies an assumption rather than a verification. Digital systems make this easier to do and easier to hide, which is a reason to be careful with them rather than a reason to avoid them.
• Scope creep. The work that happens is not the work permitted. The job opened up, a second fault was found, a nearby item was "done at the same time". Every one of those is a normal, well-intentioned decision, and each of them puts work outside the conditions that were assessed.
• Expiry overrun and rolling renewal. Work continuing past the permit's validity, or a permit renewed as an administrative act without anybody re-checking whether the conditions still hold. A renewal that does not re-verify is a renewal of the paperwork only.
• Handback treated as filing. Covered above, and worth repeating because it is where hazards get left behind for somebody who never saw the permit.
• Shift change discontinuity. The knowledge held by the issuing person does not transfer at the end of the shift. The incoming person inherits a live permit, a set of conditions they did not set, and no first-hand picture of why they were set that way.
• Multiple permits on interacting systems. Each permit is individually sound and nobody holds the overall picture. Two crews, each properly authorised, working on systems that affect each other, is one of the most dangerous situations a permit system can produce, and it is produced by good compliance rather than by rule breaking.
• Contractor permits issued on trust. A permit granted because the contractor is reputable and busy, rather than because the conditions were verified. Contractor competence at the trade is not knowledge of your plant, and that gap is exactly what the permit was supposed to bridge.
• Volume collapse. The issuer signs a stack in the morning because the alternative is stopping the day's work. At that point the control has inverted: the permit is now a production enabler, and the assessment it was created to force has quietly been removed. Over-permitting is usually what created the stack.
• The cultural tell. The clearest indicator that a permit system is genuinely working is that people are willing to stop work and go back to the issuer when conditions change. If that happens routinely and without friction, the system is alive. If it never happens, the permits are being processed rather than used, whatever the audit score says.

11. Permits in maintenance management and software

Most maintenance organisations eventually want the permit to live alongside the work rather than in a separate folder, and there is genuine value there. Conditions and required permit types can be attached to the work order so the requirement is visible at planning rather than discovered at the asset. Isolation points and hazard information can sit on the asset record. Retained permit records become searchable, which makes reviewing how the scheme is actually used far easier than it is with paper. Any competent CMMS or CAFM product can do some version of this, and the mechanics are covered in the dedicated guide to permit to work integration with a CMMS, with the surrounding work order structure in work order types and the wider operating context in facilities maintenance management.

The honest point, and the reason I keep this section short: digitising a bad permit system just makes bad permits faster. Software cannot supply the knowledge the issuer lacks, cannot verify a condition nobody checked, and cannot brief a crew that was never assembled. It can make remote issue frictionless and mass approval a single tap, which makes two of the failure modes above easier rather than harder. Fix the scheme first, then automate the record keeping. The sequence matters more than the platform.

The idea to walk away with

A permit to work is a formal authorisation that specific work may proceed, at a specific place and time, under specified conditions, granted by somebody with the knowledge and authority to grant it. It is a communication and authorisation control for hazards that arise from interaction rather than from the task, and it makes nothing physically safe by itself. Its value comes from the quality of the assessment behind it, the specificity of its conditions, the understanding of the people who accepted it, and the rigour of the handback that closes it.

Which means the health of a permit system is not measured by how many permits you issue or how complete the forms are. It is measured by whether the conditions on them are specific, whether the people doing the work can explain what they are protected from, whether handback is a check rather than a signature, and whether anybody has stopped a job this month and gone back to the issuer. Those four questions will tell you more in an afternoon than an audit will.

Final thoughts

The instinct with permits is always to add: another type, another signature, another form. The discipline that actually improves a permit system usually goes the other way. Narrow the scope to the work where interaction hazards genuinely exist, so that a permit means something again. Make the conditions specific enough that they decide something. Make sure the issuer has seen the job and can say no. Make handback a physical verification. Then keep the number of live permits low enough that a human being can hold the interaction picture across them.

And design the scheme for your site, not from a document. What an article like this can usefully give you is the reasoning: what the control is for, why the roles are separated, why the lifecycle has the shape it has, and what it looks like when the paperwork continues but the control has quietly stopped.

Related reading: Types of permit to work, LOTO versus permit to work, Confined space permits, Hot work permits, RAMS explained, PTW integration with CMMS.