← All tools

Permit-to-Work Health Check

Twelve questions drawn from the permit and handover failures identified in major accident inquiries. Answer honestly about how the system works in practice — not how it is written. Nothing you enter leaves your browser.

1. Permits are raised and signed at the job, with the people who will do the work present
Permits signed in an office describe an intention, not the plant.
2. Isolations are physically proven at the point of work before the permit is issued
Proving means testing, not reading a record.
3. The permit describes the actual plant state, including any incomplete or suspended work
This is the specific information that was lost before Piper Alpha.
4. Suspended and incomplete permits are formally handed over at every shift change
Handover is a safety-critical activity in its own right.
5. The oncoming shift can reconstruct the true state of the plant from the handover alone
If they have to go and ask, the handover is not doing its job.
6. Live permits are audited at the work face, not reviewed in an office
Office review checks paperwork; field audit checks the control.
7. Field audits include nights, weekends and shutdowns
Supervision is thinnest exactly when risk is highest.
8. People who issue permits are assessed as competent, and reassessed periodically
Authority to issue is a competence, not a job title.
9. Simultaneous or conflicting work in the same area is identified before permits are issued
Interactions between jobs are a common route to harm.
10. Workers can and do refuse to proceed when conditions differ from the permit
A permit system without stop authority is paperwork.
11. Permit close-out confirms the plant has been returned to a safe, known state
Unclosed permits leave the next shift guessing.
12. Departures from the permit system are reported, investigated and acted on
Habitual departure is the failure mode, not the exception.
Permit system score

Frequently asked questions

What is a permit-to-work system?

A permit to work is a formal written system used to control high-risk work such as hot work, confined space entry, work on energised systems and breaking containment. It records the hazards, the isolations and precautions in place, who authorised the work, and the conditions under which it may proceed.

Why do permit-to-work systems fail?

Rarely because the paperwork is wrong. The common failures are systems that are routinely departed from in practice, permits signed away from the job, weak shift handover of incomplete work and suspended permits, and no verification at the work face. The Piper Alpha inquiry found the permit system was inadequate and habitually departed from.

What should a permit-to-work audit check?

Whether the permit reflects the physical state of the plant, whether isolations have been proven at the job, whether the people doing the work understand the precautions, whether suspended and incomplete permits survive shift handover, and whether the permit is closed properly. Auditing permits in an office checks the paperwork; auditing at the work face checks the control.

How often should permits be audited in the field?

Frequently enough that the result is a measure rather than an anecdote, and always including nights, weekends and shutdowns — the periods when supervision is thinnest. Many organisations set a target percentage of live permits verified at the work face each month and report the findings, not just the count.