A permit to work is a formal, written system of control for work that could kill someone if it starts at the wrong time, in the wrong place, or without specific precautions confirmed first. It is not a risk assessment and it is not a method statement — those describe how work will be done. A permit authorises this task, in this place, during this window, under these confirmed conditions, and it is signed by someone with the authority to say so.
HSE's guidance on permit-to-work systems, HSG250, is the reference the industry works from, and its central point is worth quoting in spirit: issuing a permit does not, by itself, make a job safe. The permit is the mechanism that forces the checks to happen and puts names against them.
When a permit is the right tool
Permits are for high-hazard, non-routine work — the tasks where the danger is not obvious from where you are standing:
- Hot works — grinding, welding, torch work, anywhere sparks meet a building that must not burn. The fire watch after the task ends is half the point of the permit
- Confined spaces — tanks, pits, risers, anywhere atmosphere and escape are the hazards
- Electrical work — proving dead, isolation, and control of who can re-energise
- Excavation — a permit to dig, issued only after buried services have been located and marked
- Work on live systems — fire alarm isolations, sprinkler impairments, pressure tests, gas purging
The common thread: the person doing the task cannot see the whole picture. The welder cannot see what is on the other side of the wall; the digger driver cannot see the cable; the electrician cannot see who else believes that circuit is theirs to switch. The permit exists to connect the people who can.
The roles that make it work
Every permit system runs on two signatures. The issuer — someone with authority over the area, who confirms the conditions are in place before work starts. The receiver — the person doing the work, who accepts the conditions and hands the permit back when the task is done. Between those signatures the permit is a live document with a time limit on it. Closing it out matters as much as issuing it: the fire watch stands down, the isolation is removed, the system goes back to normal — on record, by name.
Where permit systems fail on real sites
From the approving side of the desk, the failures repeat:
- the permit is written after the work has started, as paperwork rather than control
- no time limit, so a Tuesday permit is still "covering" work on Friday
- permits issued by whoever is nearest, rather than someone with authority over the area
- two permits live in the same place that contradict each other — hot works above, gas purge below
- nobody closes anything out, so the file shows twenty open permits and no way of knowing which are real
A permit system does not need to be complicated to work. It needs the right tasks brought inside it, the right names on it, and closure taken as seriously as issue.