Permit to work process flowchart (issue, suspend, hand back)

What the permit to work process flowchart (issue, suspend, hand back) process is

A permit to work is a formal recorded process for controlling work that has been identified as potentially hazardous, and it is as much a communication system as an authorisation one. The trigger is an ordinary work request against a plant item, and the first real decision is whether that request needs a permit at all. The chart below follows one permit from that screening decision through to the archive: the method statement and task risk assessment, the permit type and the precautions written onto it, the area authority's check for clashing work, isolations applied, proved and certified, a second signature where the hazard warrants one, the issuing authority's walk of the worksite before signing, the permit issued with an expiry and displayed where operations can see it, the work itself with its suspension and shift-handover paths, and the hand-back, reinstatement, cancellation and filing that close it out.

This is the generic permit-to-work system, not one hazard's permit. Hot work, confined space entry, working at height, excavation and high-voltage switching each carry their own precautions, their own tests and usually their own certificate, and each deserves a chart of its own; this one is the frame they hang on, which is why the permit type is chosen rather than assumed and why the isolation certificate is drawn as a separate record the permit cross-references. It also stops at the edge of the work itself: the method statement, the lifting plan and the job's own quality checks belong to the maintenance or project process that raised the request, and the register that tracks live and suspended permits sits alongside the chart rather than inside it. Treat the whole diagram as a starting point to be adapted under your own written procedures, the regulations that apply where you operate and a competent person's review. A drawing authorises nothing, and issuing a permit does not by itself make a job safe.

Four decisions carry the process. 'Does the task need a permit to work?' guards the entrance, and it matters in both directions: work that should have been permitted proceeds unprotected, while a permit on every job produces more live permits than anyone can supervise. 'Clash with other work or plant status?' sits in the Area authority lane because that is the only role that can see everything live in a defined area at once, and the failure it exists to catch is one permit's work making another's dangerous. 'Precautions all in place at the worksite?' sits with the Issuing authority and is placed deliberately after preparation and before issue, because a permit signed from the control room has skipped the one check that tests the paperwork against the plant. And 'Conditions, scope or plant status changed?' sits with the Performing authority, who is standing at the job: they see the change first, and the chart gives them a suspend route and a cancel-and-re-plan route rather than a choice between carrying on and abandoning the work.

What this flowchart covers

In this template

• Five swimlanes (Originator / work party, Performing authority, Issuing authority, Isolating authority and Area authority) across six phases: request and screen, plan and specify, isolate and prepare, authorise and issue, work under permit, and hand back and close
• A screening decision at the top, "Does the task need a permit to work?", so the chart carries the judgement most procedures leave unwritten: which work is permit-controlled and which is not, with a "Run the job under normal work control" exit for everything else
• The area authority's "Clash with other work or plant status?" check before anything is prepared, and a "Re-time the job or cross-reference the other permit" loop back into the same decision, because interacting permits and shared isolations are what this role exists to catch
• Isolation as a phase of its own in the isolating authority's lane: apply and lock off, an "Isolation proved and secured?" gate with a re-isolate loop, then a separate "Record isolations on the isolation certificate" record the permit cross-references
• Two-stage authorisation before anyone starts: "High-hazard work needing a second signature?" routes the worst jobs through a permit authoriser, and "Precautions all in place at the worksite?" is answered on site before "Issue the time-limited permit and display copies"
• Live control of an issued permit rather than a filed one: "Conditions, scope or plant status changed?" offers suspend, cancel and re-plan or carry on, "Work finished within the permit validity?" forces a signed shift handover with a new expiry, and hand-back runs through reinstatement to cancellation

When to use this template

• You are writing or rewriting a permit-to-work procedure and need one picture of who screens, who isolates, who issues and who accepts the plant back
• Permits are being signed in the office rather than at the job, and you want the worksite check drawn as a gate the permit cannot pass without
• Your permit register carries jobs suspended for weeks and nobody is confident which of their isolations are still in force
• Work regularly runs past the permit expiry and is waved on verbally, so the shift handover and the new expiry need to be explicit and owned
• An auditor, insurer or regulator has asked how hazardous work is authorised, controlled and closed, and the answer currently lives in several people's heads

How it works

1. Rename the lanes to your roles

   Replace Originator / work party, Performing authority, Issuing authority, Isolating authority and Area authority with the titles your procedure uses: responsible person, authorised person, work leader, area operator. On a small site one person often holds several of these, so merge lanes rather than drawing a handoff that never happens. Keep one rule intact whatever you merge: the person who requests the work does not issue the permit for it.

2. Write down which work needs a permit

   The screening decision is only as good as the list behind it. Name the work types that are permit-controlled on your site, such as breaking containment, hot work, confined space entry, excavation, high-voltage switching or roof access, and say what runs under normal work control instead. Publish the list next to the procedure; a rule that lives in the issuer's judgement produces a different answer on every shift.

3. Set your permit types and their certificates

   Expand 'Select the permit type and specify the precautions' into the types you actually issue and the certificates that hang off them: isolation, atmospheric test, excavation, electrical. State which combinations have to be cross-referenced, because a job running under two permits with one shared isolation is where these systems usually fail, and say who is competent to carry out any test the permit calls for.

4. Decide what makes a job high hazard

   'High-hazard work needing a second signature?' needs a written rule rather than a feeling. Name the tasks, substances, pressures, energies or areas that pull in a permit authoriser, and name who may hold that role and who deputises when they are off site. Then decide how many signatures the permit really needs: a signature that adds nothing to the safety of the work teaches people to sign without reading.

5. State the permit validity and the handover rule

   Decide how long a permit may run before it expires, whether it may cross a shift at all, and who signs to continue it. Put the number on the box rather than in a policy nobody has open at the job. Then write what the incoming issuing authority has to re-check before signing, and where live and suspended permits are recorded so the oncoming shift can see them without asking.

6. Agree what suspension means on your site

   A suspended permit is normally still live, which means its isolations are still applied and the plant is still out of service. Decide who may suspend, what has to be re-verified before work restarts, how long a permit may stay suspended before it is cancelled and the job treated as new work, and where suspended permits are held so they are reviewed rather than quietly forgotten.

7. Walk it against real permits

   Take a handful of closed permits, one straightforward, one that was suspended and one that ran over a shift, and trace each through the chart with the people who actually signed them. Steps that people describe but the chart does not draw, and steps the chart draws but nobody performs, are the findings worth acting on before you publish it as your procedure.

Frequently asked questions

What are the steps in a permit to work process?

A work request is raised and screened; work needing no permit proceeds under normal work control. The performing authority writes the method statement and risk assessment, the issuing authority selects the permit type and precautions, and the area authority checks for clashing work and re-times or cross-references it. The isolating authority applies and proves the isolations and records them on an isolation certificate. High-hazard work takes a permit authoriser's second signature. The issuing authority then walks the worksite and issues a time-limited permit, displayed at the job and in the control room. The performing authority accepts it, briefs the permit users and works, suspending if conditions change and signing a shift handover with a new expiry if it runs on. Finally the work is handed back, isolations removed, the plant tested and accepted, and the permit cancelled and filed.

What is the difference between a permit to work and a risk assessment?

They answer different questions and neither replaces the other. The task risk assessment identifies the hazards of a particular job and decides the controls, including whether the job needs a permit at all. The permit is the authorisation: it names a specific job, at a specific place, for a specific period, records the precautions and isolations that must be in place, and carries the signatures of the people who checked them. A method statement sits between the two and describes how the work will actually be done. The order matters, because a permit written before the assessment records controls nobody has thought about. It is worth stating plainly in the procedure that issuing a permit does not by itself make a job safe: that comes from the people preparing, supervising and doing the work.

Who issues a permit to work, and who accepts it?

HSE guidance for the petroleum, chemical and allied industries (HSG250) suggests a harmonised set of role titles that this chart follows. The originator is the person requiring the job. The issuing authority issues the permit, having satisfied themselves that the isolations and precautions are in place. The performing authority accepts it on behalf of the permit users and is in charge of the work. The area authority controls the location and knows what else is happening there. The isolating authority makes the isolations, and where the hazard is particularly high a permit authoriser reviews the permit before issue. A site checker carries out any testing the permit calls for. On a small site one person may hold several of these roles at once, and the guidance says so, but nobody should issue a permit to themselves.

What happens when a permit is suspended or runs past its expiry?

Suspension covers a job that is stopped for a period before it is finished, for a general alarm, a change of scope, missing spares or a conflict with other work. The important point is that a suspended permit normally remains live until it is cancelled, so its isolations are still in force and the plant is still out of service. Suspended permits therefore belong on the permit register and need reviewing, because a permit suspended for weeks is a hazard on its own. If the job runs past its expiry, the chart routes it through a shift handover: the incoming issuing authority re-checks the site, the oncoming permit users are briefed on the hazards and precautions, a new expiry is set and the permit is signed to continue. Where suspension has changed the job substantially, the cleaner option is to cancel the permit and treat the restarted work as new.

Is a permit to work a legal requirement?

It depends on the jurisdiction and the work. For most sites the duty is to provide a safe system of work, of which a permit is one recognised means. In Great Britain the Confined Spaces Regulations 1997 require work in a confined space to be carried out under a safe system of work, and HSE's HSG250 is the recognised good-practice guidance on permit-to-work systems for the petroleum, chemical and allied industries. In the United States, OSHA requires a written entry permit for permit-required confined spaces under 29 CFR 1910.146 and documented energy control procedures for lockout/tagout under 29 CFR 1910.147, while its welding and cutting rules call for the area to be inspected and precautions authorised, preferably in the form of a written permit. Check what applies where you operate and have a competent person confirm your procedure meets it; a template cannot do that for you.