Permit to work: what it is, when it is required, what it contains

≈ 10 min read · 2,046 words

Picture a maintenance technician who is told in the morning to weld next to a tank. They know the job. What they cannot know is that a solvent transfer is running in the next unit and the ventilation of the sewer is switched off. A permit to work exists to connect those two kinds of knowledge, the worker’s and the plant’s, in one signed sheet (or record) before the work starts. Let’s look at what it is, when it is needed, and what it must contain.

A permit to work (PTW) is the written, time-limited authorization for hazardous work: who may do what, where, for how long and under which conditions. It also records who has accepted responsibility for it. It is not a work order and not a substitute for the risk assessment: it is the point where the plant and the performing party confirm by signature, before the work begins, that the hazards are known and the protection is in place.

Figure 1: the permit-to-work lifecycle. Issuing is not the end: the permit ends with hand-back and close-out.

Who is this for?

plant manager · shift supervisor · maintenance technician and planner · contractor supervisor · HSE specialist · fire-safety and occupational-safety officer.

Learning objectives

After reading this article you will be able to:

explain the difference between a permit to work, a work order and a risk assessment;
list the mandatory content of a permit and the four roles;
tell the permit types apart (general, hot work, confined space, work at height) and know when more than one is needed;
recognize the most common failures that turn a permit into paperwork.

In brief

A permit to work is a signed decision made before the start, not documentation written afterwards.
Four roles stay separate: requester, issuer, performing party, and the person who takes the area back.
A permit is always bound to a time, a place and a job. It expires; an extension is a new decision.
Isolation (LOTO), atmosphere testing and the check of simultaneous work are conditions of the permit, not separate matters.
The law sets general duties (safe work, risk assessment); the permit-to-work system itself is built by the employer’s own rules.

Why does it matter? The stakes

In process plants, hazardous work rarely ends in tragedy because of the technology; far more often it is simultaneous activities that do not know about each other: the welder does not know the line was not flushed, the person entering does not know that the neighbouring tank’s ventilation is down. The permit’s point is therefore connecting information, and only secondarily bureaucracy. Where that is missing, the failure is not the worker’s but the system’s.

What does the law say, and what does it not?

In Hungary, the permit-to-work system is typically built by the employer, starting from general occupational-safety duties. Hungarian Act XCIII of 1993 on occupational safety (Mvt.) states that the employer is responsible for implementing the requirements of safe and healthy work (§ 2 (2)) and must have a risk assessment (§ 54 (2)), carried out before the activity starts and at least every five years (§ 54 (3)). § 43 allows a law to make certain work processes subject to a permit. We did not find a general permit-to-work obligation for all industrial work in the text we reviewed; specific rules come from separate fields (for example fire protection) and from the employer’s internal rules. This article describes Hungarian law as an example; do not read it as a universal rule.

Internationally the benchmark is the permit-to-work system. The UK HSE guidance Guidance on permit to work systems (HSG250) describes in detail what a working system looks like. ISO 45001:2018, clause 8.1, expects operational control: eliminating hazards and reducing risks, with operational processes kept under control. The standard does not prescribe a “permit form”, but a well-run permit-to-work system is one of the most common ways to meet that requirement. Certification is a separate, organization-level question: neither software nor a template makes anyone “ISO 45001 certified”.

When is a permit to work required?

When the hazard of the work is not managed by the plant’s normal protection alone, or when a handover between the plant and the performing party is needed. Typical triggers:

Trigger	Example
Brings an ignition source into a hazardous medium	welding, cutting, grinding, open flame: hot work
Entry into a confined space, tank or pit	tank cleaning, boiler internal repair: entry permit
Requires isolation of energy or material	pump disassembly, opening a line: LOTO
Work at height	scaffolding, work on a roof or structure
Simultaneous work in the same area	several contractors, overlapping activities
External contractor on site	the handover is regulated
Explosive (Ex) zone	spark and temperature limits

The threshold is drawn by the organization’s risk assessment and rules, so write down the reasoning next to the “permit needed / not needed” list (see operational risk assessment).

What must a permit contain?

A permit is like a take-off clearance: it briefly says what is allowed, what to watch, and who is responsible. The common core of international practice and internal rules:

Description and location of the work (unit, equipment, tag);
type of work and main hazard;
validity (start, end, shift boundary, extension rule);
performers and contractor (name or headcount, competence);
isolation and de-energization (what is isolated, where, who locked it);
environmental conditions (atmosphere tests, ventilation, fire protection);
PPE and special precautions;
check of simultaneous work;
emergency arrangements (escape, rescue, notification);
signatures: requester, issuer, acceptor, hand-back, close-out.

The four roles

Role	What they do	Typical failure
Requester	describes the job and needs	“someone just signs it”
Issuer (plant representative)	checks the site, states conditions, issues	the issuer does not visit the site
Performing party	accepts the conditions, signs, complies	the crew does not know the conditions
Taker-back (the plant)	inspects the area, closes	close-out is skipped, isolation is “forgotten”

How does the lifecycle work?

The permit’s path has six stations, each with one person, one signature and one time stamp. Request, risk and condition check, issue, acceptance and site handover, work, hand-back and close-out (see Figure 1). An expired permit does not extend itself: a new decision is needed.

Implementation in practice: do this tomorrow

Mini-scenario for a shift supervisor: take three permits closed last month and check (1) did the issuer visit the site, (2) can the isolation be identified down to the lock or blind, (3) did the close-out really happen at the end of the work. If any is missing, the system, not the person, is the weak point. Take these three to the next HSE meeting.

Common mistakes

Mistake	Why it is a problem	Correct practice
The permit is written after the work	control is missing, only documentation	signature before the start, on site
A generic text that “covers everything”	nobody reads it	conditions tailored to the job, type-specific questions
The permit expires, the work goes on	work without a permit	visible expiry, extension means a new signature
The issuer is also the requester	no second pair of eyes	separate the roles; exceptions only with reason and tracking
Isolation “is done” verbally	no evidence	identified points, verified zero energy

When NOT to use a permit alone?

Situation	Why a permit is not enough	What is needed
Routine, low-risk work	if everything needs a permit, nobody reads it	risk-proportionate threshold, standard work instruction
Design flaw	the permit keeps a faulty system running	management of change, HAZOP
Insufficient competence	a signature does not make anyone skilled	training, competence records
Outdated documentation	the isolation points are wrong	updated P&ID, walkdown
A regulatory permit is required	an internal permit does not replace it	the authority’s permit

Take it home

A permit is a signed decision before the start. Written afterwards, it is only paper.
Keep the four roles separate; do not let the issuer merely sign.
Conditions belong to the job, not the template: isolation, atmosphere, PPE, simultaneous work.
Close-out matters as much as issue.
The law gives the basis; you build the system. Always check the current text.

Self-test

What is the difference between a permit to work and a risk assessment?
Which four roles are separate in a permit, and why is it a problem if the issuer is also the requester?
A permit expires and the work continues the next day. What must happen, and why?

How does this show up in digital practice?

A permit works on paper too, but in software it becomes enforceable and traceable.

Principle	Digital implementation	What it prevents
Signature before the start	a state change allowed only to the authorized user, time-stamped	after-the-fact “filling in”
Separation of roles	the issuer cannot be the requester (per policy)	signing for oneself
Expiry	validity is visible, an expired permit cannot continue	work without a permit
Simultaneous work	overlapping permits in the same area are flagged	activities unaware of each other
Audit trail	every step recorded and checkable afterwards	the unanswered “who decided what, when”
Paper check	the QR code on the printed sheet shows whether it is still valid	an obsolete paper in the pocket

Connection to OPEREX

The OPEREX Permit to Work module handles four main types (general work, hot work, confined space entry, work in an explosive zone). A permit’s path from draft to close-out is recorded as a signature chain (name, time stamp), and scanning the QR code on the printed permit shows, without logging in, whether work may proceed on it now. The plant’s shift log shows the open-permits block. Details: Permit to Work module. The module does not promise legal compliance; it makes the organization’s own rules enforceable and auditable.

Terminology (HU / EN)

Hungarian	English	Note
Munkavégzési engedély	Permit to work (PTW)	the written, time-bound permit
Kiadó	Issuer	plant representative
Végrehajtó	Performing authority / permit receiver	the performing party
Leválasztás	Isolation	see LOTO
Egyidejű munkák	Simultaneous operations (SIMOPS)	overlapping activities

FAQ

What is a permit to work?

The written, time- and place-limited authorization for hazardous work, stating who may do what, where, for how long and under which conditions. The issuer signs it before the start, the performing party accepts it, and it is closed at the end of the work.

Does the law require a permit to work?

Hungarian law sets general duties (safe work, risk assessment) and allows a law to subject certain work processes to a permit. We found no general industrial permit-to-work obligation in the text we reviewed; the system is typically built by the employer. In other countries the answer differs, so always check the current local text.

What is the difference between a permit to work and a work order?

The work order assigns and plans the task. The permit states that the hazards are known and the protection is in place, so the work may start.

Who has to sign?

At least the issuer and the performing party, and at close-out the plant’s representative. Ideally the issuer is not the requester.

Does it replace the risk assessment?

No. The risk assessment decides in advance which hazards and which permit apply; the permit confirms it at the place of work for a given time.

Next step

Hot work permit: the most common type of permit.
Confined space entry permit: the highest-risk type.
Lockout/tagout: the most common condition of a permit.

References / further reading

Mvt.: Hungarian Act XCIII of 1993 on occupational safety, § 2 (2), § 43, § 54 (njt.hu).
ISO 45001:2018: Occupational health and safety management systems, clause 8.1.
HSE (UK): Guidance on permit to work systems (HSG250).
CCPS (AIChE): Guidelines for Risk-Based Process Safety, safe work practices.