Permit to work (PTW) shaped to your rules — optionally starting with an upfront risk assessment
Non-routine work — maintenance, repairs, interventions on a running plant — is among the most dangerous situations in occupational safety: the place, the medium and the crew differ every time. In OPEREX the organisation assembles its permitting process from its own rules, around a fixed core that cannot be relaxed. One possible process starts with an optional upfront risk assessment, switched on by policy, which proposes and pre-fills the permits according to the organisation’s rule set.
In short
- The form, its conditional logic, the checkpoints, the required signatures and how strict they are can be configured per organisation, site and permit type — the 12-state lifecycle and the hash-chained signature chain are the fixed core.
- Optionally, switched on by policy, the process starts with an upfront risk assessment: following the organisation’s editable rule set, it states which permit(s) are needed and, once approved, creates pre-filled permit drafts.
- Every step is a signature in the chain — so permitting non-routine work is a provably audited process, afterwards too.
- Ten built-in templates, including hot work, confined space, ATEX and combined — all can be copied and edited; the printed permit aims for as few sheets as possible.
Why is non-routine work the riskiest?
Routine tasks settle into practice: the same place, the same sequence, the same crew. Maintenance and repair are different: a different asset, a different medium, a different environment every time — often with a contractor working in the middle of a running plant. The risk lies in the change.
That is why a permit to work is not a form but a checkpoint: under the organisation’s rules, work can start only once the conditions are met, and every step has a name on it. In OPEREX every step — request, issue, acceptance, suspension, extension, closure — is a signature in a chain, so the process is provably audited, afterwards too.
The risk assessment, the permit, the isolations and the maintenance work order live in one system — the integrated safe system of work (ISSOW) approach, not four separate papers.
How can you prove a signed permit was not altered? →A fixed core — everything else belongs to the organisation
The process is built in layers. At the bottom is the core: only the code changes it, so configuration can never undermine safety and provability. Everything above it is the organisation’s decision.
- the question set of the upfront risk assessment
- “if this, then that” rules: permit type, required and recommended item, condition, prep task, headcount
- checkpoints at off / warn / block
- which steps and signatures are required — acceptance, on-site handover, two-sided hand-back, four eyes — and where a reason is needed
- three profiles: “Lenient”, “OPEREX recommended”, “Strict” — loosening the recommended one asks for a justification
- printing settings
- questions that open blocks · blocks and fields · rules
- validity, minimum workers and watchers
- competence, certificates, gas testing, prep tasks
- 12-state lifecycle with conflict-safe transitions
- signature chain · expiry · no work without a live time window
- log link · paper fallback
The permit records the isolation points — blind flange, lockout/tagout (LOTO), valve closure, electrical isolation, draining and depressurising —, the certificates and the gas tests; the template and the policy define what is mandatory.
Additional steps that can be switched on: production-lead countersignature, worker acknowledgement, a last-minute on-site risk assessment (LMRA) before activation, and a different person for the hand-back.
Signature roles extend the signature block of the printed permit; the lifecycle steps and their order are the same in every organisation.
One possible process: starting with an upfront risk assessment
An optional “step 0”, switched on by policy — per organisation or site, as a warning or a block: before the work, a standalone, numbered risk assessment is made, and the process starts from it.
- 1Question set and step table
The assessor answers the organisation’s question set and analyses the steps of the job.
- 2A proposal by the rules
Following the rule set, the system states which permit(s) are needed, which items are required or recommended, and which conditions and prep tasks come with them.
- 3Approval
At approval the content is frozen: from then on the assessment cannot be changed, and it gets a digital fingerprint.
- 4Pre-filled permits
From the approved assessment, permit draft(s) are created in one step — separate or combined, as the organisation has set it — pre-filled.
- 5Issue
A prescribed item can only be removed with a written reason; the reason is recorded by name in the audit trail and on the printed permit, and without it issuing is blocked.
- 6Work and closure
From there it is the usual lifecycle: acceptance, the daily cycle, hand-back, closure — every step a signature in the chain.
The upfront risk assessment is not the same as the last-minute, on-site risk assessment (LMRA), which is made on site before the work is activated. The two complement each other.
Who makes the upfront risk assessment?
Whether it is the client’s own safety professional or the contractor’s is the organisation’s decision: the assessment can be prepared and approved by whoever the organisation has given an account and the right to do so. Optionally, by policy, it can be required — as a warning or a block — that the approver is recorded in the people register with a valid occupational-safety qualification; the “Strict” profile blocks. With a warning, the approver writes a reason, which is recorded.
What it pre-fills — and what it does not
Pre-filling follows the organisation’s rule set; it does not guess.
- title, site, plant, location, work orderfilled in
- permit-type markersset, if the template knows them
- gate questions“yes” — the linked blocks open
- required itemslocked: removable only with a written reason
- recommended itemsticked, freely removable
- conditionswritten in
- prep tasks, minimum workers and watchersset
- declarationsmade mandatory — a person gives the answer
The system never fills anything in from earlier jobs on its own. If someone copies an earlier assessment, the copy warns that the answers must be checked against the site.
The whole process in one diagram
Six lanes, four phases, all 12 states — with the upfront risk assessment at the top. If the organisation does not switch it on, the process starts with the draft and the rest is unchanged.
The diagram is wide — scroll sideways.
Who is responsible
Every transition is signed by the role in whose lane it sits. By default issuer ≠ requester, enforced by the system; single-person issue is a reasoned exception.
What is optional
The maintenance (CMMS), shift diary and assessor lanes are optional; countersignature, acceptance and hand-back are policy switches. The core is complete standalone too.
What the system does
Expiry and the automatic day close are set by a scheduled process — no signature, but an audit trail. An expired permit can be extended or closed.
The diagram shows the main path. Hand-back can also start from work in progress or from expiry; a permit can be cancelled at any point until activation.
Permit templates: ten built-in bases, shaped to the organisation
Built-in templates provide structure, never filled-in values. The organisation copies, renames and edits them (every save is a new version), ties them to a site, and switches them on and off; the built-in copy stays as a reference and can be refreshed from the built-in set.
- General work permit
- Hot work permit
- Confined space entry permit
- Electrical work permit
- Excavation work permit
- Crane / lifting permit
- Structural modification permit
- Pre-job quick risk assessment (LMRA)
- Combined work permit
- ATEX — work in an explosive atmosphere zone
Vehicle entry is not a separate template but a question-opened block in the combined and the ATEX template. For complex work that handles several hazards together, the combined permit is the one to use.
Less paper: the printed permit belongs to the organisation too
Paper is still needed on site — but the number of sheets matters.
- Three views: Compact (the authoritative copy, always available), Spacious and Landscape. The organisation decides which is the default and which additional views are offered.
- The organisation — or a site — sets the paper size (A4 or A3), the orientation and the page budget (1–10 sheets, 2 by default).
- In the Compact and Landscape views the system tries every possible layout and prints the one with the fewest sheets; if the budget still cannot be kept, the page footer says so.
- Scanned with a phone, the QR code on the paper shows without login whether work may proceed on the permit right now, and whether the sheet is the latest version.
Maintenance and permit, connected
- The work-order checkpoint in the maintenance policy (warn or block): work that requires a permit cannot start without an active permit, and the work order cannot be closed while an open permit belongs to it. For an emergency work order the start check does not run.
- The PTW policy can require the permit to be linked to a work order before it is issued.
Standards it aligns with
ISO 45001 — OH&S management
It supports risk assessment in an occupational health and safety management system: hazard identification and risk assessment for routine and non-routine activities (6.1.2), handling the risks of contractor work (8.1.4.2), a competence check at approval (7.2), and a retrievable, documented trail of all of it (7.5).
OTSZ 54/2014
The mandatory content of occasional hot work (the qualification exam number).
Hungarian OHS Act §40
Appointing a coordinator when several employers work on one site.
OPEREX supports compliance with an auditable trail — the software itself is not a certificate; judging compliance is up to the organisation and the certifier. The system does not assign a risk rating (high / medium / low) today.
Further reading
Frequently asked questions
Is it mandatory to start permitting with a risk assessment?
No. The upfront risk assessment is an optional step switched on by policy — per organisation or site, as a warning or a block. When it is off, the process starts with the permit draft.
What does the upfront risk assessment pre-fill in the permit?
The title, site, plant, location and work order; the permit-type markers; “yes” for the gate questions, which opens the linked blocks; the required items locked and the recommended ones ticked; the conditions, prep tasks and minimum workers and watchers. Declarations are only made mandatory — a person gives the answer.
Who can make the upfront risk assessment?
Whoever the organisation has given an account and the right to do so — the client’s or the contractor’s safety professional. Optionally, by policy, the approver can be required to hold a valid occupational-safety qualification recorded in the people register (as a warning or a block).
Can a prescribed item be removed from a pre-filled permit?
Only with a written reason. The reason is recorded by name in the audit trail and on the printed permit, and without it issuing is blocked — so the minimum prescribed by the risk assessment cannot disappear silently.
Which permit templates are there?
Ten built-in templates: general, hot work, confined space entry, electrical, excavation, crane/lifting, structural modification, ad-hoc work (LMRA worksheet), combined and ATEX. All can be copied, edited and tied to a site; vehicle entry is a block in the combined and the ATEX template.
On how many sheets does the system print a permit?
In the Compact and Landscape views it picks the layout with the fewest sheets. The organisation can set a page budget (1–10 sheets, 2 by default); if it cannot be kept, the page footer says so.
Let's start a pilot
We'll show you OPEREX on your own operational processes — no strings attached.
Request a demo