Key Elements of a Permit to Work Form
Most Permit to Work failures are not training failures. They are system failures, often identified in audits and known about long before an incident. This was the case on Piper Alpha, where the permit system had degraded from an operational control into an administrative process. The Permit to Work form is part of that system, and a critical one at that.
On 6 July 1988, 167 people died on the Piper Alpha oil platform because two permits to work were not cross-referenced. One permit covered maintenance on a condensate pump. Another covered removal of that pump’s safety valve on a different deck. The permits were stored in separate locations. The night shift operators found the pump permit. They started the pump. They had no way of knowing the safety valve had been removed because the permit system didn’t force the connection between related work.
High-pressure condensate leaked through the blind flange. It ignited. The platform burned for three weeks.
When the form is poorly designed, the checks become superficial, the conversations become assumptions, and the controls degrade.
A well-designed permit to work form isn’t paperwork. It’s a critical part of a work control system that forces the right people to think about the right things before, during, and after hazardous work. It helps those managing and undertaking the task maintain continuous focus on what might kill them.
How to Design a Permit to Work Form That Prevents Fatal Failures
This is where the form stops being paperwork and becomes part of a working Permit to Work system.
Want to see how this works in a real Permit to Work system?
My Permit to Work Systems Training covers form design, issuer competence, isolations, cross-referencing, supervision, and real-world implementation and covers all permit types.
The Purpose of a Permit to Work Form
A permit to work form must do six things:
- Identify the job clearly
- Link the job to risk controls
- Force pre-work verification
- Allocate responsibility and accountability
- Ensure competence is in place
- Provide a record of supervision and completion
If it doesn’t do all six, it’s not a Permit to Work. It’s a piece of paper that gives the illusion of control. When permit forms cannot see each other and exist in isolation, the system begins to fail in the same way it did on Piper Alpha.
Many people mistakenly treat a Permit to Work as a safe system of work. It is not. A Permit to Work does not replace the risk assessment or the method statement. It sits on top of them. The permit is the control that ensures the risk assessment and safe system are actually understood, checked, and applied at the point of work.
When a permit is used because the risk assessment and safe system are absent, the entire purpose of the permit has already been lost.
The core sections every good PTW form must contain
A Permit to Work form is not a collection of boxes. It is a structured control tool designed to force the right checks, the right conversations, and the right responsibilities before hazardous work begins. These core sections are not administrative fields. They are the parts of the form that make the Permit to Work system function as a live safety control rather than a document.
What does a basic permit to work form structure look like?
The HSE provides guidance on essential permit elements in HSG250 (Guidance on permit-to-work systems). Their basic structure covers the fundamentals:
This is a reasonable starting point. It covers identification, a place to note other permits, hazard identification, precautions, issue and acceptance, handover, and completion.
But notice what is missing:
• No formal suspension and restart procedure
• No specific competence verification for the issuer
• No requirement for periodic supervision checks during the work
• No requirement to cross-reference related permits, only a space to record them
This is why it is a minimum starting point. It provides the structure, but a working Permit to Work form needs to go further, particularly in making related work visible and maintaining control during the job.
Identification and traceability
Look at sections 1- 4 of the HSE form. These aren’t optional fields to fill in when convenient – they’re critical control information.
If your maintenance supervisor can’t look at the permit to work form and immediately know what’s happening and where, your form has already failed.
The unique permit number is not a minor administrative detail. It’s what allows cross-referencing between related permits.
On Piper Alpha, two permits existed for work on the same equipment, one for the pump and one for its safety valve. They were stored in separate locations. The night shift found one permit but had no way of knowing the other existed.
Without a system that forces cross-referencing between permit numbers, related work activities become invisible to each other. This is exactly the type of permit system failure identified by the Cullen Inquiry into Piper Alpha.
Linking the job to risk controls
A permit must never stand alone. It must reference:
- The risk assessment
- The method statement or safe system of work
- Isolation details where relevant
- Other nearby permits or non permit activities
If these documents are absent, the permit cannot perform its function as a safety control and the work should not proceed.
That last one is critical. Lord Cullen’s inquiry found that one of the permit system failures on Piper Alpha was “the absence of a need to cross-reference permits where one piece of work may impact others.”
Your form must force this. Not suggest it. Force it.
When I was managing underground mining operations, every permit included a section: “Other permits active in this area?” If you couldn’t answer it, you didn’t get the permit signed. Simple and safe.
This is what ties the permit into your actual safety management system rather than letting it become a parallel universe where people just sign things and hope for the best. Hope has never been a safety strategy.
Pre-work checks
A good Permit to Work form separates two different types of checks that are often confused.
The first is the task control checklist, which focuses on the specific hazards and controls for the job, for example hot work, confined space, or work at height.
The second is the pre-work control check, which confirms that the conditions for carrying out the work safely exist at all. These checks relate to competence, isolations, nearby work, and communication with others in the area.
When these are mixed into one long list, the permit becomes difficult to use and important checks are missed.
In 2017, Luke Branston died at Mountsorrel Quarry because a conveyor wasn’t properly isolated before maintenance work started. Tarmac Aggregates Limited was fined £1.275 million. HSE Inspector Adrian Jurg said: “When a company like Tarmac profit from the hard work of contractors like Luke then the very least they owe him and his family is a duty to ensure he gets home safe at the end of his shift.”
The permit to work form should have forced verification: Is the isolation effective? Has it been tested? Is there a pre-start warning system?
If your permit just has a tick box that says “isolation confirmed” without forcing the actual checks, you’re not preventing incidents. You’re creating paperwork that makes you feel better. In this case a 26-year-old with his whole life in front of him dies.
That’s not about paperwork. That’s keeping someone alive.
Authorisation and responsibility
The form must clearly show:
- Who issued the permit
- Who received it
- Time limits of validity
- Arrangements for transfer between shifts
- What information must be handed over at shift change
On Piper Alpha, the removal of the safety valve was recorded on paper but not verbally communicated during the shift handover. The permit system had no mechanism to force that communication.
Without clear handover requirements, responsibility becomes blurred very quickly.
I’ve seen too many incidents where nobody could answer “who was supposed to be supervising this?” Because the permit didn’t make it clear.
Supervision during the job
A good Permit to Work form includes space for active supervision while the job is underway. It must allow the issuer to record:
- Periodic checks during the work
- New hazards discovered
- Amendments to the job
- Changes to nearby work activities
This is what keeps the permit alive after it has been issued. A permit signed at 06:00 and not looked at again until 16:00 is not a control.
A good Permit to Work form also controls the life of the permit over time. It must clearly show:
- The time limits of the permit’s validity
- How the permit is transferred to a new issuer or receiver during the shift
- How additional workers sign onto the permit after being briefed
- How the handover of information is managed at shift change
On many sites, those joining the task are required to sign onto the back of the permit once they have been briefed. This is not administrative. It is how the permit controls who is actually working under its authority at any point in time.
Critical point on competence:
The form must clearly show:
- Who issued the permit
- Who received it
- Time limits of validity
- Arrangements for transfer between shifts
- What information must be handed over at shift change
On Piper Alpha, the removal of the safety valve was recorded on paper but not verbally communicated during the shift handover. The permit system had no mechanism to force that communication.
Without clear handover requirements, responsibility becomes blurred very quickly.
I’ve seen too many incidents where nobody could answer “who was supposed to be supervising this?” Because the permit didn’t make it clear.
The person issuing the permit must understand every single item on that form. Not just know what the words mean – understand what each check is actually controlling and what happens if it’s missed.
I’ve seen permits issued by people who couldn’t explain what “isolation” means or why it matters. I’ve seen permits signed by supervisors who’ve never physically completed an isolation in their lives. That’s not authorisation. That’s an accident waiting to happen.
If your permit issuer can’t explain to the permit receiver exactly why each check exists and what hazard it controls, then the PTW system won’t work.
Suspension and restart procedures
This is often where organisations create dangerous gaps in their systems. Sometimes work needs to be suspended – shift change, breakdown, waiting for parts, emergency response elsewhere. Sometimes equipment needs to be temporarily re-energised during maintenance for testing or adjustment.
Both are high-risk moments. Your form must handle them explicitly. A good PTW form includes:
A suspension section that requires:
- Confirmation that work area is left safe
- Tools and equipment accounted for
- Area access controlled
- Communication to all affected parties
- Signed suspension by both issuer and receiver
Restart/re-energisation section that requires:
- Checklist confirmation before any re-energisation
- Clear authority for who can authorise restart
- Verification that all persons are clear
- Confirmation of what’s being re-energised and why
- Time limits on temporary re-energisation
I’ve investigated incidents where someone re-energised plant during a “suspended” permit and a maintenance technician was still inside the guarding. The permit had no suspension section. Just a vague note in the margin.
Operating machinery with safeguards removed is a measure of last resort. When it must happen, your form must force the right checks. Every single time – the checklist and the authorisation below is an example of how this can be included on the PTW form.
Completion and hand back
The form must include:
- Clearance confirmation
- All tools and equipment removed
- All persons withdrawn
- Area restored to safe condition
- Hand back to operations
- Cancellation
- Post-work review where necessary
This ensures the area returns to normal operations safely and leaves an auditable trail.
I’ve investigated incidents where someone re-energised plant because they didn’t know work was still ongoing. The permit had no hand-back section. Just a signature at the top and hope.
Role of Checklists in a Permit to Work Form (Why They Matter)
This is where most organisations get their permit to work form design badly wrong.
A checklist must be:
- Short enough to be used
- Long enough to stop critical things being missed
If its too long, it becomes a tick-box exercise. If its too short, it misses the hazards that matter.
I’ve seen permits with 47 tick boxes. Nobody reads them. They just initial down the page and crack on. Might as well wipe your arse with it.
A good PTW system uses:
- A short core checklist on the main permit
- Task-specific supplementary checklists attached when required
- A specific suspension/restart checklist
A confined space checklist – focuses on atmosphere testing, isolation, rescue equipment, and supervision.
A hot work checklist – focuses on fire load, ignition sources, fire watch, and shielding.
A work at height checklist – focuses on edge protection, falling objects, rescue plan, and access equipment.
A suspension/restart checklist – focuses on: area safe, personnel clear, tools removed, access controlled, re-energisation authority, verification checks.
Every one of these checklists – must include: “Other permits active that may affect this work?”
The main permit doesn’t try to be all of these at once. That’s how forms become unusable.
“A missing checklist item is often where incidents start. Not because people are careless, but because the permit system failed to prompt the right conversation.”
Features that make a PTW form work in practice
Good forms also include:
- Cross-referencing section for related permits – this is not optional
- Clear suspension and restart procedures – not buried in footnotes
- Colour coding for different permit types
- Attachments for drawings or photos
- Emergency plan reference
- Distribution list for who must see the permit
- Physical or electronic linking between interdependent permits
- Version control and form number
These may look small design features, but they make big practical differences.
When you’re coordinating five different work activities in the same area – and I’ve done this hundreds of times – cross-referencing between permits is what stops two contractors creating a hazard neither of them knows about.
On Piper Alpha, two theories exist for why the night crew didn’t know about the safety valve permit: either it was misplaced, or the filing system stored permits in separate locations and the crew found the first one without knowing to look for a second.
Your system must make it impossible to miss related work. If permits can exist in isolation, your system is broken.
What a bad PTW form looks like
You can spot a bad permit to work form quickly..
It will:
- Be overly long (3+ pages of tick boxes)
- Try to cover every task type in one generic form
- Contain meaningless tick boxes like “appropriate controls in place”
- Fail to reference risk assessments and method statements properly
- Have no provision for supervision during the job
- Have no cross-referencing to other active permits
- Have no formal suspension procedure – just people writing notes
- Have no controlled restart/re-energisation section
- Look impressive in an audit but be useless on site
These forms create the illusion of control rather than real control.
They get filed. They don’t get used. And the risk remains.
A Permit to Work form is a control tool, not a document
The purpose of the permit to work form is to force structured thinking and clear communication before hazardous work begins – and during critical transition points like suspension and restart.
When designed properly, the form drives behaviour and prevents parallel work activities from creating unexpected interactions.
When designed badly, it drives paperwork and allows work to proceed in dangerous isolation.
Lord Cullen’s inquiry concluded that inadequate permit-to-work systems were central to the Piper Alpha disaster. The policies were in place. The procedures existed. But the forms and the system didn’t force the behaviours that would have prevented 167 deaths.
A good permit form takes time to design properly. It forces cross-referencing. It controls suspension and restart. It prevents isolation of related work activities. It saves you from writing reports about why someone’s dead.
Final thought
A good permit to work form does not try to do everything.
It does the critical things well – including forcing awareness of related work, controlling suspension and restart procedures, and maintaining control during transition points.
It relies on the right supporting documents and checklists to handle the detail.
- That is what makes it usable.
- And what makes it effective.
- And what prevents another Piper Alpha.
If you want to understand how the form fits into a properly designed Permit to Work system used in real industry, I cover that in detail in my PTW systems training below:
Want to see how this works in a real Permit to Work system?
My Permit to Work Systems Training covers form design, issuer competence, isolations, cross-referencing, supervision, and real-world implementation and covers all permit types.
Phil Douglas has 33 years of frontline operational experience including managing high-risk work activities in coal mining, manufacturing, and construction. He has investigated permit-to-work failures and designed PTW systems and trained 1000’s of Permit to Work Issuers for organisations across multiple sectors worldwide.
