Why PTW Is Not a Safe System of Work
CONTENTS
- What a safe system of work actually is
- Where PTW sits downstream, not equivalent
- The five elements that must precede a permit
- The covering attemp using PTW to mask weak controls
- What happens when upstream controls are absent
- The legal position
- Practical implications for permit issuers
- Summary
Where PTW Sits – Downstream, Not Equivalent
The permit to work sits downstream of the safe system of work. It is the formal check and authorisation step that confirms, at the point of work, that the safe system is in place and functioning. It does not create the safe system. It verifies it.
This distinction is fundamental. The permit form asks: has the risk assessment been done? Are the isolations in place? Is the PPE available? Have the workers been briefed? Are the emergency arrangements confirmed? It records the answers to those questions. But the work that generates those answers the risk assessment, the method development, the isolation, the briefing must have happened independently of the permit. The permit records compliance with a safe system. It cannot substitute for one.
Sets organisational rules, authority, and accountability for all safety management. A legal requirement under HSWA 1974.
Identifies hazards, evaluates risks, and determines the controls required. Must be task-specific and current. A legal requirement under the Management Regulations 1999.
Translates risk assessment into a defined, documented method. Specifies controls, sequence, isolations, competence, and supervision. Must exist before a permit can be issued.
Confirms that elements 1—3 are in place and functioning at the point of work. Authorises work to proceed. Cannot substitute for any element above it.
Final check carried out immediately before and during work to confirm conditions have not changed and the safe system remains valid.
Organisational Policy & Arrangements
Legal requirement. Defines roles, responsibilities, standards, and authority across the organisation.
Risk Assessment
Legal requirement. Identifies hazards, evaluates risks, and determines the controls required for each specific task.
Safe System of Work
Legal requirement. Translates risk assessment findings into a defined method — the specific controls, sequence, and conditions under which the work will be carried out.
Before-Work Job Checks
Dynamic review carried out immediately before work starts to confirm conditions have not changed and the safe system remains valid.
Permit to Work Verification & Authorisation
Formal confirmation that elements 1—4 are in place and functioning. Authorises work to proceed within defined conditions. Cannot substitute for any element above it.
The hierarchy above is not theoretical. It reflects the structure described in HSG250 and embedded in competent PTW policies. Each layer depends on the layers beneath it. A permit issued where the risk assessment is inadequate, the safe system is vague, or the isolations have not been applied is not a controlled permit — it is a signed piece of paper over an uncontrolled hazard
The Five Elements That Must Precede a Permit
Before a permit to work can be legitimately issued, five conditions must already exist. These are not bureaucratic prerequisites they are the substance of the control that the permit is designed to verify.
A suitable and sufficient risk assessment
The hazards of the specific task must have been identified and evaluated. Generic risk assessments that do not reflect the actual task, location, or conditions are not sufficient. The risk assessment must be task-specific and current.
A defined safe system of work
The method by which the task will be carried out safely must be documented and understood by those who will carry it out. This includes the sequence of operations, the controls required at each stage, and the limits of the task.
Applied and verified isolations
Where the task requires isolation of hazardous energy sources — electrical, mechanical, hydraulic, pneumatic, thermal, chemical — those isolations must have been applied and independently verified before the permit is issued. The permit records that isolation exists. It does not create it.
Competent people
The people carrying out the work must be competent to do so safely. The permit issuer must be competent to assess and verify the conditions. Competence cannot be assumed from the existence of a permit — it must exist independently of it.
Adequate supervision arrangements
The supervision required during the task must be defined and in place. The permit specifies supervision conditions — but the people and authority required to fulfil those conditions must exist before the permit is issued.
The Covering Attempt – Using PTW to Mask Weak Controls
One of the most persistent and dangerous patterns in PTW misuse is the use of the permit system as a substitute for adequate upstream controls. The pattern is recognisable across many industries and organisation types, and it is worth describing explicitly because the people involved are often not aware that this is what they are doing.
- Risk assessments in the organisation are generic, copied from templates, or not task-specific. They exist on paper but do not reflect the actual hazards of the work.
- Safe systems of work are vague method statements or absent entirely. The organisation has not invested the time or competence to define how hazardous tasks should actually be carried out.
- Someone recognises that a piece of work is hazardous and reaches for a permit as the solution. The permit is seen as the control measure rather than as the verification of existing controls.
- The permit is issued. Boxes are ticked. Signatures are obtained. Work proceeds.
- The underlying hazards were never properly controlled. The permit recorded compliance with a safe system that did not exist.
- When something goes wrong, the permit record exists — but the actual controls did not.
This pattern is not always the result of deliberate negligence. In many cases it reflects a genuine but mistaken belief that the permit system is the safe system that having a signed permit means the work is safe. That belief is wrong, and it is dangerous, and it is encouraged by training that focuses on how to complete permit forms rather than on what the permit system is designed to achieve.
The permit becomes a liability shield rather than a safety control. It gives the appearance of a managed system while the substance is absent. And critically — if something goes wrong, the existence of a signed permit may make things worse legally. It demonstrates that the organisation knew the work was hazardous and chose to proceed. If the underlying controls were inadequate, that signed permit is evidence of a managed failure, not a defence against one.
The HSE’s investigation of serious incidents consistently identifies this pattern. Permits were in place. Forms were completed. Signatures existed. But the controls the permits were supposed to verify were inadequate, absent, or not checked at all. The permit system provided the appearance of control without the substance.
What Happens When Upstream Controls Are Absent
When the safe system of work is absent or inadequate and the permit is issued anyway, several predictable failure modes follow.
The permit issuer cannot verify what does not exist
A permit issuer who arrives at the work location to verify that the safe system is functioning has nothing to verify if the safe system was never defined. The issuer faces a choice: refuse to issue the permit on the grounds that the preconditions are not met, or issue it anyway and hope that the work party manages the hazards informally. In organisations where permit issuance is treated as routine, the second path is taken far more often than the first.
The work party operates without genuine guidance
Workers who receive a permit without an adequate safe system of work behind it have been told that the work is authorised — but they have not been told how to carry it out safely. They must make safety-critical decisions in real time, in the field, without the preparation and planning that those decisions require. This is precisely the condition that safe systems of work are designed to prevent.
Supervision becomes reactive rather than planned
Where the safe system has not defined supervision requirements, supervisors have no clear basis for their oversight. Supervision becomes a matter of personal judgement rather than systematic management. When conditions change — as they frequently do on live plant — there is no agreed protocol for what should happen next.
The close-out is meaningless
The permit close-out requires confirmation that the work has been completed safely and the plant can be returned to service. Where the safe system was never adequate, this confirmation is based on nothing more than the work party’s assertion that nothing went wrong. The close-out signature records an outcome, not a controlled process.
The Legal Position
The duty to provide safe systems of work arises from the Health and Safety at Work etc. Act 1974, Section 2(2)(a), which requires employers to provide and maintain plant and systems of work that are, so far as is reasonably practicable, safe and without risks to health.
The Management of Health and Safety at Work Regulations 1999, Regulation 3, requires employers to make a suitable and sufficient assessment of the risks to the health and safety of employees and others, and to implement the preventive and protective measures identified.
A permit to work system, where it has been established, becomes part of the organisation’s safety management arrangements. Where that system is operated in a way that provides only the appearance of control — where permits are issued without the upstream controls being in place — the organisation is not merely operating a poor permit system. It is failing to discharge its statutory duties to provide safe systems of work.
The consequences of that failure, in the event of a serious incident, are not mitigated by the existence of signed permit forms. They may be aggravated by them.
Courts and enforcement authorities look beyond the documentation to the substance of what was actually controlled. A permit record that demonstrates that an organisation knew work was hazardous, issued a permit, and proceeded without adequate upstream controls is not evidence of compliance. It is evidence of a managed system that failed to manage the actual risk.
Practical Implications for Permit Issuers
Understanding that the PTW is not a safe system of work has direct practical implications for anyone who issues, receives, or supervises permit-controlled work.
Challenge the upstream controls before issuing
A competent permit issuer does not simply verify that a permit request form has been completed. They verify that the risk assessment is task-specific and current, that the safe system is defined and understood, that isolations are applied and verified, and that the work party is competent. If these conditions are not met, the permit should not be issued.
Refuse to issue where the safe system is absent
A permit issuer who issues a permit despite knowing that the upstream controls are inadequate is personally accepting responsibility for authorising work that they know is inadequately controlled. The authority to issue a permit carries with it the authority and the duty to refuse to issue one.
Treat generic risk assessments as a red flag
A risk assessment that has clearly not been prepared for the specific task, location, and conditions is a strong indicator that the safe system is inadequate. Generic RAMS submitted by contractors, method statements that do not reference the specific plant or hazards, and risk assessments dated months or years before the task are all warning signs.
Understand what your signature means
When a permit issuer signs a permit to work, they are confirming that the conditions for safe working have been established and verified. That signature has legal weight. It should only be given when the issuer has personally confirmed — at the work location — that those conditions genuinely exist.
Raise the underlying problem, not just the permit issue
Where a pattern of inadequate upstream controls is identified — where risk assessments are routinely generic, where safe systems of work are consistently absent or vague — the problem is not with the permit system. It is with the organisation’s approach to managing hazardous work. That requires a management response, not a permit system fix.
Summary
A permit to work is a verification and authorisation document. It confirms that a safe system of work has been established and is functioning at the point where hazardous work is about to begin. It does not create that safe system, and it cannot substitute for one.
The safe system of work grounded in task-specific risk assessment, defined safe methods, applied isolations, competent people, and planned supervision must exist independently of the permit. The permit records compliance with it. Where the safe system is absent or inadequate, the permit is a record of nothing.
The use of permit systems to paper over weak risk assessments and absent safe systems of work is a recognisable and dangerous pattern. It provides the appearance of managed control while the actual hazards remain uncontrolled. It does not protect the organisation legally. In the event of a serious incident, it may do the opposite.
Ready to Go Further?
Our full permit to work training course covers system design, governance, competency requirements and practical application — everything needed to operate PTW effectively in real working environments.
View PTW Training Course →