Permit to work on paper: a system designed to fail quietly

Ask whether the permit system is working and people point at the board. It hangs in the cabin where everyone can see it: numbered stubs on hooks, a grid of zones, a laminated notice saying live permits are not to be removed. It looks like control, and it photographs well. When something goes wrong it is the first thing copied into the investigation pack — a signed form, therefore a working system.

Follow one permit out of that cabin, though, and watch where it actually ends up.

The HSE has said for years that a permit to work is a procedure rather than a slip of paper. On a paper system the two collapse into each other, and the space between them is where things quietly come apart. None of what follows is the mark of a badly run job. It happens on sites with a permit office, a weekly safety meeting, a perfectly decent RAMS pack and a board that looks immaculate at half past seven in the morning.

It starts with a pad

Hot work, an excavation, an electrical isolation, a confined space. A supervisor or a subcontractor fills in a numbered carbon pad. Under location they write a grid reference, or a room name, or — more often than anyone likes to admit — "as discussed". The method statement referenced is last week's, or a generic one covering the activity class rather than this particular isolation. The hazards ticked are the ones already printed on the form, because those are the ones already printed on the form.

None of that is unreasonable. CDM assumes the right information can be produced at the point of work, and the pad assumes the same thing: that whoever signs it later can see what the person requesting it saw. Everything downstream rests on that assumption, and it holds less often than the procedure imagines.

A permit is also a programme fact, which tends to get left out of the training. The shift does not stop because the isolating authority is two floors up and in a meeting. Work will start from whichever piece of paper is already in somebody's pocket.

The walk for signatures

Approval is a walk. Area authority. Isolating authority, if there is a lock or a test involved. Permit coordinator, on the jobs that still have one. Each of those signatures is meant to be a change of state, and on paper each one is a mark in biro.

A mark carries no reliable time. It does not record the isolation schedule as it stood when the pen touched the page, or whether the person signing had the current drawing, the current RAMS, or the faintest idea what else was live in that area. Two signatures on the same line in the same ink tell you nothing about which came first. A countersignature obtained at four in the afternoon, after the gang has been working since eleven, looks in the file exactly like one obtained beforehand.

Simultaneous operations are supposed to be the entire point of that walk. In practice the second permit for the same zone is on a different pad, in a different pocket, or still being written. The first pad has no way of knowing. The board finds out later, assuming somebody hangs both stubs, and later is not a control.

Issue means tearing a page

White to the workface. Pink to the board. Yellow stays in the file. Colours vary by supplier; the logic does not. Copies are how a paper system imitates having states.

Tearing a page does not withdraw yesterday's permit for the same location. It does not invalidate the photocopy someone ran off because the original goes soft in the rain. And the copy at the workface can be amended in biro — an extra two hours, a changed isolation, a second gang brought in — while the file copy sits in the office knowing none of it. From that point the job is carrying two permits with the same number, both looking live, disagreeing with each other. The one that matters is the one already at the workface.

That divergence can run for hours, sometimes across a whole night shift, and the board will look complete throughout. It is why the argument afterwards gets so expensive. A project can produce a signed form and still be unable to show that the people who struck the arc, or went into the space, were working to the conditions the file now displays.

The board is not the workface

A stub on the board does not prove the workface copy is still current. A missing stub does not prove work has stopped. A closure signed in the same hand as the issue, in the same pen, does not prove the isolation was ever put back.

The people hanging stubs are frequently not the people doing the work, and the people doing the work are frequently not the ones who come back to close it out. Which is why "check the board" was never really a workface procedure. The board is in the cabin. The permit is in a pocket, or under a helmet, or taped to the inside of a panel door. Until that copy is physically collected, marked up or replaced, the site is running a public record and a private instruction side by side, each free to drift. Paper has no way of syncing.

Nights inherit whatever days left behind

Handover is where this fails most quietly of all. The day gang leaves a permit that still looks live. The night supervisor picks up a time window written for a different crew, a different isolation state and a different set of neighbouring works. The extension is a fresh line on the form, or a set of initials, or a supervisor saying carry on. None of those is a new issue. All of them read, by morning, as continuity.

Expiry goes the same way. A permit that ran out at six can still be in a pocket at nine. Nobody collects expired paper with the diligence a plotter room applies to superseded prints, because collection is nobody's coded activity and filling in the next pad is. The expired copy keeps its authority simply by being paper, being signed, and having been good enough at the start of the shift.

Ask why the unofficial extension exists at all and the answer is usually the same: the official route cannot keep pace with the work. You cannot supersede a spoken carry-on. You certainly cannot withdraw it from a gang that has already started.

Closing out

Closure ought to be the moment work finishes, the isolation is restored and the permit dies. On paper it is one more mark, sometimes made with the same pen as the issue several hours earlier. Sometimes the workface copy never comes back and the file copy is closed in the office because the gang has gone home. Sometimes the board is stripped on a Friday, the stubs go into a box, and the box becomes the archive.

Nobody investigating an incident asks whether a permit existed. They ask who knew what was authorised, against which isolation, at what time, and which copy the operative was actually holding. A numbered pad with a company name on it answers none of that. A signature without a time is not an approval — it is evidence that a pen was available. Two coloured copies that disagree are proof that issue and use had already come apart, hours before anyone noticed.

A site can be entirely correct in its cabin file and still lose the argument, because the argument concerns the piece of paper that authorised the work, not the piece of paper that was filed.

Why it stays quiet

Nothing here announces itself. No alarm sounds when a copy diverges, no warning appears when a signature goes on late, nothing flags an expired permit sitting in a pocket. Each of those failures produces exactly the same artefact as success: a completed form. That is what makes paper permits so durable, and so hard to argue with in a management review. The system only shows its condition when somebody asks it to reconstruct a sequence, and by then the sequence is a box of stubs in the site office.

So if you want to know whether your permit system works, do not look at the board. Walk out to the workface, ask to see the copy in somebody's pocket, and compare it with the one in the file. The gap between those two pieces of paper is the honest measure of the system.

Closing that gap does not need a committee or a new standard. Give every approval a time that was captured when the pen moved rather than typed in afterwards. Make collecting an expired permit somebody's named job, the way issuing the next one already is. Tie each permit to the drawing revision and the isolation state it was written against, so the two travel together. And before you buy or rebuild a permit system, ask whoever is selling it — or whoever runs the one you have — to reconstruct a shift from six months ago while you watch. Most of what is described here surfaces inside that half hour. Clients and principal contractors are the ones who can make that a condition of the job, and until they do, the board in the cabin will go on looking immaculate.