Permit to work system: permit types, roles, handover and SIMOPS

What a permit to work system is

The UK Health and Safety Executive guide HSG250, Guidance on permit-to-work systems, the reference most petroleum, chemical and process sites build on, describes a permit to work system as a formal recorded process used to control work identified as potentially hazardous, and also as a means of communication between site management, plant supervisors and operators, and the people who carry out the work.

That second part matters most. A permit is how the operator who knows the live plant tells the maintenance crew what is isolated, what is still live, what gas test was done and what else is happening nearby. It is also how the crew tells the operator that they have finished and the plant can be put back into service.

HSG250 lists the essential features of a good system:

• clear identification of who may authorise particular jobs, and the limits of their authority;
• clear identification of the types of work considered hazardous;
• clear identification of tasks, risk assessments, permitted duration, simultaneous activity and control measures;
• training in the issue, use and closure of permits;
• monitoring and auditing to check the system works as intended.

Is a permit to work required by law in Malaysia?

The Occupational Safety and Health Act 1994 does not use the words "permit to work", but it requires what a permit system delivers. Section 15(2)(a) makes it the employer's duty to provide and maintain plant and systems of work that are, so far as is practicable, safe and without risks to health, and section 15(2)(c) requires the information, instruction, training and supervision needed to keep employees safe. Since 1 June 2024, section 18B also requires a risk assessment and the controls it identifies. Under section 19, breaching sections 15 or 18B carries a fine of up to RM500,000, up to two years in prison, or both. See our OSHA amendment 2022 guide.

For some work, DOSH guidance names the permit directly. The Industry Code of Practice for Safe Working in a Confined Space 2010 requires a written permit to work for entry, says the confined space permit is the overriding permit, and accepts an integrated permit system that links it to a hot work permit. Read more in our confined space entry guide.

In practice, a permit system is the normal way to show DOSH, a client or an auditor that high-risk, non-routine work is controlled. The HIRARC for the activity tells you which jobs need one.

Types of permit and certificate

Sites name their permits differently, so define each type clearly in your procedure. HSG250 describes these common types and suggests colours so that a travelling workforce recognises them:

An isolation certificate is not a permit to start work. It records the isolations (valves locked, spades inserted, breakers locked off) that one or more permits depend on, and it must be cross-referenced to every permit that relies on it. Our lockout tagout guide covers how those isolations are made and proved. The Hot Work lesson walks through hot work permits, gas testing and the fire watch.

Roles: issuer, receiver and area authority

Titles vary between companies. HSG250 suggests common titles to help people who move between sites:

• Originator: the person who needs the job done and requests the permit.
• Permit authoriser: approves the permit for issue where an extra level of sign-off is needed.
• Issuing authority (often "permit issuer"): checks the plant and site conditions, specifies the precautions and issues the permit.
• Performing authority (often "permit receiver", "permit holder" or "person in charge of the work"): accepts the permit on behalf of the work party, briefs them and makes sure they follow it.
• Area authority: the person in control of the location, who must know what work is going on, especially at breaking containment, handover and suspension.
• Site checker: carries out checks such as gas testing (the authorised gas tester).
• Isolating authority: makes and removes the isolations.

On a small site one person may be area authority, issuing authority and authoriser at once. The confined space code is stricter for entry: its permit issuer must be trained as an entry supervisor and authorised gas tester, and cannot be the same person who supervises the entry.

How a permit moves through its life

1. Request and plan. The originator describes the job, location, equipment and time. The job is risk assessed, with a job hazard analysis for the task.
2. Prepare the plant. Isolations are made and recorded on an isolation certificate; the equipment is drained, purged or vented; gas tests are done and recorded.
3. Issue. The issuing authority visits the site, checks the precautions are in place and signs the permit with its validity period.
4. Accept and brief. The performing authority signs to accept it, briefs the crew at the work site (a toolbox talk works well) and each worker understands the limits.
5. Display. A copy is displayed at the work site and a copy is held in the control room or permit office.
6. Work, monitor, suspend if needed. Gas tests are repeated as specified. If conditions change, work stops and the permit is suspended or cancelled.
7. Hand back and close. The performing authority confirms the work is finished and the site is clean; the issuing or area authority checks the plant is safe, isolations are removed and signs the plant back into service.

HSG250 says the hand-back must answer three questions: has the work been completed, has the plant been returned to a safe condition with isolations removed, and has the person in control of operations acknowledged that it is back under their control?

Handover, suspension and SIMOPS

Shift handover

If a job runs past one shift, the incoming shift must know every live permit, its status and the state of the plant. HSG250 recommends that the incoming issuing authority signs to allow the permit to continue. A permit log or display board helps. The Piper Alpha inquiry found that the night-shift handover did not pass on that a pressure safety valve had been removed for overhaul; the leak from that open point ignited and 167 people died in 1988.

Suspended permits

A suspended permit is still live until it is cancelled, and its isolations may still be in place. Keep suspended permits on the same recording system as active ones, re-check the site before work restarts, and do not let them pile up for weeks.

Simultaneous operations (SIMOPS)

One job under a permit must not create danger for another, even if the other job needs no permit. Issuers should check what else is planned or under way in the area, cross-reference interacting permits, and take special care where one isolation protects more than one job. HSG250 notes that at Piper Alpha there was no cross-referencing when work under one permit affected another; people relied on memory. Offshore and in turnarounds, a SIMOPS matrix decides which activities may run together. The SIMOPS lesson lets staff practise this in a 3D scene with live production, crane lifts and hook-up work on one deck.

Common permit to work failures

• No permit for the actual job. In a 1992 UK incident HSG250 describes, permits were issued for removing a lid and blanking an inlet, but not for raking out the residue inside the still. A jet of flame killed five people.
• Issuer did not know the process. A permit listed mechanical and electrical isolations but missed a process line, because the issuer did not know the process controls.
• Desk issue. The permit is signed in the office without a site visit or a fresh gas test.
• Permit in a pocket. The performing authority's copy is not displayed at the job, so nobody nearby can check the limits.
• Vague scope. "General maintenance, Area 3" lets the job grow beyond what was assessed.
• Too many permits per issuer. HSG250 warns that issuers need time to check site conditions; limit how many permits one person can control.
• Weak handover and hand-back. Plant returned to service with an isolation still in place, or a missing valve not passed on.
• Training on the form, not the hazards. Crews sign without understanding what the precautions protect them from.

Audit a sample of live permits at the work site, not just closed ones in the file. The Permit to Work & Risk Assessment lesson puts staff in the area authority's seat, with permits, JHA, handovers and SIMOPS decisions to get right before the job starts.