Which work needs a permit: scope and selection

Every permit system starts with a decision that is easy to get wrong: which work goes under a permit and which does not. If the net is too narrow, dangerous jobs slip through with only a verbal instruction. If it is too wide, the system drowns in paperwork, issuers spend their shifts signing forms for trivial tasks and people stop reading what they sign. This lesson explains how sites define the scope of their permit system, how they classify work into permit categories, and how they keep that scope under review as the plant and the work change.

Start from the hazards, not the forms

The best permit systems define their scope by asking what could go seriously wrong, not by copying another site's list of permit types. The starting point is the site's hazard register and risk assessments. Work belongs under a permit when it is non-routine and when it can bring people into contact with a hazard that normal operating controls do not cover. The UK HSE guidance HSG250 puts it simply: permits are for work that is potentially hazardous and that is not adequately controlled by other means, such as the normal operating procedures of the plant.

Most sites use a set of triggers. If any trigger applies, the work needs a permit; if none applies, the work can be done under procedures, job instructions or a simple work order. Typical triggers include:

• Breaking containment: opening, cutting or disconnecting any vessel, pipe, hose or equipment that contains or has contained hazardous material or pressure.
• Hazardous energy: work that needs isolation of electrical, mechanical, hydraulic, pneumatic, thermal or stored energy beyond a simple, verified procedure.
• Ignition sources in hazardous areas: welding, cutting, grinding, open flames or non-certified electrical equipment where flammable materials could be present.
• Atmospheres: entry into confined spaces or work where oxygen deficiency, flammable gas or toxic gas could occur.
• Ground disturbance: excavation, trenching, drilling or driving stakes where buried services may exist.
• Work at height or over open edges where collective protection is not already in place.
• Live electrical work, or work near exposed energized conductors.
• Lifting operations classed as critical or complex, for example tandem lifts, lifts over live plant or lifts close to capacity.
• Use of ionizing radiation sources, such as industrial radiography.
• Disabling or bypassing safety systems, such as fire detection, gas detection, interlocks or relief devices.
• Any other task that the site's risk assessment rates as high risk, or that is new and has never been assessed.

Routine work under procedures

Not everything risky needs a permit. Much hazardous work is done every day under well-designed procedures, by trained people, with engineered controls that are always present. An operator who switches a pump using the control system, drains a sample point through a fixed sample cooler, or changes a filter using a procedure that includes a simple verified isolation may not need a permit, because the hazards are understood and controlled by design and training. What matters is that the procedure has been risk-assessed, that it includes the controls, and that the people using it are competent.

The danger comes when routine slides into non-routine without anyone noticing. A filter change becomes a filter housing repair. A sample point is blocked and someone decides to rod it out. A small leak is tightened, then the fitting is replaced, then the pipe is cut. Good permit systems include a rule that work stops and a permit is sought whenever a routine task goes outside the conditions assumed by its procedure.

Permit categories and levels

Many sites group permits into categories, each with its own form, issuer requirements and controls. Lesson 5 describes the common types. When deciding the scope, sites also decide how to handle different levels of risk within a type. Common approaches are:

• Single-level permits: every job of that type gets the same permit and the same controls. Simple, but heavy for low-risk tasks.
• Graded permits: for example, a general work permit for lower-risk non-routine work, and a high-risk permit with extra controls, more senior issuers and more frequent checks for the most dangerous work.
• Base permit with attached certificates: one permit per job, with certificates attached for each hazard present, such as an isolation certificate, a confined space entry certificate, a hot work certificate or an excavation certificate.

Whatever the structure, the categories must be clear enough that two experienced people looking at the same job would choose the same permit type and level.

Ranking work by risk

Some sites go a step further and use a simple scoring method to decide which work goes under which level of permit. The score is not a substitute for judgment, but it helps keep decisions consistent across shifts, areas and issuers. A common method rates the severity of the worst credible outcome and the likelihood that it occurs if the work is done without permit-level controls, then multiplies them.

Here \( S \) is severity on a scale of 1 to 5 and \( L \) is likelihood on a scale of 1 to 5, so \( R \) runs from 1 to 25. A site might decide that any job scoring 15 or more goes under a high-risk permit with senior issuer sign-off, scores of 8 to 14 need a general permit, and scores below 8 can be done under a procedure, provided no mandatory trigger applies. Mandatory triggers, such as confined space entry, override the score: they always need a permit.

Gray areas and default rules

No list of triggers covers every case. Experienced sites write two default rules into their permit procedure. First, if the person planning the work is unsure whether a permit is needed, the answer is yes until an authorized person decides otherwise. Second, new or unusual work that has never been risk-assessed goes under a permit the first time it is done, and the experience is used to decide whether it can later move to a procedure.

Contractors deserve special attention. Contractors often do the most hazardous non-routine work, and they may not know the plant. Many sites therefore require permits for all contractor work in operating areas, even tasks that site staff would do under a procedure. Lesson 6 covers contractor roles in more detail.

Writing the scope into the procedure

The scope decision must be written down, not left to custom. A good permit procedure includes:

• A clear statement of what work requires a permit, listing the triggers and permit types.
• Examples of work that does and does not need a permit, drawn from the site's own activities.
• The default rules for uncertain and new work.
• Who has authority to decide that a job does not need a permit, and how that decision is recorded.
• Areas where any work at all needs a permit, such as process units, tank farms, substations or data center electrical rooms, and areas where only triggered work does.
• How the scope is reviewed, for example after incidents, plant changes, audits or a set period.

In the US, OSHA expects the scope to cover at least the work its standards name, such as permit-required confined space entry under 1910.146 and hot work under the process safety management standard, 1910.119(k), and to reflect the employer's own hazard assessment. ANSI/ASSP Z10.0, the consensus standard on OHS management systems, treats permit systems as one of the operational controls that follow from hazard identification.

Keeping the scope under review

Plants change. New equipment arrives, processes are modified, contractors change and incidents reveal hazards no one had considered. The permit scope should be reviewed whenever one of these happens and at a set interval, often every one to three years. Useful questions in a review are: Were there incidents or near misses involving work that was not under a permit? Are issuers spending most of their time on low-risk permits? Are there tasks that are routinely done under permits but could safely move to a procedure? Are there new hazards, such as battery energy storage systems or hydrogen, that the triggers do not mention?