Hot Work Permit
A hot work permit template for welding, cutting, brazing, grinding and anything else that throws sparks. Section 5 is the one it is built around: most hot work fires are not discovered while the work is happening, they are discovered after everybody has gone home.
- Forty-two confirmations across the area, the equipment, detection and the watch
- A fire watch that continues at least 60 minutes past the last spark
- Detection and sprinkler isolations recorded with the time they will be restored
- A nine-stage fire watch log, timed and initialed at every check
Hot Work Permit
One location, one task, one shift
| # | Confirmation before work starts | Confirmed | By whom | Time |
|---|---|---|---|---|
| 1 | Wall and ceiling voids checked and protected | |||
| 2 | Other side of the wall or floor checked and protected | |||
| 3 | Detection isolated only if unavoidable, and recorded with a restore time |
The document you will get. Download for the full, editable file.
Who this hot work permit is for
Four people are named on this permit, and the one who matters most is the one with nothing else to do.
The person issuing the permit
Your signature says the area is safe now, not that the form is filled in. The two sections worth slowing down on are the far side of the wall and the isolations, because those are the two that leave consequences behind after everybody has gone.
The fire watch
The permit states in writing that you have no other duties, and you sign to confirm it. Your watch continues for at least an hour past the last spark, through the voids and the far side of the wall, and the log in section 7 is how that hour gets proved rather than assumed.
The contractor or operative
You are the reason the permit exists and usually the person under the most time pressure. What the form does for you is settle in advance what counts as done: the area cleared, the equipment checked, the watch held, and the point at which you can actually leave.
Facilities or estates, as the duty holder
You own the building the sparks are landing in, and the isolations are yours to get back. The closure section exists for your benefit, because the failure that turns a contained incident into a total loss is a detection zone nobody put back.
Which section matters the most in your sector
The work is the same everywhere. What changes is what is on the other side of the wall, who is in the building while it happens, and how much protection has to come off for the job to go ahead.
- FM service providers
The issue block. Where hot work is subcontracted, the permit is the only document naming who verified the precautions in person, who accepted them and who held the watch, and that is the record an insurer reads first.
FM service provider software - Retail and malls
The area section. Hot work above or behind a trading floor is a permit about everybody who is not doing the work, and stock, fixtures and voids full of packaging make the 11 meters harder to clear than on a plant deck.
Retail maintenance software - Healthcare
Detection isolations. A hospital cannot be evacuated casually, so any isolation has to be minimal, recorded with a restore time and confirmed back in service, and the fire watch is covering a building that cannot leave.
Healthcare maintenance software - Data centers
Suppression and alarm. Taking a zone off line in a data center is a decision with its own approval chain, and the permit has to carry the isolation, the restore time and the confirmation from the receiving center.
Data center maintenance software - Commercial real estate
The far side of the wall. Tenant fit-outs put unknown material inside partitions and ceiling voids, so the thing most likely to catch is the thing nobody on the working side can see.
Portfolio maintenance software - Education
The fire watch arrangements. Campus work frequently runs into the evening with the trades leaving before the site does, which is precisely the period the watch exists to cover.
Campus maintenance software
What a hot work permit should contain
A hot work permit is a written authorization to carry out welding, cutting, grinding or any other work producing heat or sparks in a place not designed for it. It records the precautions taken before the work, the detection isolated for it, the fire watch held during and after it, and the closure returning the area to normal.
A. Fields specific to a hot work permit
| Field | What goes in it | Why it earns its place |
|---|---|---|
| Could the work be done without hot work | Cold cutting, mechanical fixing, prefabrication off site | The most useful question on the form and the one most often skipped. A great deal of site welding exists because it is quicker than arranging a bolted connection, and the permit is the last point at which anybody asks. |
| Exact location of the work | Floor, room, elevation, and what is on the other side of the wall | Written as a place rather than a building. The second half of that field is the one that prevents fires, because the hazard is regularly in a space the person doing the work will never see. |
| The area, 11 meters in every direction | Twelve lines, including below the work and inside the voids | The radius is the easy part. The lines that earn their place are dust on ledges and beams, openings and cracks in floors, ducts and conveyors that can carry sparks, and combustible cladding or insulation in the structure itself. |
| Wall and ceiling voids | Checked and protected, as a separate confirmation | A void is the worst case: combustible, unventilated, invisible and directly connected to the rest of the building. It gets its own line because a cleared floor tells you nothing about the space above the ceiling tiles. |
| Equipment and services | Nine lines covering the kit and what it is plugged into | Cylinders secured upright and outside the immediate area, flashback arrestors checked, the return clamp close to the work, screens positioned to protect other people, and local exhaust where the fume needs it. |
| Detection and suppression isolation | Isolated only if unavoidable, with the time it will be restored | The field that protects the building overnight. An isolation with no restore time written against it is an isolation nobody owns, and the permit is the only document that connects taking it off to putting it back. |
| Fire watch arrangements | Twelve lines, including a second watch where needed | Named, briefed, positioned to see the work and the area at risk, with extinguishing equipment and a way to raise the alarm, and explicitly with no other duties. A watch doing something else is not a watch. |
| The watch after work stops | At least 60 minutes past the last spark, then further checks | The reason the permit exists. Most hot work fires are discovered after everyone has gone, so the watch has to outlast the job, be checked again before the area is left and reinspected at the end of the working day. |
| Conditions that cancel the permit | Change of location, change of method, alarm, loss of the watch | Written in advance so nobody has to decide under pressure. A permit with no stated cancellation conditions gets stretched by exactly the circumstances it should have ended for. |
| Fire watch log | Nine timed stages from before the work to the end of day | Before work started, during, work stopped, then 15, 30, 45 and 60 minutes after, a final check before leaving and an end of day reinspection. Each one with the area checked, the condition, any hot spots and an initial. |
| How the check was made | Back of a hand or a thermal camera, not sight alone | Smoldering inside a cavity shows no visible sign until it no longer matters. A visual check of a closed void is a check of a ceiling tile, which is why the log asks what was checked rather than only whether it was. |
| Closure | Isolations removed, and confirmed back in service with the center | Restoring an isolation at the panel without confirming it with the alarm receiving center is the failure that turns a contained incident into a total loss. The permit is not canceled until that confirmation exists. |
If you cut this down, keep the fire watch log and the isolation restore time. Every other control on the permit reduces the chance of an ignition while somebody is standing there to see it. Those two decide what happens in the hours when nobody is. The log is what turns an hour of watching into something that can be shown to have happened, which matters because it is the control most often shortened under time pressure and the one with no physical trace when it is not held. The restore time is what stops a building being left without detection because a job finished late and the person who took the zone out had already gone home. A permit that is exhaustive about combustibles and casual about those two has been written for the issue rather than for the night afterwards.
B. What it looks like filled in
The fire watch log from one evening’s welding, with the stage and the area checked at each entry.
| Time | Stage | Area checked | Condition |
|---|---|---|---|
| 16:45 | Work stopped | Work area and void above | Cool, no smell |
| 17:00 | 15 min after | Work area and far side | Cool |
| 17:15 | 30 min after | Void, far side of wall | Slight warmth |
| 17:30 | 45 min after | Void, next unit | Hot spot, damped down |
| 17:50 | 65 min after | Void and both sides | Cool, no smell |
| 19:10 | End of day | Full area reinspected | Cool |
Nothing was found until forty-five minutes after the work stopped, and it was not found in the work area. The welding finished at 16:45 and the work area itself was cool from the moment the torch went off. What changed was the void above the ceiling on the far side of the partition, where conducted heat through a steel upstand had reached packaging stored against the wall in the next unit. A watch that ended once the work area itself had gone cold would have finished well before anything was detectable, because the work area was cool at the first check and stayed that way throughout. The hot spot was found by hand, on a surface that looked exactly as it had all afternoon.
Word to adapt the precautions and the wording to your own procedure, Excel for the fire watch log and the Permit Log tab that shows whether watches are actually being held for the full period, PDF for the copy that gets displayed at the work location. Free, and yours to rebrand.
How do you issue a hot work permit?
One location, one task, one shift. Work it in order, and walk it rather than reading it, because every line above the signature is something somebody is supposed to have looked at. Six steps.
Ask whether the hot work is necessary at all
Permit number, site, the exact location including what is on the other side of the wall, the description and type of work, the equipment, the people and their qualifications, and the validity window with both times. Then the question that can end the process early: could this be cold cut, mechanically fixed or prefabricated off site.
Clear and protect the area in every direction
Twelve lines covering 11 meters around the work and below it. Combustibles removed or covered with fire resisting blankets, floors swept and protected, flammable liquids and gases out, dust cleared from ledges and beams, openings and cracks covered, ducts and conveyors protected or shut down, and the voids and the far side of the wall checked and protected.
Check the equipment and the services it uses
Nine lines: equipment in good condition, cylinders secured upright and outside the immediate area, hoses, regulators and flashback arrestors checked, cables and the return clamp sound with the clamp close to the work, electrical supply protected or isolated, screens positioned to contain sparks, ventilation and local exhaust adequate for the fume, lighting sufficient, and access clear for everybody in the area.
Confirm the fire protection, and record anything taken out of service
Extinguishers appropriate to the risk and within reach, operatives who know how to use them, the sprinkler system in service or the isolation authorized and recorded, detection isolated only where unavoidable and recorded with the time it will be restored, the alarm method tested, the assembly point known, the fire service route clear and nearby occupants told.
Name the fire watch and say when it ends
Twelve lines. The watch is named and briefed, has no other duties, is positioned to see the work and the area at risk, has extinguishing equipment and a means of raising the alarm, and a second watch covers the far side of the wall or floor where that is needed. The watch continues throughout the work and for at least 60 minutes after it stops, with further checks after that, a final check before the area is left and a reinspection at the end of the day.
Log every check, then close it in order
Nine timed stages in section 7, each with the area checked, the condition and any hot spots found, including the void and the far side rather than only the work area. At the end: equipment removed, cylinders returned, the area confirmed safe, isolations taken off, system restoration confirmed with the alarm receiving center, and only then the permit canceled and filed.
The controls during the work versus the hour after it
Most of a hot work permit is about the period when somebody is standing there with a torch. Most hot work fires happen later, and the controls that cover the two periods are not the same ones.
| Aspect | While the work is happening | The hour after it stops |
|---|---|---|
| What you are protecting against | A spark reaching something that will burn | Material already heated that has not caught yet |
| Where the risk is | The work area, and whatever sparks can fall onto | Voids, cavities and the far side of the partition |
| Who is present | The operative, the watch, usually other trades | The watch, and increasingly nobody else |
| How a problem shows itself | Visibly, immediately, with somebody looking at it | Warmth and smell, often with nothing visible at all |
| How it is detected | Seen, and dealt with in seconds | Felt by hand or found with a thermal camera |
| What ends the control | The work finishing, which is obvious to everybody | A time on the permit, which is nobody’s instinct |
The watch is the only control on the permit that has to survive the job losing everybody’s attention. Everything in the left hand column is held in place by the work itself: people are present, the hazard is visible, and the controls are being used continuously. The right hand column has none of that. The task is done, the equipment is packed, the operative wants to leave, and the thing being watched for produces no visible sign until it has stopped being manageable. That is why the watch is written as a duration with a log rather than as an instruction to stay alert, why the person holding it is given no other duties, and why the checks continue past the point where the work area itself has gone cold. It is also why the log asks what was checked rather than only whether somebody checked, since a visual sweep of a closed ceiling void confirms the condition of a ceiling tile.
When the template starts to feel limiting
A permit at the work location handles one job well. A site, a contractor base and a year of permits is where it stops, and it stops in the same four places.
The watch period is a number somebody has to honor
Sixty minutes after the last spark is a duration on a page held by the person it applies to, at the end of a shift, with a van to load. Nothing outside the work area knows whether the watch ran its full length or finished when the work did.
Nobody knows a detection zone is still out
The isolation and its restore time are written on a permit at the work location. A control room, a duty manager or the incoming shift has no way to see that part of the building is currently without detection.
The location is not a record anywhere
The plant room, the riser and the unit above the shop exist as descriptions typed onto permits. What has been cut or welded there before, and what was found in the void last time, lives in a filing cabinet rather than against the place.
You cannot see whether watches are being held
An insurer asks whether fire watches run for the full period after work stops. Answering that from paper means reading every permit issued and trusting a column that the person being asked about filled in themselves.
What running this in Facilio looks like
The template is the paper version of this permit. The precautions are the same ones; the difference is that the location becomes a record with a history, an isolation is a live state rather than a line on a clipboard, and the watch period is something the system is counting rather than something one person is remembering.
Ops Performance Intelligence
The watch period is counted rather than remembered
The end of the work starts a clock that belongs to the permit rather than to the person holding it, so the watch period and its checks surface to the supervisor and the duty manager instead of only to the one person with a reason to want it over.
Reactive Maintenance Agent
An isolation that is still open is visible as a fault
Detection taken out of service for a job becomes a state on the building rather than a note on a permit, so a zone that has not been restored shows up as an open condition on the area instead of being discovered at the next alarm test.
Work Completion Validator
A permit cannot close with a system still isolated
On paper, closure depends on somebody completing the last block correctly at the end of a long day. Held as a record, the permit cannot reach a closed state while an isolation it opened has no confirmed restoration, so the order is enforced rather than hoped for.
Audit Report Intelligence
The insurer question becomes a report
Because every permit carries its times, its isolations and its watch log, how many permits were issued, how long the watches actually ran, how many isolations were restored late and where the hot spots were found is a query rather than a week of reading paper.
Hallucination-free by design. Atom AI answers from the records in your tenant rather than generating plausible text, so an empty field reads as empty rather than filled in for you.
Frequently asked questions
What is a hot work permit?
A hot work permit is a written authorization to carry out welding, cutting, brazing, grinding, torch applied work or anything else producing heat or sparks in an area not designed for it. It records the precautions taken, the fire protection in place, any detection isolated for the job, and the fire watch held during and after the work.
It covers one location, one task and one shift. Changing any of those three means a new permit rather than an amendment, because the precautions were verified against the place and the method that were described when it was issued.
How long should the fire watch continue after work stops?
At least sixty minutes past the last spark, with further checks after that, a final check before the area is left unattended and a reinspection at the end of the working day. Where work continues across shifts, the watch is handed over rather than ended.
The reason for the duration is that most hot work fires are not found while the work is happening. Smoldering material in a void or behind cladding takes time to develop into something visible, and the period in which that happens is the period when everybody has finished and gone.
Can the fire watch do anything else?
No, and the permit has a line for it specifically. The watch is positioned to see the work and the area at risk, has extinguishing equipment and a way to raise the alarm, and has no other duties for the whole of the work and the watch period after it.
It is written down because a watch given a second job is the ordinary way the control quietly disappears. Holding the ladder, fetching material or covering a delivery each sound reasonable individually, and each one takes the watch away from the only thing it exists to do.
Why check the other side of the wall?
Because conducted heat does not need a gap to travel through. Heat moves through steelwork, pipes and the wall itself and can ignite material on the far side of a partition with nothing visible on the working side at all.
The same applies upwards into ceiling voids, which are usually combustible, unventilated and connected to the rest of the building. Both get their own confirmation lines before work starts and both appear in the fire watch log, because a check of the work area alone is a check of the one place that is probably fine.
What if detection or sprinklers have to be isolated?
Isolate only what is unavoidable, record it on the permit, and write down the time it will be restored. The permit then cannot be closed until the isolation is removed and the restoration is confirmed with the alarm receiving center rather than just at the panel.
An isolation that outlives the job is a building left without protection overnight, and it is a well known cause of large losses. The permit is the only document connecting the decision to take it out with the obligation to put it back, which is why both halves sit on the same page.
Is this the same as a permit to work?
No. A general permit to work covers a task with a known hazard and that template handles the broad case. This one is specific to work that makes heat and sparks, so it carries the clearance radius, the voids, the detection isolations and the timed fire watch, none of which a general permit is shaped for.
Sites often need both, with the general permit covering an isolation or an access arrangement and this one covering the hot work itself, cross referenced by number. What does not work is stretching one permit over both, because the fire watch is the part that gets flattened into a line saying an extinguisher was present.
Who should sign the permit?
The person issuing it, the person accepting it on behalf of the people doing the work, and the fire watch, each with a time against the signature. The issuer signs to say the precautions were verified in person, which is why the form says in person rather than confirmed.
Walking the area before signing is the whole point of that distinction. A permit issued from an office on the basis of a description is a record that nobody looked, and the lines it certifies, particularly the voids and the far side of the wall, are exactly the ones that cannot be checked from a desk.
Can I edit and rebrand this template?
Yes. It is free to use, edit, rename and put your own logo on, internally or for clients. No attribution required.
The Word version is the one to edit if you want the precautions to match your own procedure or your insurer’s requirements. The Excel version is the one to use if you want the timed fire watch log and the Permit Log tab, which holds the register and shows the watch duration against each permit, which is the control most often shortened under time pressure.
In one paragraph
A hot work permit is a document about the hour after the work more than the work itself. Start by asking whether the hot work is needed at all, because a lot of site welding exists only because it is faster than a bolted connection. Clear and protect 11 meters in every direction including below, then check the two places the person working will never see: the void above the ceiling and the far side of the wall, where conducted heat ignites material with nothing visible on the working side. Record any detection or sprinkler isolation with the time it will be restored. Name a fire watch with no other duties and keep it running for at least sixty minutes past the last spark, logging each check by hand or thermal camera rather than by sight. Then close in order, confirming the systems are genuinely back in service with the receiving center before the permit is canceled.
The template is the floor, not the ceiling
Take the permit; it will run one job properly and give an insurer something to read. When a drawer of permits stops being enough, a connected CMMS runs the regime: every location a record with what was cut there before, isolations with a live state rather than a line on a clipboard, a watch period counted by the system rather than by the person holding it, and the question of whether watches are actually held answered as a report rather than reconstructed from paper.
