Permit to Work
Authorisation to do one job, in one place, for a stated window of time, with the precautions confirmed before anybody starts rather than after.
- One job, one place, one window of time with an end on it
- Hazard present and precaution in place, ticked separately
- Atmospheric tests retested, not read once at the start
- A hot work fire watch that continues after the work stops
Permit to Work
One job, one place, one window
| # | Hazard | Yes | Prec | By |
|---|---|---|---|---|
| 1 | Flammable atmosphere or materials | |||
| 2 | Interruption to fire detection or suppression | |||
| 3 | Confined or restricted space |
The document you will get. Download for the full, editable file.
Who this permit to work is for
Four people sign or rely on a permit, and the one it protects most often never reads it.
The issuing authority
You are signing to say the precautions are in place. The hazard and precaution columns are what you are actually certifying, which is why they are ticked separately rather than as one line.
Person in charge of the work
You accept the permit and brief your team under it. The valid-to time and the conditions are the two things you have to hold, because working past the expiry is not a paperwork problem.
Safety or compliance lead
You are auditing afterwards. Whether the permit was cancelled, whether extensions were authorised before they were needed, and whether the fire watch ran are the three lines you check.
Site or operations manager
You live with the consequences of an interrupted fire panel or a barriered corridor. The isolation status and handback sections are what tell you the building is back to normal.
Which section matters the most in your sector
The permit is the same shape everywhere. What changes is the section that carries the risk, and it is usually the one your insurer or your client asks about first. If you run one of these, the sector page goes further than the template does.
- FM service providers
Competence evidence. When the work is subcontracted, what was actually seen before issue is the line that decides whether the permit means anything.
FM service provider software - Healthcare
Interruption to life safety systems. Isolating a fire zone or a lift in an occupied hospital is the entry that needs a time against it, not a tick.
Healthcare maintenance software - Retail and malls
Adjacent occupants and public access. Hot work above a trading floor is a permit about everybody who is not doing the work.
Retail maintenance software - Commercial real estate
Handback and cancellation. Across a portfolio the risk is not the permit issued, it is the permit nobody closed.
Portfolio maintenance software - Data centres
Isolation and system status. Suppression and detection interruptions in a data hall are measured in minutes and have to be logged both ways.
Data centre maintenance software - Corporate facilities
Extensions. Office-hours work that overruns is where permits get extended after they expired, which is the one thing an extension cannot do.
Corporate facilities software
What a permit to work should contain
A permit to work is written authorisation for one job, in one place, for a stated period of time. It records the hazards present and the precaution in place against each, the isolations and system status, the protective equipment and standby arrangements, who issued and accepted it, and the handback that closes it.
A. Fields specific to a permit to work
| Field | What goes in it | Why it earns its place |
|---|---|---|
| Permit number and type | General, hot work, confined space, electrical, height, excavation, roof or live services | The type decides which sections apply and which certificates have to be attached. A hot work permit and a confined space permit are not the same document. |
| Valid from and valid to | Date and time at both ends | The end time is the field that makes it a permit. Work outside the window is unauthorised, which is why an expired permit cannot be extended after the fact. |
| Exact location of the work | Specific enough to stand on | Not the building, the spot. The next permit issued for the same location has to be readable against this one, and that only works if both are specific. |
| Hazard present, precaution in place | Eighteen hazards, each ticked twice, with detail and who checked | The two ticks are the point. A hazard marked present with no precaution beside it is a permit that should not be issued, and one column cannot show that. |
| Isolation and system status | Lockout applied, zero energy verified, detection and suppression status | This is where the permit meets the lockout procedure. It references the procedure and attaches the lock register rather than repeating it. |
| Protective equipment and standby | Twelve lines covering PPE, gas detection, rescue equipment and the attendant | Standby arrangements are what turn a confined space entry from a risk into a controlled one. The attendant and the communication method are named, not assumed. |
| Atmospheric testing record | Oxygen, LEL, carbon monoxide and hydrogen sulphide, with time and tester | One row per test, because one reading at the start of a shift is not monitoring. Retest before entry, after any break, and at the stated interval. |
| Hot work and fire watch | Combustibles cleared, watch during, watch continued after, final inspection | Most hot work fires start after the work has stopped. The continued watch and the final inspection are the lines that catch a smouldering start. |
| Issue and acceptance | Issuer and acceptor, each with a signature and a time | Two signatures for two different statements: the issuer certifies the precautions, the acceptor confirms everybody working under it has been briefed. |
| Extensions and suspensions | New valid-to, the reason, and whether conditions were re-checked | An extension is a fresh authorisation with the conditions confirmed again. If the time ran out first, the work stops and a new permit is issued. |
| Handback and cancellation | Ten steps, ending with the permit signed off and cancelled | The last line is the one that gets missed. An uncancelled permit means nobody can tell whether that area is safe, so the next permit is issued blind. |
If you cut the permit down, keep the two-tick hazard table and the cancellation line. The hazard table is the only part that shows the difference between a risk somebody noticed and a risk somebody controlled. The cancellation line is what makes the permit system a system rather than a pile of forms, because an area with an open permit against it is an area nobody can safely issue a second permit for.
B. What it looks like filled in
The life of one hot work permit, taken from the register: a bracket welded to a duct support in a plant room, issued at eight in the morning and closed out that evening.
| Time | Event | Detail | By whom |
|---|---|---|---|
| 08:00 | Permit issued | PTW-2026-0442, hot work, plant room B, valid to 17:00 | P. Okonkwo |
| 08:10 | Atmosphere tested | O2 20.9%, LEL 0%, CO 0 ppm, H2S 0 ppm, safe to enter | D. Osei |
| 08:20 | Work started | Weld bracket to duct support, fire watch posted, detection zone isolated | Ashdown M&E |
| 15:30 | Extended to 19:00 | Bolts seized, more time needed, conditions re-checked and retested | P. Okonkwo |
| 19:00 | Work stopped | Fire watch continues past the end of the work, not with it | D. Osei |
| 20:05 | Handed back and cancelled | Final inspection done, detection restored and logged, permit closed | P. Okonkwo |
Read the two bold rows together, because they are the two places this permit could have failed. The extension was authorised at half past three, an hour and a half before the permit expired, with the atmosphere retested as a condition of it. Had it instead been left until half past five, the permit would already have expired: the work would have had to stop and a new permit be issued, because an expired permit cannot be extended backwards. And the job finished at seven but the permit did not close until five past eight: the fire watch ran past the end of the work and a final inspection followed it, which is the sequence that catches a smouldering start behind a duct. The register records this one as closed clean, and both of those lines are why.
Word to adapt the hazard list and add your own permit types, Excel for the permit register that tracks extensions, gas tests and cancellations, PDF for the copy displayed at the work location. Free, and yours to rebrand.
How do you issue a permit to work?
Fill it in before the work starts, in the order the form is laid out, and do not sign the issue section until the precaution column is complete. Six steps.
Scope the permit to one job, one place, one window
Permit number, type, site and building, the exact location, and the valid-from and valid-to times. Then the related work order and any associated certificates: an isolation certificate, a lockout procedure, a scaffold handover, a gas-free certificate.
Record the work and check competence before issue
What the work is, the plant or system involved, who is carrying it out, the person in charge with a phone number, how many people, and what competence evidence you actually saw. The method statement is reviewed before issue, not filed after it.
Work the hazard table and tick both columns
Eighteen hazards from live electrical energy through to interruption of life safety systems. Tick present, then tick the precaution separately and write what it is. A hazard present with no precaution beside it means the permit is not ready to issue.
Confirm isolations, equipment and standby arrangements
Energy isolation applied under the lockout procedure with the lock register attached, zero energy verified at the point of work, detection and suppression status logged both ways. Then PPE, gas detection, rescue equipment, the attendant and how you will talk to them.
Test the atmosphere, then issue and accept
Record oxygen, LEL, carbon monoxide and hydrogen sulphide with the time and the tester, and set the retest interval. Then two signatures: the issuer certifying the precautions, the acceptor confirming the team has been briefed.
Hand back, then cancel
Work stopped at a safe point, area cleared and cleaned, guards refitted, everybody accounted for, isolations removed, detection and suppression restored and logged, barriers down. Then sign the permit off and cancel it, because an open permit blinds the next one.
A permit to work versus a lockout procedure
These two documents get treated as alternatives, and they are not. One authorises the work; the other controls the energy.
| Aspect | Permit to work | Lockout procedure |
|---|---|---|
| What it authorises | One job, in one place, for a stated window | Nothing. It controls energy on one machine |
| What it is written for | A job that is about to happen | A machine, once, and reused every time |
| Who signs it | An issuer and the person accepting the work | Whoever applies each lock, one row per lock |
| How long it lasts | Until the valid-to time or the handback | For as long as the locks are on |
| What it references | The lockout procedure and its lock register | Nothing outside itself |
| If you only have one | You may authorise work on a live machine | You may isolate a machine nobody approved work on |
The permit references the procedure; it never replaces it. Section 4 of this permit asks whether energy isolation has been applied under a written lockout procedure, whether the isolation certificate or lock register is attached, and whether zero energy was verified at the point of work. Those are three questions about a different document, and they are questions rather than instructions on purpose. A permit that tries to describe the isolation itself ends up as a generic description of a machine it was not written for, which is the same failure as a generic lockout procedure.
When the template starts to feel limiting
A pad of permits handles one job well. It handles a live site badly, and always in the same four ways.
Expiry cannot enforce itself
The valid-to time is the whole basis of the permit, and it is a number written on a form in somebody's pocket. Nothing stops work continuing past it, and nothing flags the permit that quietly expired at five.
You cannot see what is open
How many permits are live right now, in which areas, and which fire zones are isolated because of them. That is the question a control room needs at two in the morning, and a folder cannot answer it.
The permit and the work order live apart
The permit authorises work that exists somewhere else as a job. Keeping them in two systems means the permit can be cancelled while the work is still open, or the reverse.
Conflicts between permits go unnoticed
Two permits in the same plant room, one isolating the detection the other depends on. Nothing compares them, because comparing them means reading every open permit at once.
What running this in Facilio looks like
The template is the paper version of this permit. The fields are the same ones; the difference is that a valid-to time and an isolated fire zone become things the system knows about rather than things on a form in a pocket.
Work Completion Validator
A permit cannot be closed with the handback incomplete
On paper the permit is finished when somebody signs it. Work Completion Validator holds the ten handback steps against evidence, so detection restored without a logged time is caught before the permit cancels.
Ops Performance Intelligence
Expiry and extensions are enforced rather than remembered
The valid-to time is live, so a permit approaching expiry surfaces before it lapses and an extension has to be authorised while the permit is still valid rather than afterwards.
Audit Report Intelligence
Open permits and isolated systems become one view
Which permits are live, in which areas, and what is isolated because of them: held as data, so a control room or an auditor gets an answer instead of a search through a folder.
Contractor Work Tracker
Competence and the permit sit with the contractor record
Who is approved for hot work, what evidence was seen and when it expires sits against the contractor, so competence is checked at issue rather than taken on the day.
Hallucination-free by design. Atom AI answers from the records in your tenant rather than generating plausible text, so an empty field reads as empty rather than filled in for you.
Frequently asked questions
What is a permit to work?
A permit to work is written authorisation for one job, in one place, for a stated period of time. It records what the work is and who is doing it, which hazards are present and what precaution is in place against each, the isolations and the status of fire detection and suppression, the protective equipment and standby arrangements, and the signatures of the person issuing it and the person accepting it.
It closes with a handback: the area cleared, isolations removed, systems restored, and the permit formally cancelled. A permit that is never cancelled leaves the area in an unknown state.
What should a permit to work include?
The permit number and type, the site, the exact location, and the valid-from and valid-to times. The description of the work, the contractor or department, the person in charge, the number of people, the competence evidence seen and the method statement reference. Eighteen hazards each ticked for present and for precaution. The isolation and system status. Twelve protective equipment and standby lines.
Then the atmospheric testing record, the hot work and fire watch section, the issue and acceptance signatures, the extensions log, a ten-step handback, the cancellation, and the emergency arrangements for that specific job.
What is the difference between a permit to work and a method statement?
A method statement describes how the work will be done and is written in advance by whoever is doing it. A permit to work is authorisation to do it now, in this place, until a stated time, and it is issued by somebody responsible for the area rather than by the people doing the job.
The permit references the method statement and confirms it was reviewed before issue. One is a plan; the other is permission, and permission has an expiry time on it.
How long is a permit to work valid for?
For exactly the window written on it. That window should cover one shift or one continuous piece of work, and it needs a date and a time at both ends. A permit with no end time is not a permit.
If the work needs longer, the permit is extended before it expires: a new valid-to time, the reason, and the conditions re-checked and recorded. An expired permit cannot be extended retrospectively. Once the time has run out the work stops and a new permit is issued.
What is a hot work permit and what makes it different?
A hot work permit is a permit to work for anything producing heat, flame or sparks: welding, cutting, grinding, brazing or soldering. It carries everything a general permit does, plus a section for combustibles removed or protected within the required radius, floor and wall openings covered, and the status of the fire detection that has been isolated to stop the work setting it off.
The part that makes it different is the fire watch. Most hot work fires start after the work has finished, so the permit records a watch during the work, a watch that continues after it stops, a final inspection of the area, and the time the fire detection was restored and logged.
Does a permit to work replace a lockout procedure?
No, and treating it as though it does is a common and serious mistake. The permit authorises the job; the lockout procedure controls the energy in the machine, and it is written for that machine rather than for this job.
Section 4 of this permit asks whether isolation was applied under a written lockout procedure, whether the lock register is attached, and whether zero energy was verified at the point of work. It references the procedure rather than repeating it, because a permit that describes an isolation generically is describing a machine it was not written for.
Can I edit and rebrand this template?
Yes. It is free to use, edit, rename and put your own logo on, internally or for clients. No attribution required.
The Word version is the one to edit if you want to change the hazard list, add your own permit types or match your authorisation levels. The Excel version is the one to use if you want the permit register, which tracks type, validity, extensions, gas tests, the fire watch, handback and cancellation in one row per permit.
In one paragraph
A permit to work authorises one job, in one place, for a window of time with an end on it, and the end time is what makes it a permit rather than a note. Work the hazard table with both columns ticked, because a hazard marked present with no precaution beside it is a permit that should not be issued. Where the job involves isolating a machine, reference the lockout procedure and attach the lock register rather than describing the isolation here. Test the atmosphere and retest it, since one reading at the start of a shift is not monitoring. If the work overruns, extend the permit before it expires, never after. And close it: hand the area back through all ten steps and cancel the permit, because an area with an open permit against it is an area nobody can issue the next permit for safely.
The template is the floor, not the ceiling
Take the permit; it will authorise one job properly and stand up to an audit. When a pad of forms stops being enough, a connected CMMS runs the system: permits tied to the work order they authorise, expiry enforced rather than remembered, isolated fire zones visible while they are isolated, and every open permit on the site as one list.
