A permit to work is a formal written authorisation that controls specified high-risk activities — hot work, confined space entry, work on live electrical systems, work at height in unusual circumstances, excavations, and isolations. UK law does not name a single 'Permit to Work Regulation', but the duty arises from the Health and Safety at Work etc. Act 1974 and is operationalised through the Management of Health and Safety at Work Regulations 1999 and activity-specific regulations including the Confined Spaces Regulations 1997 and CDM 2015. HSE guidance HSG250 is the practical reference. A working permit system follows a seven-step lifecycle (identification, assessment, preparation, issue, work, suspension, closure) and assigns three separate roles: Issuer, Acceptor and Worker. Most permit failures are not paperwork failures — they are failures of the conversation the paperwork is meant to force.
A permit to work is not a piece of paper. It is a conversation, written down, between someone who understands a hazard well enough to authorise work and someone who is about to do that work. The paper is the residue of that conversation. Treat it as the thing itself and the system fails — usually quietly, until it doesn't.
This guide explains how permit to work systems are meant to function in UK workplaces, where they sit in law, the seven-step lifecycle most well-run schemes follow, and the patterns of failure that have killed people on sites that had paperwork in perfect order. If you're building a scheme, auditing one, or working under one, the same fundamentals apply.
A permit to work is a formal written authorisation that controls specified high-risk activities. It does three things at once. First, it confirms that a hazard has been assessed for this specific job, in this specific location, on this specific day. Second, it records the precautions in force — isolations, atmospheric testing, fire watch, rescue arrangements, communication protocols. Third, it transfers temporary responsibility for an area or system from operations to the people doing the work, and back again when the job is done. The permit is the audit trail.
Permits are typically required for hot work (welding, cutting, grinding in areas with combustible materials), confined space entry, work on live electrical systems, work at height in unusual circumstances, excavation in areas with buried services, and isolation of plant for maintenance. Some sites also operate cold work permits on the principle that anything entering a hazardous area should be logged and tracked. The exact list depends on the site — what matters is that the threshold for permit control is documented and applied consistently.
There is no single 'Permit to Work Regulation'. The duty arises from a combination of statutes and regulations that together create the legal framework UK courts apply.
| Statute / regulation | What it requires |
|---|---|
| Health and Safety at Work etc. Act 1974 | Section 2 general duty to provide and maintain safe systems of work. Permit to work is the standard means of compliance for high-risk activities. |
| Management of Health and Safety at Work Regulations 1999 | Risk assessment and proportionate controls for all work activities, including the highest-risk subset where permits apply. |
| Confined Spaces Regulations 1997 | Safe system of work for confined space entry — in practice this means a permit, supported by atmospheric testing and rescue arrangements. |
| Construction (Design and Management) Regulations 2015 | Proportionate controls for construction risks. Most CDM-governed sites operate permits for the high-risk subset of activities. |
| Electricity at Work Regulations 1989 | Work on or near live conductors must be properly controlled. Permit to work is the standard mechanism. |
HSE guidance HSG250 (Guidance on permit-to-work systems) is the document most UK schemes reference. It is not law, but a competent court will treat departure from it as something an employer must be able to justify. The 2005 edition remains the current version.
A well-run permit moves through seven stages. Skipping any of them is the failure mode — and on most sites that have had a permit-related incident, the failure was either a skipped step or a step compressed into another one.
The lifecycle is sequential and the steps are non-substitutable. A scheme that has the form filled in but cannot demonstrate that step 3 actually happened, separately from step 4, is not running a compliant system regardless of what the paperwork looks like.
A permit needs three people, even on small jobs. They can occasionally be combined, but the roles are functionally distinct and most well-run schemes require strict separation between the first two.
| Role | Responsibility | Typical authority |
|---|---|---|
| Issuer | Authorises the permit. Verifies preparations are in place. Defines the limits of the permit. Owns the area until the permit is closed. Has authority to refuse to issue. | Site manager, area authority, designated permit issuer with documented competence at appropriate level. |
| Acceptor | Accepts responsibility for the work within the permit's boundaries. Briefs the work crew. Stops work if conditions change or if the precautions cease to be adequate. | Supervisor or lead engineer of the team carrying out the work. |
| Worker | Carries out the task within the precautions specified. Has authority to refuse or stop work if controls fail or if conditions deviate from those briefed. | Trained operative, contractor, technician with appropriate competence for the task. |
Issuer and Acceptor must not be the same person. This is the single most-violated rule in informal schemes, and the one that audit findings tend to circle back to. The point of separation is that two pairs of eyes have looked at the precautions before work starts — one from the perspective of the area being affected, one from the perspective of the team being affected. Collapsing the roles eliminates that check.
In larger schemes, additional roles appear — an Authorising Engineer who designs the isolation strategy for complex work, a Senior Authorised Person for high-voltage electrical work, a Standby Person for confined space entry. The principle is the same: distinct roles, distinct competencies, signatures that mean something.
Permits fail in a small number of recurring ways. Knowing them is half of running a scheme well.
The job changes — a different valve, an extra weld, a longer duration — and the permit is not updated. The paperwork describes one job; the actual work is another. This is the most common failure and the easiest to police, because it shows up immediately in any walk-around audit. Schemes that include unannounced permit audits as part of normal supervision catch drift early; schemes that don't tend to discover it after the incident.
A permit issued on day shift is treated as still valid by night shift, even though the conditions have changed and no formal handover has happened. Schemes need an explicit re-validation rule for shift change, and most do, but enforcement is weak when the site is busy. The discipline tends to be strongest in petrochemical and offshore environments where shift handover is built into operating procedure, and weakest on construction sites where shift boundaries are looser.
The permit says the line is isolated. The line is not isolated, or it is isolated at the wrong point, or the isolation has been removed by someone working a different job. Lock-out/tag-out discipline is what prevents this; permits assume it is already in place. When LOTO is weak, permits issued on top of unreliable isolations carry false confidence into the work.
The 1988 explosion on the Piper Alpha platform in the North Sea killed 167 people. The official inquiry under Lord Cullen identified permit to work failure as a primary cause: a pump was returned to service while still under maintenance because two permits — one for the maintenance, one for the start-up — had not been cross-referenced at shift handover. The system on paper was sound. The communication between shifts and between control rooms was not.
Cullen's recommendations restructured offshore safety in the UK and led directly to the Offshore Installations (Safety Case) Regulations 1992. The lesson generalises beyond offshore: a permit scheme is only as good as the conversations the paperwork forces. Where conversations are skipped — at handover, between contractors, across operations and maintenance — the permits stop protecting against the failure modes they were designed to catch.
A supervisor signs as Acceptor on behalf of a crew who have not been briefed. The crew arrives, starts work without the briefing, and the precautions exist only in the supervisor's head. This is endemic in contractor-heavy environments and is the failure most often associated with hot work fires — the welder never heard the brief about removing combustibles from the work area, because the brief never happened.
The permit is signed off because the job is 'finished', without anyone walking the area to confirm tools, fire blankets, or temporary services have been removed. A surprising number of fires start hours after the welders have left. Closure verification is the cheapest control in the lifecycle and the most commonly skipped.
If you're building a permit scheme from scratch, the temptation is to start with the form. Start with the activities instead. List every routine and non-routine task on the site, classify each as needing a permit, a risk assessment, or normal procedure, and only then design the form. A form designed before the activity inventory tends to ask for the wrong information and miss the right information.
If you're auditing an existing scheme, the questions worth asking are not about the paperwork. They are:
If any of those answers is uncomfortable, the paperwork is not the problem. The paperwork is the symptom; the issue is the discipline behind it.
Issuers, Acceptors, and Workers need different training, and the regulations expect that distinction to be reflected in the scheme. The three populations are not interchangeable, and the most common audit finding in this space is a scheme where everyone has had the same generic course regardless of the role they actually fulfil.
Workers operating under permits need to understand what a permit covers, what the precautions mean for the work they are about to do, and the authority they have to stop if things change. A short structured awareness course — like our Permit to Work Awareness session — is the appropriate level for crew who will be Workers under someone else's permit but will not raise or accept permits themselves. Site-specific induction sits on top of this; the awareness training is the baseline.
Acceptors need more than awareness. They need to understand the limits of what a permit covers, the authority to stop work, how to brief a crew effectively, and how to refuse work when the precautions on paper don't match the conditions on the ground. They also need to understand the wider scheme well enough to interface with the Issuer credibly. Our Comprehensive Permit to Work (General & Specific) course covers this depth and is the level most supervisors who will accept permits should reach. Acceptor training is shorter than Issuer training but the operational test is the same: can they hold the line under production pressure?
Issuers carry the most demanding role. They need to understand the legal framework, the site's specific hazards, the authority they hold, and the consequences of getting it wrong — and they need to be able to write a permit that someone reading it under pressure can act on safely. This last point is where most Issuer-level training falls short. Our Permit to Work Writers Course addresses precisely this: the discipline of writing permits that work in practice, not just on paper. Generic e-learning does not produce competent Issuers. Most well-run schemes pair structured Issuer training with a documented period of supervised issue, where a trainee Issuer raises permits under the eye of an experienced one before being signed off independently. The supervised period is typically three to six months on complex sites.
Above the role-specific permit training, broader management qualifications support the people accountable for the scheme. The IOSH Managing Safely qualification is widely used at supervisor level and covers permit systems alongside the broader management framework. For more advanced process safety roles, the NEBOSH National General Certificate is the standard qualification and covers permit to work as part of its workplace hazard management content. For senior leaders and directors carrying ultimate accountability for site safety, IOSH Leading Safely covers the strategic-level duties.
There is no single regulation requiring a permit by name. The Health and Safety at Work etc. Act 1974 requires safe systems of work, and for activities like confined space entry the practical means of compliance is a permit. HSE guidance HSG250 is the document UK schemes are measured against in court.
No. Most well-run schemes prohibit this because the separation of authority is what gives the permit its protective value. Combining the roles eliminates the cross-check that two distinct people have looked at the precautions before work starts.
Typically a single shift, or 12 hours, whichever is shorter. Longer permits drift away from the conditions they were issued under. Schemes that allow multi-day permits without re-validation tend to find that the conditions have changed in ways the permit doesn't reflect.
Two permits — one for pump maintenance, one for start-up — were not cross-referenced at shift handover, leading to a pump being returned to service while still under maintenance. The 1988 explosion killed 167 people. The Cullen Inquiry made permit reform a central recommendation and reshaped offshore safety in the UK.
No. Contractors work under the host site's permit scheme, with the host's Issuer authorising work and the contractor's supervisor typically taking the Acceptor role. Contractor-on-contractor work in shared spaces requires explicit interface arrangements set out in the scheme.
A method statement describes how a job will be done. A permit authorises that the job can be done at this place, at this time, under these specific precautions. Method statements feed into permit issue but do not replace it. A signed method statement does not authorise work; only a signed permit does.
If your organisation is building or refreshing a permit scheme, the highest-leverage starting points are:
For training matched to specific permit roles, our Permit to Work Awareness course suits Workers operating under permits, the Comprehensive Permit to Work (General & Specific) course is the right level for Acceptors, and the Permit to Work Writers Course covers the discipline of issuing permits that hold up in practice. For broader management training that puts permits in the wider H&S context, see our IOSH Managing Safely and NEBOSH National General Certificate qualifications. Call us on +44 (0) 3300 569534 for tailored advice on the right training for your team or scheme.
For related guidance, see our 5 Steps to Risk Assessment — the assessment framework that feeds into permit issue — and our forthcoming guide on the Confined Spaces Regulations 1997, which covers the activity most commonly governed by permits.
