Why permit to work systems decay, and how to stop it

We have reviewed a good number of permit to work systems. The pattern of decay is remarkably consistent.

Month one

The system is new, the training is fresh, and permits are completed carefully. Issuers walk the job before signing. Isolations are proved. Everyone is slightly nervous, which is exactly right.

Month three

Volume has built up. Issuers are signing permits at a desk rather than at the job. The hazard sections start to repeat the same three entries regardless of the task. Nobody has done anything wrong yet, but the permit has stopped being an assessment and started being a form.

Month six

Permits are pre-populated. Isolation certificates reference a standard list rather than the actual isolation points. Somebody has produced a photocopied permit to save time. The system now provides documentation rather than control, which is the worst of both worlds because it also provides false assurance.

What stops it

Three things, in our experience. First, a permit audit routine with teeth, where someone independent walks live jobs against live permits weekly. Second, authorisation limits that force higher risk work up to a named authorised person rather than whoever is on shift. Third, and most importantly, visible management interest. Permit quality tracks almost exactly with how often a manager has been seen looking at one.

The technical design of a permit system matters far less than most people assume. What matters is whether anyone checks.