Who issues and who signs a permit to work
roles, authority, and where the responsibility actually sits

A permit with the wrong name on it is worse than no permit: it looks like control while nobody has actually taken responsibility. The signatures are the point of the document — each one is a person saying “I checked this, and I am answerable for it”.

The three questions behind the three signatures

Every permit system in the world, whatever it calls its roles, answers the same three questions before work starts:

1. Is the plant safe to release? — answered by the person who owns and understands the installation.
2. Is the crew ready to accept it? — answered by the person who will lead the work and answer for the people doing it.
3. Does anything else in the area conflict? — answered by whoever holds the overall picture of what else is running.

Competence is a decision, not a job title

Someone at the site has to have looked at this person, on this plant, for this permit type, and decided they are competent. That decision has three parts and all three are auditable: appointment (a written record naming the person and the scope), assessment (training plus demonstrated understanding of this installation), and currency (it was renewed, and it has not lapsed).

The most common finding after an incident is not a missing signature. It is a signature from someone whose appointment did not cover that permit type, that area, or that period. When that happens the authorisation is treated as absent, and the responsibility moves to whoever appointed them.

What each signature actually means

• The issuing signature says: I have made this equipment safe by the means listed here, and I have proved it, and nothing I know of will change while this permit runs.
• The accepting signature says: I have read these conditions on site, I understand what may not be done, and my crew has been briefed on it.
• The gas test signature says: I took these readings myself, at that place and time, with an instrument in calibration.
• The closing signature says: work is finished or stopped, people and tools are out, guards are back, isolations are ready to be removed.

That last one is the one people skip, and it is the one that hands a live hazard to the next shift.

Delegation, handover and shift change

Authority can be delegated only to someone appointed for the same scope, and the handover must be face to face with the permit in hand. A permit does not survive a shift change on its own: either it is formally handed over and re-signed, or it is closed and a new one is raised. “It was still valid” is not an answer if nobody on the incoming shift knew the job was running.

Contractors: two companies, one set of signatures

On most industrial sites the crew doing the work is not employed by the operator who owns the plant — and the permit is where the two companies formally meet. The division of the signatures does not change: the issuing authority stays with the operator, because releasing the plant as safe requires knowing the plant, and that knowledge cannot be subcontracted. The performing authority sits with the contractor’s supervisor, because answering for the crew requires knowing the crew.

Three things go wrong at this interface more than anywhere else:

• The contractor’s supervisor signs without walking the job. Accepting a permit from an office chair means accepting conditions nobody has looked at. The acceptance signature is given at the worksite, with the isolations pointed at, or it means nothing.
• Two permit systems collide. An international contractor brings its own procedures; the operator has its own. The working rule that survives audit: the operator’s system governs the permit, the stricter requirement governs each control, and the bridging document — agreed before mobilisation, not during the job — says so in writing.
• Sub-subcontractors appear on nobody’s permit. Every person at the worksite is under some permit’s crew list. A rigger borrowed for an hour from the neighbouring job is either signed on, or sent back.

Electronic permits: what changes and what must not

Digital permit systems change the mechanics of the signature — a login instead of a pen — and that is acceptable in most jurisdictions as long as three properties hold: the record is attributable (one account, one person, no shared logins), time-stamped, and immutable after signature (corrections are new entries, not edits). What must not change is the meaning: an approval tapped from the canteen has exactly the value of a paper permit signed without a site walk — none. A good electronic system makes the walk harder to skip, by tying the gas reading, the location and the acceptance together; a bad one makes skipping it frictionless. When choosing or auditing one, that is the question to ask: does it prove the check happened, or merely that a button was pressed?

How an auditor reads the signature block

Auditors rarely start with the hazards; they start with the names, because the names fail faster. The standard passes are worth knowing because they are the same passes an investigator makes after an incident:

1. Does each signatory hold a current appointment for this permit type in this area?
2. Is the gas test signed by the person who took the readings, with time and instrument recorded?
3. Are acceptance and issue signed by different people?
4. Does the crew list match the people who were actually at the worksite?
5. Was the permit closed — and by someone entitled to close it?

Five questions, all answerable from the document itself. A permit that survives them was probably a real control; a permit that fails the first one was paperwork, whatever else it says.

Stop-work authority

The right to stop is deliberately the widest right in the system. It belongs to the issuing authority, the area authority, the supervisor, the attendant, the fire watch and the person holding the tool. It needs no explanation at the moment it is used, and a site where it is used and then quietly punished does not have a permit system — it has a filing system.

Frequently asked questions