The permit can feel like the thing standing between you and getting on with the job. A form to fill, signatures to chase, an officer to track down, all for a task you have done a dozen times before. That irritation, the sense that the paperwork is the obstacle, is exactly the frame of mind that gets people hurt, because the jobs that kill and maim at sea are rarely the ones everyone already treats as dangerous. They are the routine ones, done one more time without stopping to check what had changed since the last time.
A permit to work exists to force that stop. It is the structured pause that makes a crew confirm, in writing and out loud, that a hazardous job has actually been made safe before anyone starts. Understanding it is not about learning to fill in a form. It is about understanding why the form exists, what it is really checking, and where the system quietly breaks down when people treat it as a signature rather than a safeguard.
What a Permit to Work Actually Is
A permit to work is part of the ship’s safety management system, the set of procedures every vessel must operate under the ISM Code. It is a documented authorization for non-routine, high-risk work, the tasks that ordinary operating procedures do not cover, and it ties that work to a specific place, a specific time, and a specific set of precautions. The single most important thing to understand about it comes straight from the Code of Safe Working Practices: a permit to work does not, in itself, make a job safe. The controls make the job safe. The permit confirms that those controls are in place, fixes a time limit on the work, and records who authorized it and who is carrying it out.
That distinction is not academic, because it tells you what the permit is for. It is a barrier against the assumption that because a job was safe last week it is safe today, and it is a communication tool that puts the person doing the work and the officer responsible for it on the same page before anyone commits. A permit signed without the controls actually being checked is worse than no permit at all, because it manufactures confidence where none is justified. The form is only as good as the verification behind each line of it.
When You Need One
A permit is triggered by the hazard, not by how familiar the task feels, and the categories are consistent across the industry. The most dangerous of all is enclosed space entry, where an unbreathable atmosphere can kill in a breath, but the list is longer than that. Hot work such as welding, cutting, or grinding, with its ignition and fire risk, almost always needs one. So does working aloft or over the side, where a fall is the hazard, and electrical work on live or high-voltage systems, and any work on machinery that must be isolated so it cannot start while hands are inside it. Work on deck in heavy weather, lifting operations, and work on pressurized or refrigeration systems commonly fall under permits too.
The thread running through all of them is that the risk cannot be controlled by routine practice alone, so the work is lifted out of the ordinary and placed under a controlled procedure. The trap is the experienced hand who decides a particular job is too familiar to bother with a permit. That judgment is precisely the one the system is designed to take out of any single person’s hands, because the accident record is full of competent people who had done the job safely many times right up until the time they did not.
What a Permit Contains and How Isolation Fits In
Every permit, whatever the task, is built from the same parts, and each part is a question that must be answered honestly before work starts. It states the job and its exact location, lists the hazards identified by the risk assessment, and sets out the control measures that bring those hazards down to an acceptable level. Those controls are where the real safety lives: ventilation and atmosphere testing for a space, fire watch and screening for hot work, harness and lifeline for work at height, and the right protective equipment for the task, drawn from the same thinking as any other use of PPE. The permit then carries the authorization, the time limit, and the arrangements for handing the worksite back when the job is done.
For a great many jobs, the central control is isolation, making sure the thing being worked on cannot move, energize, or release its contents while someone is exposed to it. On a modern ship this is done through lock-out, tag-out, where the energy source, an electrical breaker, a valve, a hydraulic line, is physically locked in the safe position and tagged so that no one can restore it by mistake. A push button or a control switch is not an isolation; only a device that physically breaks the supply counts. The permit records the isolation so that everyone knows the equipment is locked out, and so that it is not restored until the work is finished and the permit is closed. Getting an isolation wrong, or removing it too early, has killed people who were certain the machine they were inside could not start.
The People and the Roles
A permit only works because it assigns responsibility to named people rather than leaving safety to whoever happens to be present. The authorizing officer, sometimes called the responsible person, is the one designated under the safety management system to issue the permit and, just as importantly, to close it. The competent person is the one carrying out the work, who countersigns to show they have understood the hazards and the precautions they are agreeing to follow. On many ships a separate person is responsible for completing and confirming the isolations. Above all of them, the master holds overall accountability, and commonly authorizes the most dangerous permits personally, hot work near cargo or a complex enclosed space entry, while delegating routine permits to heads of department.
None of these roles is a formality, and the system depends on each person actually doing their part rather than signing on trust. The bridge belongs in the loop as well, because a permit often affects more than the worksite. When someone is working on a radar, an aerial, or anything the bridge might energize or operate, the officer of the watch has to know, so that the equipment stays dead until the work is done and the permit is closed. The moment a permit becomes one person’s paperwork rather than a shared agreement, its protection starts to leak.
The Permit Lifecycle: Issue, Monitor, Hand Back
A permit is not a one-time signature at the start of a job. It is a loop with a defined beginning and, crucially, a defined end, and the diagram below shows how it runs.
Once issued, a permit is valid only for a stated period and only for the work it describes. If the time runs out, if the job is interrupted, or if anything about the conditions changes, the authorization stops and the situation has to be reassessed before work continues. Throughout the job the conditions are monitored, gas levels in a space, heat and sparks in hot work, weather and motion aloft, because a permit is a living control, not a snapshot taken once and trusted for hours. The part people most often rush is the end. Hand-back is the deliberate confirmation that the worksite has been left safe, that isolations have been cleared in the right order, and that equipment can be returned to service. A permit that is never properly closed leaves the ship in an ambiguous state, with isolations possibly still in place or, worse, removed while someone still relies on them.
Where Permits Fail
Knowing the system is easy; the value is in knowing how it breaks, because permits rarely fail through ignorance of the rules. They fail when someone signs without checking, treating the form as the goal rather than the verification, so the controls are recorded as done without anyone confirming they actually are. They fail through scope creep, when a team does a little more than the permit covers, or moves to a nearby space the permit never assessed. They fail when a permit is allowed to run past its time while the work carries on, so that a control that was valid in the morning is quietly relied on into the afternoon. And they fail at hand-back, when isolations are restored too soon, or a permit is left open and forgotten, or the bridge is never told the work is finished.
The common factor in all of these is the same human pressure the system exists to resist: the urge to keep moving and treat the procedure as friction. A permit to work is one of the clearest places where good seamanship shows, because it is invisible when it works and catastrophic when it is skipped. The crews who run it honestly, every time, are not being slow. They are refusing to let a familiar job become the one that goes wrong.
Frequently Asked Questions
What is a permit to work system on a ship? It is a formal, documented procedure within the ship’s safety management system, required under the ISM Code, that controls non-routine high-risk work. The permit identifies the job and its hazards, confirms the control measures, authorizes the work for a set time and place, and defines how the worksite is handed back when the job is finished. It does not make the work safe by itself; it verifies that the work has been made safe.
What jobs need a permit to work? Tasks whose risks cannot be controlled by routine procedures alone. Common examples are enclosed space entry, hot work such as welding and cutting, working aloft or over the side, electrical and high-voltage work, work on machinery that must be isolated, lifting operations, and work on deck in adverse weather. A permit is triggered by the hazard, not by how routine the task feels.
Who is responsible for a permit to work? An authorizing officer, designated under the safety management system, issues and closes the permit. The competent person carrying out the work countersigns to confirm they understand the hazards and precautions, and a designated person often confirms the isolations. The master holds overall accountability and commonly authorizes the most dangerous permits personally.
What is lock-out, tag-out in a permit to work? Lock-out, tag-out is the method of isolating an energy source so that equipment cannot move, energize, or release its contents during work. The source, such as an electrical breaker or a valve, is physically locked in the safe position and tagged so it cannot be restored by mistake. A control switch or push button is not an isolation; only a device that physically breaks the supply qualifies.
Why do permit to work systems fail if the rules are clear? Permits rarely fail through ignorance. They fail when people sign without verifying the controls, extend the work beyond the permit’s scope, let the permit run past its time limit, or rush the hand-back so isolations are cleared wrongly or the worksite is left in an ambiguous state. The system fails when it is treated as paperwork rather than a shared safety agreement.