CHIRP: Permit to work systems are not a full risk management
CHIRP Maritime has examined how permit to work systems can become focused on administrative compliance rather than actively managing risk, highlighting the importance of challenge, communication and adapting to changing conditions.
According to CHIRP, a permit to work is not, by itself, proof that risk has been effectively controlled. Its value lies in whether it prompts people to identify hazards, challenge assumptions, communicate clearly and adapt controls before and during high-risk tasks. The permit should therefore be seen as the beginning of risk management, not the end of it.
Because permits are often issued routinely on vessels, familiarity can lead people to stop actively processing the information and instead recognise the familiar format and procedures. This does not necessarily mean carelessness, but it can reduce attention to changing or unexpected circumstances.
When compliance becomes the measure of success
Similarly, investigations and audits can focus heavily on whether a permit existed, was signed and contained the required signatures. While these checks confirm compliance and create an audit trail, they do not establish whether the permit actually changed how the risk was understood, discussed and managed. The real measure of success should be whether the permit made the work safer, rather than simply whether the paperwork was completed.
The more important questions are harder to audit:
- Did anyone challenge the assumptions behind the permit?
- Did the conditions change after it was issued?
- Did the permit influence the decisions made by the work party?
- Did anyone feel empowered to stop the job when something no longer looked right?
- Did someone ask: “What if?”, “Is this really sufficient?” or “Can this be done within our work hours?”
The real measure of success is therefore not whether the permit was completed correctly, but whether it changed behaviour, encouraged challenge and helped people recognise when it was no longer safe to continue.
The illusion of shared understanding
CHIRP reports have shown situations where people signed because everyone else had signed, because they trusted the supervisor, or because the permit had become routine. An assumption can develop that someone else has already checked everything.
Responsibility becomes diluted. The important question is not whether people signed the permit, but whether they understood the hazards, the control measures and their own responsibilities. If the answer is no, the work should be stopped, and the permit reviewed before work continues.
Risk is dynamic; permits must be dynamic too
A permit captures the risk picture at a particular moment in time; however, work rarely takes place in a static environment.
- Weather conditions deteriorate and vessel movements increase.
- Ventilation arrangements change.
- Additional crew and/or contractors arrive.
- Unexpected defects are discovered.
- The job takes longer than planned.
- Work and rest hour limits are reached.
The permit that was valid at the start of the task may no longer reflect the conditions several hours later. An effective permit system recognises this reality. It encourages people to pause, review and challenge their assumptions whenever conditions change.
A useful question for any work party is:
“If we were issuing this permit right now, knowing what we know now, would we still approve the job under the same conditions?”
If the answer is no, the work should be stopped, and the permit reviewed before work continues. The permit that was valid at the start of the task may no longer reflect the conditions several hours later.
A familiar scenario
Consider an enclosed-space entry into a ballast tank. Atmospheric tests are completed, safety equipment is ready at the site, lighting, communication and personnel are in place, the permit to work is issued, and entry begins.
Initially, conditions are exactly as expected.
As the work progresses, additional tasks are requested, equipment and materials are brought into the space, ventilation arrangements are adjusted, and the job starts taking longer than planned.
The permit remains valid on paper, but the conditions under which it was approved have changed.
A similar situation can occur during hot work. Cargo operations nearby change, additional ignition sources are introduced, or contractors begin unrelated activities close to the worksite. None of these developments may have existed when the permit was signed.
Likewise, during work aloft alongside, vessel traffic movements may increase, weather conditions may deteriorate, or operational pressure may build as sailing time approaches.
In each case, the hazard is not that the permit was wrong when it was issued. The hazard is failing to recognise that the situation has evolved.
The safest teams treat a permit as an ongoing conversation about risk rather than a one-time approval.
What effective permit use looks like
The most effective permit to work systems are not necessarily those with the most signatures or the longest checklists.
They are the systems that stimulate useful conversations and encourage people to think about how the work might change once it begins.
Good permit discussions include questions such as:
- What could change during this job?
- What assumptions are we making, and how will we know if they remain valid?
- What would make us stop the job and reassess?
The permit document is only one part of the control process. The real safety value comes from the planning, challenge, verification and communication that surround it.
In that respect, a permit is not simply a form. It is a structured process for managing risk.
The unintended consequence
Ironically, the more polished and administratively robust a permit system becomes, the greater the risk that people focus on completing the paperwork rather than engaging with the hazards.
Nobody deliberately sets out to make permits bureaucratic. However, if a permit grows from two pages to six, with multiple signatures and extensive checklists, attention can naturally shift towards getting through the process.
People can begin managing the document instead of managing the risk.
The objective should therefore not be to make the permit to work system more complicated, but to make it more effective at encouraging people to think, communicate and challenge.
A different way of thinking
Perhaps the industry has been asking the wrong question.
Instead of asking: “Do we have a permit to work?”, we should ask:
“Has this permit to work changed the way we are about to carry out this task?”
If the answer is “No”, the permit may have added administration but little safety value.
A good permit should influence how people approach the job. It should make hazards visible, confirm that controls are understood, encourage challenge and provide a clear basis for stopping and reassessing the work when circumstances change.
Questions to consider
When using a permit to work system, ask yourself:
- When did a permit last cause you to change the way you intended to do the job?
- Do people read the permit to understand the hazards, or simply recognise it as permission to proceed?
- Do signatures demonstrate genuine understanding, or simply that someone was present?
- If conditions change, does the work change with them?
- Could a new crew member explain why each control is necessary, or would they simply follow the checklist?
- If you were uncomfortable with the job, would you feel able to stop it, even if everyone else wanted to continue?
These questions are difficult to answer through an audit alone. They require us to look beyond the document and consider what is actually happening at the worksite.
The real test is not whether the permit was completed. It is whether the permit helped people make better decisions.
Concluding thoughts
A permit to work should never be seen simply as permission to start work. It should provide evidence that the hazards have been understood, controls have been verified, and risks will continue to be managed throughout the task.
The permit itself is not the control. The control is the quality of the conversations, challenge, verification and monitoring that take place before and during the work.
The safest permits are not necessarily those with the most signatures. They are the ones that encourage people to pause, think, question assumptions and adapt when conditions change.
So, CHIRP concludes, before the next job begins, ask yourself:
- Will this permit simply allow the work to start, or will it help us recognise when the work should stop?
- That is the real test of whether your permit to work system is working.
Content Original Link:
" target="_blank">
