Permit to Work Minimum Standard for Technical Jobs

• Which technical jobs should be controlled through a permit-to-work system.
• How the permit connects with the risk assessment, method statement and isolation record.
• Who requests, authorises, accepts, suspends and closes a permit.
• How contractor work and simultaneous operations should be coordinated.
• What evidence should remain once the equipment or work area has been handed back.

The welding contractor is onboard at 07:00 with the equipment ready. The yard supervisor wants to start before another team begins work nearby.

A hot-work permit has been prepared, but it only says “weld bracket in tender garage”. The far side of the bulkhead is behind interior panelling and has not been inspected. Part of the fire-detection system was isolated during the night shift, nobody has been named as fire watch, and another contractor is preparing to use solvent-based products in an adjacent space.

The welder may be competent and the repair may be straightforward. The work still cannot begin.

This is where the permit system earns its place. It forces the yacht and yard to agree the exact job boundary, confirm the precautions and deal with other activity that could change the risk.

A permit to work is a formal, recorded authorisation for a defined job at a specific location and time. It identifies the work, the hazards, the precautions and the people responsible for maintaining those precautions.

The UK Health and Safety Executive describes it as a means of communication between those managing the work, those controlling the area or equipment and the people carrying out the job. It also states that issuing a permit does not, by itself, make the job safe.2

On a yacht, the permit should answer five practical questions:

• What work is authorised?
• Where does the job begin and end?
• Which conditions must remain in place?
• Who is controlling the work and the affected area?
• What causes the authorisation to be withdrawn?

The permit only covers the scope written on it. If the contractor finds that an additional bracket must be cut away, a pipe opened or a cable moved, the job has changed. Work stops while the new scope is assessed.

The yacht’s Safety Management System should define the types of work requiring permits, the authorised roles, the approval limits and the process for suspension and close-out. The ISM Code requires companies to establish procedures, plans and instructions for key shipboard operations affecting personnel, the vessel and the environment.4

A permit system becomes useful when work could affect people, machinery, essential services, fire safety, pollution prevention or the safe operation of the yacht. Applying permits to every routine task can weaken the system by turning signatures into habit. The SMS should set a threshold that crew can understand and use consistently.

The MCA Code of Safe Working Practices for Merchant Seafarers identifies permit-controlled activities including hot work, enclosed-space entry, working aloft or overside, machinery work and electrical work.1

Detailed electrical isolation documentation sits outside the scope of this article. Use YachtByte’s Electrical Permit to Work and LOTO Minimum Standard when defining electrical isolation, locking, tagging and test-before-touch records.

Job titles vary between yachts, but the responsibilities need to remain clear.

The person requesting the work defines what needs to be done and provides the available technical information. A vague work order usually produces a vague permit.

The permit preparer reviews the job, the worksite, the risk assessment, the contractor’s method and any isolations. This role also checks for other permits or operations affecting the same space or equipment.

The authorising officer decides whether the work may begin. Depending on the SMS and work type, this may be the Chief Engineer, Master, Chief Officer, ETO or another specifically appointed person. The authoriser needs suitable competence and authority for the job. Approval should include a worksite visit rather than a signature from the shipyard office.

The person in charge of the work accepts the permit on behalf of the work party. By accepting it, that person confirms that the scope, hazards and precautions have been understood and explained to everyone involved.

Where isolation is required, the competent person responsible for that isolation confirms the correct energy sources, isolation points, locks, tags and verification tests. The isolation record should be cross-referenced to the main permit.

Smaller yachts may need one senior officer to perform several administrative roles. The SMS should still provide an independent check for the highest-risk work. HSE guidance advises that a person should not issue a permit to themselves and recommends stronger authorisation where the potential harm is particularly high.3

Every crew member and contractor should have authority to stop the job when conditions become unsafe or depart from the permit. The SMS needs to say this clearly. People are less likely to intervene when they believe only the permit issuer can stop work.

These records serve different purposes and should be linked rather than combined into one overloaded form.

• The risk assessment identifies what could go wrong and selects the controls.
• The method statement describes how the work will be carried out and in what sequence.
• The permit confirms that the job, location, timing and precautions have been authorised.
• The isolation or LOTO record identifies the energy sources secured for the work.
• The toolbox talk confirms that the work party understands the job and current conditions.

The contractor’s method statement may be technically sound while missing yacht-specific dependencies. A machinery repair might also affect fire detection, bilge alarms, stabilisers, watertight doors, ventilation or emergency power. The yacht’s technical team must connect the contractor’s work to the vessel’s systems.

The same principle applies in a shipyard. The yard and yacht should agree which permit system leads, how permits are cross-referenced and who controls the work area. Two independent permits do not provide two layers of protection if neither party knows what the other has authorised.

Return to the tender-garage repair. Before the permit is issued, the Chief Engineer or authorised officer walks the job with the contractor and yard representative.

The exact bracket and hot-work boundary are marked. Access is opened to inspect the opposite side of the bulkhead. Interior materials, insulation, cables and pipework that could be affected by heat are identified. Combustible material is removed where possible, and the remaining surfaces are protected.

The fire-detection isolation is then reviewed. The permit records which devices or zone will be affected, who approved the isolation and what temporary measures will cover the loss of automatic detection. The bridge, engine control room and yard fire-safety contact are informed. Responsibility for reinstating and testing the detection system is assigned before welding begins.

Fire-watch arrangements cover the worksite and any concealed or opposite side that the welder cannot see. Suitable extinguishing equipment is immediately available. The person performing the fire watch has no competing task that would pull them away.

The daily yard coordination meeting shows that a painting contractor intends to use solvents nearby. That work conflicts with the hot-work boundary, so one activity is delayed. The decision is recorded against both jobs.

Later in the day, ventilation stops and the painting team returns earlier than planned. The contractor pauses welding, shuts down the equipment and reports to the permit issuer. The permit is suspended. Existing isolations remain controlled, the worksite is left safe and the permit register shows that the job is still open.

Work resumes only after the issuer revisits the area, confirms the conflicting activity has stopped, checks the permit conditions and formally revalidates the permit.

At completion, welding equipment and gas hoses are removed. The repair and surrounding spaces are inspected, including the concealed side of the division. COSWP advises frequent checks for at least two hours after burning or welding has stopped because fire can develop after the work appears complete.1

The permit stays open until the fire watch is complete, affected detection is restored and tested, and the yacht accepts the area back.

Work should stop when the conditions supporting the permit no longer exist. Typical triggers include:

• a general or emergency alarm;
• a change in job scope, location, tools or materials;
• an isolation being disturbed or found incorrect;
• ventilation, lighting, communications or atmosphere testing becoming unavailable;
• weather, vessel movement or access conditions exceeding the agreed limits;
• another job entering the work area or creating a new hazard;
• a change of person in charge without a proper handover; or
• expiry of the authorised period.

Suspension does not automatically cancel the permit or release its isolations. HSG250 recommends recording the condition in which the equipment has been left and preventing restart until the issuing authority has revalidated the permit or issued a new one.3

If work continues into another shift, the incoming issuer and work-party supervisor need a direct handover. They should check the worksite, plant status, outstanding isolations and remaining precautions before accepting continued work. Extending the time on the form without this review misses the purpose of the handover.

Enclosed-space entry needs its own controls. IMO Resolution MSC.581(110) recommends a ship-specific entry permit issued by the Master or nominated responsible person. Its validity should be based on the risk assessment and should not exceed eight hours.5

A completed task is handed back by the person who accepted responsibility for the work. That person confirms the job status, accounts for the work party and reports any incomplete work, temporary repair or new defect.

The permit issuer then verifies the condition of the area or equipment. Close-out should confirm that:

• the authorised work has been completed or clearly left incomplete;
• personnel, tools and temporary equipment are clear;
• guards, covers, fire boundaries and access arrangements are restored;
• isolations are removed by the authorised persons;
• systems are tested through an agreed reinstatement sequence;
• alarms and protective functions are returned to service;
• affected departments have accepted the equipment or space back; and
• drawings, maintenance records and defect reports are updated where necessary.

The permit should not be closed while a temporary isolation or safety-system impairment remains hidden elsewhere. If the yacht accepts an operational limitation, that limitation moves into the SMS defect and handover process with a named owner and due date.

The most common failures are ordinary ones: the work description is copied from the purchase order, the site is never visited, the same precautions appear on every permit, or the contractor begins while the signatures are being collected.

Yard periods add volume. One person may be expected to control more permits than can be checked properly. HSG250 advises either limiting the number of active permits or providing additional coordination and supervision during busy periods.3

Other warning signs include permits with no expiry time, isolations that cannot be matched to a job, suspended permits missing from the active register, and separate work parties sharing an isolation without cross-references.

A digital permit system does not correct weak practice. The issuer still needs to visit the worksite, and changes must be communicated to everyone affected.

The closed permit record should show:

• permit number, category, location and work scope;
• linked risk assessment and method statement;
• authorised people, work-party leader and issue times;
• isolation, lock and test references where applicable;
• gas-test results, fire-watch records or other permit-specific checks;
• related permits and simultaneous-operation decisions;
• suspensions, extensions and shift handovers;
• handback, reinstatement and functional-test results; and
• outstanding defects, temporary arrangements or follow-up actions.

Retention periods should follow the vessel’s SMS, flag requirements and company document-control policy. Records need to remain available long enough for audits, incident review and verification that recurring weaknesses have been corrected.

Permit requirements depend on the yacht’s flag, applicable yacht code, SMS, size, operating status, work type and whether the vessel is in operation, alongside or under shipyard control. REG Yacht Code vessels should confirm the applicable safety-management requirements, current amendments, flag guidance and company procedures rather than treating this article as a universal permit form.67

Electrical Permit to Work and LOTO Minimum Standard