A permit to work certificate can be fully signed, dated, and filed correctly, and the job can still result in a catastrophic failure. The paperwork isn't the control, the isolation is the control. Everything else — the permit form, the risk assessment, the sign-off chain — exists to evidence that the isolation was done properly and stayed in place for the duration of the work.
That distinction gets lost on busy sites. Isolation certificates get referenced on a permit, filed, and treated as closed business, when the actual physical state of the valve, breaker, or spade has never been independently verified against what the paperwork says. A technician opens a panel expecting a de-energised circuit because the permit says so. A valve that was locked out for a vessel entry gets cracked open by someone on a different job who didn't check the isolation register first. These aren't hypothetical failure modes — they are the pattern behind a large share of the serious near-misses reported across UKCS operations every year.
Isolation is the physical control, the permit is the evidence
A permit to work authorises a specific task under specific conditions. It does not, on its own, make anything safe. What makes the job safe is the isolation, the physical break in the energy source, correctly identified, physically applied, tested and locked so it cannot be reinstated without deliberate action. The permit is meant to be a faithful record of that isolation, nothing more.
When teams treat the permit as the safety measure rather than the record of one, isolation verification becomes a box-ticking exercise. The permit gets issued once the isolation certificate number is written in the right field, not once someone has walked down the isolation, confirmed the correct points and checked it against the isolation register. That gap between what's recorded and what's physically true is where control of work breaks down and it is invisible until something goes wrong or an auditor asks the wrong question at the wrong time.
Why paper and spreadsheet isolation registers fail under pressure
Most isolation failures aren't caused by a single person making a bad decision. They're caused by a register that can't keep pace with a live site. A few patterns recur constantly
- Isolation certificates are cross-referenced against permits manually, so a permit can be extended or reissued without anyone re-checking whether the original isolation is still valid or whether conditions on the ground have changed.
- Multiple permits share a single isolation boundary, and no one owns the job of tracking every permit that depends on that boundary before it's broken.
- Deisolation happens at shift handover, when the person closing out the isolation and the person who applied it are not the same, and the verbal handover doesn't match what's written down.
- Locks and tags stay in place well past the point where the isolation is still relevant, because removing them requires chasing down a paper trail nobody wants to do at the end of a shift.
- Each of these is manageable in isolation (no pun intended) with strong supervision. Under time pressure, with several isolations running simultaneously across a live asset, they compound. This is exactly the territory covered in what the OIM security guidelines mean for control of work offshore — control of work only holds up when the people accountable for it can see the full picture in real time, not reconstruct it from separate paper trails after the fact.
What auditors and regulators actually check
When HSE or an internal auditor reviews control of work, they are not primarily interested in whether a permit form was filled in correctly. They want to trace a specific isolation from application to removal and confirm that every step is verifiable for who applied it, what was tested, which permits relied on it and who authorised its removal. Under the Safety Case Regulations and PSSR 2000, that traceability isn't optional documentation, it's the evidence base for demonstrating that major accident hazards are being managed.
The same scrutiny applies to electrical isolations specifically, where the margin for error is even smaller. If your site still has open questions about when live working is genuinely justified versus when isolation should be mandatory, that's worth resolving before an auditor raises it, see electrical permit to work: when is live working actually permitted for where that line typically gets drawn.
A diagnostic check for your isolation process
Run these questions against your current process, honestly
- Can you produce, within minutes, a complete list of every permit currently relying on a given isolation?
- When an isolation is applied, is it verified by someone other than the person who applied it, and is that verification recorded against the specific point, not just the certificate number?
- If a shift changes mid-isolation, does the incoming supervisor inherit a written, current status, or a verbal handover plus a paper file?
- Can you tell, without asking around the control room, whether every lock currently out on the plant is still tied to an active job?
- Is deisolation ever authorised by someone who hasn't confirmed all dependent permits are closed?
- If any of these are difficult to answer quickly, that's where the audit finding will land, and it's usually not a documentation gap, it's a visibility gap.
Building isolation integrity into control of work, not around it
The fix isn't more paperwork. It's making the isolation register and the permit system the same live picture, so an isolation can't be broken while a dependent permit is still open, and a permit can't be issued against an isolation that hasn't been verified. That's the operational assurance argument laid out in what is operational assurance? Turning verification tasks into a process safety framework: verification has to be structural, not something bolted onto the end of a workflow.
Contractor-heavy sites carry an added layer of risk here, because the people applying and verifying isolations often change week to week. If your isolation discipline depends on institutional memory that contractors don't have, that's a competency gap worth closing directly, see contractor permit management: closing the competency gap on critical equipment.
A permit that references an isolation nobody has physically confirmed is not a safety control. It's a record of intent. The operations teams that get this right treat isolation status as live data that every permit decision draws on, not a certificate filed once and trusted indefinitely. If you want to see how Elisian's Permit to Work and control of work tools keep isolation status and permit dependencies in one verifiable record, get in touch for a walkthrough of how it applies to your asset.
Source: OEUK's Process Safety Leadership Principles: What the 2025 Strategy Means for Asset Integrity Teams