What permit to work software actually has to do

Most permit to work systems start life as a paper pad in a site office and end up as a PDF someone emails around. Both versions share the same weakness: nothing in them can tell you, right now, which permits are live, which have quietly run past their window, and whether the isolations they depend on were ever actually applied.

That is the bar a permit system has to clear. Not storing permits. Answering questions about them while the work is still happening.

A permit has to be able to expire on its own

A permit is a time-boxed authorisation. If the system lets one sit open past its validity window because nobody closed it, the record is worse than useless: it says work was authorised at a time when it was not. Expiry has to be a property of the permit, enforced by the system, not a task on somebody's list.

The same applies to suspension. Work stops for weather, for a shift change, for an alarm. A permit that cannot record a suspension and a resumption will be reconstructed afterwards from memory, which is exactly the kind of evidence that does not survive scrutiny.

Isolation is the part auditors actually test

Lockout and tagout is where permit systems are won or lost. It is not enough to note that isolation was required. The record needs each isolation point, who applied it, who verified it, and who removed it, so that the sequence can be reconstructed from the record alone.

When an incident happens on permitted work, this is the first thing anyone asks for. A permit that says isolation: yes will not help you.

One approver is not an approval process

High-risk work usually needs more than one authority: the area owner, the discipline authority, sometimes a third party. A system that models approval as a single signature forces sites to run the real process somewhere else, on paper or over the phone, and then record the outcome afterwards. At that point the system is documenting a decision it did not witness.

Multi-authority approval also has to survive edits. If somebody changes the scope of the work after approval, the approvals should reset. Otherwise the permit carries signatures for a job that no longer exists.

Checklists before and after, not just before

Pre-work checks get attention because they gate the start. Post-work checks get skipped, and they are the ones that catch the isolation nobody removed and the guard nobody refitted. A permit that closes without a post-work check is a permit that cannot tell you the site was left safe.

What this looks like in HSE360

HSE360 issues permits across nine work types, each with a validity window the system enforces, multi-authority approval, and pre and post-work checklists. Every LOTO isolation point and worker sign-on is recorded against the permit, so the isolation sequence is part of the record rather than an attachment to it.

Findings do not stop at the permit either. A failed check becomes a tracked corrective action with an owner and a due date, which is the difference between noticing a problem and fixing one.