Permit-to-work systems: when a RAMS on its own isn't enough

A RAMS covers most construction tasks well: it sets out the hazards, the method, and the controls before work starts. For a narrower category of genuinely high-risk activities — hot work near flammable materials, confined space entry, live electrical work, some excavations near buried services — a RAMS on its own doesn't provide enough real-time control, and that's the gap a permit-to-work system is designed to close.

What a permit actually adds

HSE's guidance on permit-to-work systems, HSG250, was written with process and chemical industries specifically in mind, but the underlying logic has been widely adopted across construction and other sectors precisely because the problem it solves isn't industry-specific: some tasks are safe under one set of conditions and genuinely dangerous under a slightly different one, and those conditions can change during the working day in ways a RAMS written the day before can't anticipate. A permit doesn't replace the RAMS — it sits on top of it, formally authorising the specific work, at a specific time, under conditions that have been checked immediately before work starts, not just planned for in advance.

The kind of task that actually needs one

Not every high-risk-sounding task needs a formal permit — the point of a permit system is that it's reserved for a defined, limited set of activities where the consequences of a control failing are severe and where conditions genuinely can shift between planning and execution. Hot work is the clearest construction example: cutting or welding that's perfectly safe in one location on a site can become genuinely dangerous an hour later if flammable materials have since been stored nearby, or if a fire watch that was supposed to be present has quietly drifted off elsewhere. A permit forces someone to check the actual conditions immediately before authorising work, rather than relying on an assessment made the previous day.

How this differs from RAMS review

A RAMS is reviewed and approved before a task begins, generally once per task or once per change in task conditions. A permit is issued fresh, often daily or even per shift, and it expires — a permit that's still technically "active" from three days ago because nobody formally closed it out is a live risk, not a technicality, because it means work could restart under conditions that were checked days ago and haven't been reverified since. This is the core practical difference: RAMS answers "is this task, in principle, safe to do"; a permit answers "is it safe to do right now, under today's actual conditions."

Who issues and who accepts a permit

A workable permit system has a genuine separation between the person issuing the permit and the person doing the work, with the issuer holding the authority — and, critically, the willingness — to refuse or suspend it if conditions aren't right. This mirrors the same dynamic that matters when a subcontractor turns up without a valid RAMS: the person enforcing the control needs to be genuinely backed by management when they say no, or the requirement quietly stops meaning anything under enough schedule pressure. A permit system where the issuer always signs off because refusing feels awkward isn't a permit system, it's a formality with an extra signature attached.

A worked example

A subcontractor is due to carry out hot cutting work inside a plant room as part of a mechanical strip-out. The RAMS, written the week before, covers the task generically — PPE, fire extinguisher on hand, no combustibles nearby. On the morning the work is due, the permit issuer walks the space before signing it off and finds that insulation material for a different trade has been temporarily stored against the wall the cutting work would be closest to, put there overnight by a different subcontractor entirely unaware of the planned hot work. The RAMS didn't anticipate this because it was written before the material arrived. The permit process catches it because checking current conditions immediately before authorising work is the entire point — and the work is delayed an hour while the material is moved, rather than proceeding into a genuinely different risk than the one that was originally assessed.

Where permits and other trades intersect

Permit-controlled work rarely happens in isolation on a live site — it's often happening alongside other trades whose activity could either create the hazard the permit is meant to control against, or be put at risk by the permitted work itself. This is where the permit needs to connect with the site's broader coordination, of the kind a construction phase plan is meant to provide — a permit for hot work issued without checking what else is scheduled nearby that day is only doing half its job.

How many tasks should genuinely need a permit

It's worth resisting the temptation to apply permits broadly on the theory that more formal control is always safer. HSG250 is explicit that permits work best when reserved for genuinely high-consequence activities — spreading the system across too many routine tasks dilutes the attention each individual permit gets, and turns what should be a careful, conditions-checked authorisation into a rubber-stamp exercise done quickly because there are simply too many of them to give each one real scrutiny. A short, well-maintained list of activities that genuinely require a permit, reviewed by someone with the authority to add or remove tasks from it as the project's risk profile changes, tends to work far better than an expansive one that's technically comprehensive but practically unmanageable.

Briefing the people actually doing the permitted work

A permit is only as good as the understanding of the people carrying out the work under it, which means whoever's doing the task needs to be briefed on what the permit actually specifies, not just handed a signed form to keep in a pocket for the day. This matters particularly where a crew changes partway through a task, or a permit is handed over between shifts — the new arrival needs the same understanding of the conditions and limits the permit sets out as the person originally briefed, and a permit that simply gets passed along without that conversation happening again is quietly losing the thing that made it meaningful in the first place. It's worth treating the handover of a live permit between people as a deliberate step, in the same way a project handed over between site managers needs a genuine transfer of what's actually known, not just a document changing hands.

Closing a permit out properly

The other half of a permit system that's easy to under-invest in is closing permits out properly once work finishes — confirming the area's been left safe, hot work areas checked for smouldering material after a suitable interval, confined spaces confirmed clear and ventilated again. A permit that's issued carefully but closed out casually, with nobody actually confirming the site's been returned to a safe state, has done half the job a genuine permit system is meant to do. This closing step is also where a formal fire watch period after hot work — checking the area again some time after work has finished, since some ignition sources smoulder before catching properly — genuinely earns its place, rather than being treated as an optional extra once the cutting itself has stopped.

Common mistakes

• –Applying a permit system so broadly that individual permits get rubber-stamped rather than genuinely checked
• –Treating a permit as valid for the duration of a task rather than for the specific shift or day it was issued
• –Issuing a permit without checking what other trades are working nearby that day
• –Letting the same person who wants the work to proceed also be the one authorising the permit
• –Not closing a permit out properly once work finishes, including a fire watch period after hot work where relevant
• –Assuming a RAMS already covers everything a permit is meant to add, when the two answer genuinely different questions