Hot Work Permits and Permit-to-Work: Controls That Actually Matter
A hot work permit is not just a form to fill in before striking an arc. It is the mechanism that decides whether the area is genuinely safe to introduce ignition sources, and whether it stays safe after the job is finished.
Most sites that use hot work permits treat them as a box-ticking exercise. The permit gets issued, the fire extinguisher gets pointed at, and the job starts. The controls that actually prevent fires, gas testing, combustible clearance, post-job fire watch, and genuine SIMOPS awareness, get treated as formalities rather than the reason the permit exists.
The job that ran short of gas tests
A grinding task was underway in a process area, permitted and signed off. The gas test at permit issue came back clear. Partway through the job, an adjacent drain connected to a flammable system was opened by a different crew working under a separate permit. Neither crew knew about the other’s activity. The firewatch was watching the grinder, not the ground-level drain four metres away.
The gas test at issue was accurate. It was also twelve minutes old by the time conditions changed. The permit system had no mechanism to link two overlapping jobs in adjacent areas. The post-incident review found both permits were correctly issued. The coordination failure happened in the gap between them.
What Triggers a Hot Work Permit
Hot work covers any task that introduces an ignition source or generates heat, sparks, or flame. That is a wider category than most people assume when they first encounter the term.
Common triggers include:
- Welding and cutting: oxy-acetylene, MIG, TIG, plasma
- Grinding and disc cutting: angle grinders, whizzers, cut-off wheels
- Brazing and soldering
- Non-ATEX rated electrical equipment in classified areas
- Any power tool with the potential to generate sparks in a flammable atmosphere
- Heat guns or open flame work in areas with combustibles present
On process and manufacturing sites, the practical question is not whether the task uses flame. It is whether the task can produce an ignition source in an environment where flammable material might be present. Grinders produce sparks over a wide area. Welding produces spatter that travels further than the job footprint. Both require the same controls.
The permit covers the area, not just the task. A job that looks contained on paper can scatter ignition sources well beyond where anyone was looking.
Before Work Starts: What Actually Needs Checking
The pre-work checks on a hot work permit are not bureaucratic. They are the point at which a potential fire gets prevented. Issuing a hot work permit without completing these checks is not a shortcut. It is a failure of the system.
- Combustibles removed or protected within the work area and adjacent zones
- Drains and floor openings sealed: sparks travel downwards
- Conveyors, ducts and voids checked, not just the visible floor
- In dust-handling areas: area inspected and signed off by HSE professional before work begins
- Gas test completed where flammable atmospheres are possible
- Confined spaces: gas test mandatory before entry and at intervals during work
- Result recorded on the permit, not assumed safe because the area looked clear
- Re-test required if conditions change or work pauses for an extended period
- Fire extinguisher present, in date, and correct type for the fire risk
- Fire blanket available where required
- All equipment within maintenance date and inspected before use
- In EX areas: equipment must be ATEX rated; non-EX equipment requires specific permit and sign-off
- Cordon established around the work area
- Hot work in progress signage posted at all approaches
- Adjacent areas and operations informed, not just the immediate workface
- Area authority signatures obtained before work starts
The emergency response requirement
On some sites, hot work cannot proceed unless a minimum number of emergency response team members are on site. This is not a procedural quirk. It reflects the reality that a hot work fire can escalate faster than a small maintenance team can manage. Where this requirement exists, the issuer needs to verify it is met before signing the permit, not assume it is covered.
The permit issuer also needs to confirm the alarm-raising procedure with the performing authority before work starts. Specifically, how to raise the alarm to the gatehouse or control room if a fire develops. That information is often on the back of the hot work sheet, but it needs to be communicated, not just available.
Fire Watch: What It Is and What It Requires
A fire watch is a dedicated person whose sole job during hot work is to monitor for fire risk. Not to help with the job. Not to hand tools. To watch for fire.
That distinction matters in practice. On busy sites, the firewatch role gets absorbed into the job. The assistant becomes a second pair of hands and the fire monitoring stops happening. A permit issuer doing a walkdown should be looking for exactly this: is the designated firewatch actually watching, or are they doing something else?
Fire watch selection by risk
The level of fire watch required scales with the fire risk of the environment. The matrix below reflects how this is typically applied in practice.
Fire Watch Selection Matrix
Based on site fire risk assessment| Risk factors | Risk rating | Fire watch | Post-job monitoring |
|---|---|---|---|
| Hot work in non-hazardous area, limited or contained heat, non-combustible building construction | Low | 30 min minimum past job completion | Not required |
| Hot work generating considerable heat, building materials or contents combustible | Medium | 1 hour past job completion | 1 hour monitoring period |
| Hot work in hazardous area, considerable heat generated, building and construction combustible | High | 1 hour past job completion | 2 hour monitoring period |
The post-job fire watch period is the control most often skipped. Production pressure to close permits and release areas for the next job pushes sites to sign off as soon as the flame is out. Smouldering material behind a wall lining, in a void, or under insulation does not become a fire immediately. It develops over time. That is exactly the period the fire watch is there to cover.
After the Job: Why the Risk Does Not Stop When the Flame Does
Hot work creates heat in materials that retain it. Metal takes time to cool. Insulation, lagging, and building fabric can smoulder for an hour or more after work has stopped, long after the workforce has moved on.
The post-job fire watch and monitoring period exists because most hot work fires do not start during the job. They start after it. A firewatch that leaves when the welder does has not completed the job.
The permit should not be closed until the full post-job monitoring period has elapsed and the area has been physically checked, not signed off from a distance because the job looked finished.
What the post-job check should cover:
- All surfaces in the work area and immediately adjacent areas checked by hand for residual heat
- Voids, ducts and openings re-checked, not just the visible working surface
- Any discolouration, smoke smell or warm surfaces treated as a live risk until investigated
- Fire extinguisher remaining in position until the permit is formally closed
Higher-Risk Scenarios
Some hot work situations compound the baseline fire risk with additional hazards. These require specific controls on top of the standard permit requirements.
Hot work in confined spaces
Welding and grinding in confined spaces, blenders, vessels, tanks, ducts, generate toxic fumes in addition to the fire risk. Carbon monoxide from welding and metal fume are the primary concerns. Local exhaust ventilation is required to extract fumes at source.
The firewatch in a confined space job has a harder task: monitoring for fire while also watching for signs of atmospheric deterioration in the entrant. Gas monitoring should be continuous during welding. The confined space entry permit and hot work permit run simultaneously, and the controls of both apply.
See Confined Space Entry and Permit-to-Work for the full control framework.
Hot work at height
Sparks and spatter from elevated work fall over a wide area below, well beyond the platform or scaffold footprint. A single firewatch positioned at the workface cannot cover the ground below at the same time.
Hot work at height routinely requires a second firewatch on the ground. Their job is specifically to monitor the area below for falling sparks landing on combustibles or in voids. Cordons below elevated hot work must account for the realistic travel distance of spatter, not just the footprint directly below.
Dust-handling and process areas
Combustible dust is a serious ignition risk. Fine organic dusts, flour, sugar, wood, certain chemicals, can form explosive atmospheres at the right concentration. Hot work in these areas cannot go ahead until the area has been cleaned and inspected. On most sites, that inspection must be signed off by an HSE professional before the permit can be issued.
The same principle applies to non-ATEX rated equipment in classified areas. Non-EX equipment generates sparks through normal electrical operation. In a classified zone, that is an uncontrolled ignition source. The permit must specifically address whether the equipment being used is rated for the area, and if not, what controls are in place.
Hot work near other operations
Hot work near areas that contain, handle, or transfer flammable materials is one of the highest-risk SIMOPS combinations on any industrial site. The hot work area may be safe in isolation, gas tested clear, combustibles removed, but an adjacent operation can change that in minutes.
Before issuing a hot work permit, the issuer needs a full picture of what is happening in adjacent areas: open pipework, transfers, venting operations, drains connected to flammable systems. A gas test passing at permit issue does not remain valid if conditions upwind or in connected systems change during the job. See SIMOPS and Permit-to-Work for the coordination controls that apply.
When to Stop the Job
Hot work permits carry a clear stop-work obligation. The conditions that made the job safe at permit issue do not always hold for the duration of the job. Any of the following should halt work immediately.
- Gas test reading rises above zero in an area that tested clear at start
- Smell of flammable material, smoke or burning that cannot be immediately accounted for
- Adjacent operations change: a transfer starts, a drain opens, a process vessel is vented
- Fire watch cannot maintain observation: distracted, called away, or the job has moved outside the covered area
- Fire extinguisher becomes unavailable, is discharged, or its serviceability is in doubt
- Weather or ventilation changes affect gas dispersion in the area
- Scope of work changes and the permit conditions no longer cover what is actually happening
Stopping hot work mid-job is not a failure. It is the permit system working. The issuer who authorised work under one set of conditions did not authorise work under different ones. If conditions change, the permit needs to be reassessed, not pushed through because the job is nearly done.
The common permit failure patterns that produce hot work incidents are examined further in Common Permit Failure Patterns Across Industries.