Shift Handover in Permit Systems: What Gets Lost Between Shifts
The incoming shift signed the permits. They had the paperwork. What they didn’t have was any understanding of what had changed during the previous eight hours.
Shift handover is the most consistently cited failure point in permit-to-work investigations. It appears in post-incident reports, audit findings, and near-miss analyses across sectors and geographies. Yet most permit systems treat it as an administrative step rather than a critical control point. The practical consequence is that incoming shifts regularly accept jobs without the understanding they need to manage them safely.
The Gap Between Information and Understanding
When a permit issuer hands over a job at shift change, the transfer typically happens through one of two mechanisms. Neither is as reliable as it appears.
The first is a verbal briefing: the outgoing issuer tells the incoming issuer what is active, what the current status is, and anything worth knowing. This works when both issuers are present at the same time, the outgoing issuer has been across the job throughout their shift, and there is time to cover the detail. It stops working when the outgoing issuer left before shift end, when the job changed status late in the shift, or when there are ten permits to hand over in fifteen minutes at the end of a busy day. Under those conditions, the verbal briefing becomes a status update rather than a transfer of understanding.
The second is documentation: the incoming issuer reads the permit and assumes it reflects the current state of the work. This is the more dangerous of the two mechanisms. A permit describes the job as it was when it was issued. It does not capture what changed during the shift, what the task performer found when they got to the workface, what isolations were difficult to achieve, or what remains incomplete. An incoming issuer who treats a permit as a live description of current conditions is making an assumption the permit was not designed to support.
In both cases the incoming issuer is receiving information. They are not receiving understanding. Those are different things, and the gap between them is where handover failures develop.
How permit systems behave under the kinds of pressure that typically coincide with shift changes is examined in Why Permit-to-Work Systems Fail When Work Actually Starts.
What Actually Gets Missed at Handover
Permit-to-work investigations consistently identify the same categories of information that do not transfer reliably at shift change. Understanding these gaps is the starting point for addressing them.
Isolation Status
An incoming issuer accepts a job with isolations listed on the permit and assumes they have been applied as documented. In practice that assumption is often wrong. Isolation points noted on the permit may not have been locked off as stated. The previous issuer may have accepted a standard below the site minimum under pressure, without documenting that decision or communicating it forward. When isolations are physically checked at handover, discrepancies between what the permit records and what exists in the field are not uncommon.
Equipment Status at Handback
When a job is signed off as complete by the task performer, operations assumes the equipment is ready to return to service. That assumption is frequently wrong. Lines are handed back with loose flanges. Tank lids are not fully secured. Pumps are handed over before lines have been pressure-tested. Parts removed during the job have been stored elsewhere and not documented. The permit was closed and the handback section was signed. None of that captured what was actually left incomplete.
Changes During the Shift
What the task performer found at the workface often differs from what the permit described. A valve that was listed as isolated was found to be passing. Access that was planned required additional controls. Work scope that was defined before the shift started changed as the job progressed. None of these developments are necessarily captured on the permit. The incoming issuer has no way of knowing what changed unless the outgoing issuer tells them, and at the end of a long shift that conversation is often brief or absent.
The Absent Outgoing Issuer
The highest risk handover scenario is one where no verbal handover is possible at all. A job is active when the outgoing issuer finishes their shift. The incoming issuer arrives and the outgoing issuer has already left. The only information available is what is written on the permit. If that documentation is incomplete and describes the job as it was issued rather than as it currently stands, the incoming issuer is managing work they do not understand from a document that no longer reflects reality.
Isolation Verification and the Tag Rule
Isolation status is the most critical element of any permit handover. It is also the element most likely to be accepted on assumption rather than verified in the field. A structured approach to isolation verification at handover is essential to maintaining control across shift boundaries.
A reliable check for LOTO jobs is the isolation tag. When a piece of equipment is isolated, a numbered tag should be applied to the lockout box and recorded against the job, along with the date it was fitted. This creates an auditable record that the incoming issuer can check against the permit documentation.
- If a job is handed over and the LOTO tag is still intact, the isolation does not need re-checking, provided no more than seven days have passed since it was applied
- If the tag has been removed or damaged, or no tag is present at all, that is an immediate signal that isolation may not be applied as documented
- If no tag is present or the tag is more than seven days old, the job should not proceed until isolation is physically re-verified from scratch, regardless of what the permit says
- Re-verification takes time. It causes friction. It is the right call every time.
- The incoming issuer inherits the isolation position as they find it, not as it is documented
The relationship between isolation control and permit systems more broadly is examined in Lockout Tagout and Permit-to-Work: Where Isolation Control Fails.
The Tag That Was Missing
On a chemical plant, a pump overhaul had been running across two shifts. The incoming issuer at the second shift change checked the permit, confirmed the isolation points were listed, and proceeded to authorise continued work. The isolation tag had been removed by a third-party contractor who needed access to the lockout box for a different job and had replaced it without completing the required documentation.
The incoming issuer had no way of knowing the tag had been replaced. The permit listed the isolation as complete. The tag appeared intact. What the issuer could not verify without physically walking the isolation route was that the replacement had been done at a lower standard than the original, with one valve position not confirmed before the lock was reapplied. The discrepancy was identified by the task performer before work restarted, but only because they had been present on the previous shift and noticed something was different.
Accepting a Handover That Is Not Compliant
One of the more difficult realities of shift handover is that incoming issuers sometimes inherit jobs that were not being run correctly by the previous shift.
Equipment may be isolated below the baseline isolation standard the job should have been held to. Compensating controls that should have been applied were not. The task performer has been working under conditions that the permit does not properly authorise.
An incoming issuer who accepts that job without checking inherits the liability as well as the permit. An incoming issuer who checks and finds the discrepancy faces the uncomfortable position of having to put additional measures in place, potentially stopping work, and addressing a gap that was created by someone else.
Accepting a handover is not a formality. It is a transfer of accountability. The incoming issuer becomes responsible for the safety of the work from the moment they sign it over.
The right response to a non-compliant handover is always to verify. If isolations do not meet the baseline isolation standard and no ALARP assessment has been completed and documented, the job stops until the position is properly assessed. If the handback section is incomplete and equipment has not been properly returned to service, the permit does not close until it has been.
How ALARP assessments should be applied when minimum isolation cannot be met is examined in ALARP and Permit-to-Work: How to Assess Risk When Minimum Isolation Cannot Be Met.
That response requires issuers who understand that the incoming position is not simply to continue what the previous shift was doing. It is to take genuine responsibility for the safety of the work as it currently stands. If the current conditions do not support safe continuation, the work stops until they do.
What Effective Handover Looks Like
The standard for effective handover is both issuers and both task performers physically present at the workface at the same time.
The outgoing issuer walks the incoming issuer through the job in the field: not at the permit office, not over the phone, not through a written note. They show the isolation points, confirm what has been applied, identify anything that changed during the shift, and explain anything the permit does not capture. The outgoing task performer does the same with the incoming team. The incoming issuer and task performer can ask questions about what they are looking at, not what they are reading.
That standard is not always achievable. Shift patterns, site logistics, and operational pressure make simultaneous workface handovers impractical in many environments. But where it is achievable it should be the expectation rather than the exception.
Where workface handover is not achievable, documentation has to compensate. The permit needs to reflect the current state of the job, not the state it was in when it was issued. Isolation discrepancies need to be noted. Incomplete work needs to be clearly flagged. Anything the incoming issuer needs to know that is not obvious from the permit itself needs to be written down before the outgoing issuer leaves site.
Confined space entry adds a further layer to this risk, since conditions inside the space can change between shifts even where the permit and isolation remain unchanged. This is examined in Confined Space Entry and Permit-to-Work.
The handback section of the permit is particularly important and is frequently ignored or completed as a formality. It should be the point at which the issuer confirms physically, at the equipment, that the system is in the condition operations is about to assume it is in: flanges tight, lids secured, lines tested, all parts accounted for, system ready to return to service. Why restart is the most dangerous phase of the permit lifecycle is examined in Plant Restart: Managing the Most Dangerous Phase of the Permit Lifecycle.
A Practical Tool for Shift Handover
The checks described above can be structured into a consistent process using a dedicated handover checklist, designed to attach to the permit pack and completed as a record of the handover rather than as a formality.
An effective handover checklist covers five things the incoming issuer needs to confirm before accepting operational responsibility for a job:
- Handover details and handover type: whether workface, verbal-only, or documentation-only, and the names of the outgoing and incoming issuers
- Isolation status for each active isolation point, including whether the LOTO tag is present, intact, and within seven days of fitting
- Conditions or changes from the previous shift that are not captured on the permit itself, including scope changes, access difficulties, or isolation variances
- Equipment and handback status where the job is approaching closure, confirming physical condition rather than relying on the permit handback signature
- A formal declaration transferring operational responsibility to the incoming issuer, as a documented transfer of accountability rather than an assumed one
The Permit System’s Role
Most permit systems have a handback section. Few treat it as an actual control point. Most treat it as a signature to collect before closing the permit.
The difference between a permit system that handles handover well and one that does not is rarely about the paperwork. It is about whether the system requires physical verification at the point of transfer, or whether it allows issuers to accept a handover on the basis of what is written rather than what can be confirmed in the field.
A permit system that accepts verbal handover as sufficient, that does not require isolation re-verification when documentation is incomplete, and that treats the handback section as an administrative close-out is a system that is managing handover on trust rather than on control.
When the System Permits Trust to Substitute for Verification
Trust works when conditions are stable, the people involved are experienced and careful, and nothing has changed between the permit being issued and the handover taking place. It stops working when the site is busy, the outgoing issuer is tired, the incoming issuer is new to the job, and production is waiting for the equipment back.
Those are exactly the conditions under which shift change occurs at the end of a demanding shift. A system designed around trust functioning correctly has been designed for conditions that are not typical. The handover is where that trust is tested. Most permit systems do not have a mechanism to catch the moment when it fails.
How coordination between permits breaks down during simultaneous operations is examined in SIMOPS and Permit-to-Work: Managing Overlapping Risks.
The patterns that develop at handover are examined across the site permit system in Common Permit-to-Work Failure Patterns Across Industries. How those patterns are identified during an audit is covered in How to Audit a Permit-to-Work System: The Operational Approach.
Key concepts are summarised in the Permit-to-Work Reference Guide.