ALARP and Permit-to-Work: How to Assess Risk When Minimum Isolation Cannot Be Met
When a job cannot meet the minimum isolation standard, blocking it without engagement leaves everyone stuck and the risk unresolved. ALARP is the structured method for finding a safe path forward.
Most permit-to-work systems are built around the assumption that hazardous work will be isolated to a defined minimum standard before it begins. On paper that assumption is reasonable. In practice, on ageing plant with seized valves, inadequate isolation points, and systems that were never designed with maintenance access in mind, it is regularly wrong.
When minimum isolation cannot be achieved, permit issuers face a decision. The wrong response is to block the job without engagement and wait for the problem to resolve itself. The right response is to work through the risk systematically, identify what mitigation is achievable, and make a documented decision about whether the residual risk is tolerable.
That is what ALARP means in a permit context. Not a regulatory checkbox. A structured way to find a safe path forward when the standard route is not available.
What Happens When Issuers Block Without Engaging
Steam Valve, Pressure Drop, and a Standoff
A leaking valve on a steam line was causing a pressure drop across the plant. The fluid bed dryer could not reach temperature. Product quality was affected and production was falling behind schedule.
The job could not meet the minimum isolation standard. Double block and bleed was the requirement. The system did not have adequate isolation points to achieve it. The permit issuer blocked the job.
Days passed. Management pressure built. More people became involved. The conversation shifted from how to do the job safely to why the issuer was stopping production. The standoff that followed is one that anyone who has worked in a high-hazard operational environment will recognise.
The problem was not that the issuer was wrong to identify the gap. The problem was that blocking without assessment left everyone stuck. The risk did not disappear because the job was stopped. The leaking valve was still there. The pressure drop was still affecting production. And as days passed, the informal pressure to find a way forward was growing in ways that were harder to document and control than a formal assessment would have been.
How management pressure reshapes permit behaviour more broadly is examined in Why PTW Systems Fail Under Pressure and How Operational Drift Takes Hold.
The legal basis for ALARP (what “reasonably practicable” means under UK health and safety law) is covered in Permit-to-Work Regulations UK.
What the ALARP Process Actually Involves
ALARP (As Low As Reasonably Practicable) is a structured approach to risk reduction. In a permit context it applies specifically when the job cannot be controlled to the standard the system normally requires.
The assessment works through a hierarchy of questions. Each one is answered honestly, not optimistically. The answers determine what compensating controls are available and whether, when applied collectively, they bring the residual risk to a level that is tolerable.
Work through each question in order before determining whether residual risk is tolerable
-
1Can the temperature of the system be reduced before work begins?Changes the nature of the hazard itself. Most effective controls first.
-
2Can the pressure be reduced or relieved?Reducing energy state lowers the consequence of any isolation failure.
-
3Can the hazardous substance be removed, drained, or displaced?Removing the hazard is always preferable to reducing exposure to it.
-
4Can additional isolation be achieved even if minimum standard cannot be fully met?Partial isolation strengthened by additional controls may bring risk to a tolerable level.
-
5Can isolation effectiveness be verified before work begins?Proving isolation holds reduces reliance on assumption.
-
6Can a spade or physical barrier be inserted early in the work sequence?Strengthens isolation during the highest-risk phase of the task.
-
7Can the number of people exposed during the work be reduced?Reduces the consequence of exposure if something goes wrong.
-
8Can the duration of the highest-risk phase of the work be shortened?Time of exposure is a risk factor independent of isolation quality.
-
9Do the collective compensating controls bring residual risk to a tolerable level?This is the decision point. If the answer is no, the job does not proceed.
On the steam valve job, the assessment worked through each of those questions in turn. One isolation valve was achievable even if double block and bleed was not. Steam traps post-isolation could be opened to prove the isolation was holding. The line jacket could be removed and the system left for 24 hours while temperature and pressure were monitored to confirm the isolation was effective. The work itself was planned to include a spade insertion early in the sequence to strengthen the isolation before the main task began.
None of those measures alone was sufficient. Together, they reduced the risk to a level where a competent HSE advisor could review the assessment, sign the ALARP sheet, and determine that proceeding was justifiable. The permit was issued. The valve was replaced. The plant pressure issue was resolved.
That is how the process is supposed to work. Not as a way to justify proceeding regardless of risk, but as a structured method for identifying whether a safe path forward exists and documenting the decision properly.
Confined space entry is one of the clearest examples of where this hierarchy gets tested under real pressure. This is examined in Confined Space Entry and Permit-to-Work: When the Risk Changes After Entry Begins.
The Role of the Competent Advisor
The ALARP assessment is not a decision the permit issuer makes alone. A competent HSE advisor reviews the compensating controls identified, challenges any assumptions, and determines whether the collective mitigation is sufficient to make the risk tolerable.
That sign-off matters for several reasons. It brings independent technical judgment to a decision that is being made under operational pressure. It ensures the assessment has been challenged rather than simply completed. And it documents that the decision to proceed was made properly, by the right people, on the basis of a structured analysis rather than under informal pressure to get the job done.
The HSE advisor’s role is not to find reasons to refuse. It is to ensure the assessment is honest and the controls proposed are genuine. Where the risk cannot be brought to a tolerable level, the job does not proceed regardless of how much pressure exists to complete it.
The sign-off matters for the advisor personally as much as it does for the organisation. A competent person who reviews and challenges a genuine assessment has a defensible record. One who rubber-stamps a weak one does not.
How permit issuer responsibilities interact with HSE advisor sign-off is examined in Permit-to-Work Roles and Responsibilities: Where Accountability Breaks Down.
Management Pressure and Why ALARP Helps
Production schedules, output targets, and cost implications create real pressure on permit issuers when jobs are blocked. Some managers are significantly less risk-averse than the people responsible for issuing the permit. The longer a job remains stopped, the more people become involved, and the more that pressure intensifies.
The pressure is not always about finding the right solution. Sometimes it is simply about getting the job done, and the issuer is expected to find a way to make that happen regardless of what the risk assessment shows. That is the reality many permit issuers face, and it is one that most official guidance never acknowledges.
A properly applied ALARP process gives the permit issuer something that a straight refusal does not: a structured framework for explaining the decision and a clear path toward resolution. Rather than a standoff between management and the issuer, the ALARP assessment creates a shared problem-solving process where all parties work toward the same outcome: finding a way to complete the job safely.
Management cannot simply pressure an issuer to proceed when the issuer can show exactly what risk reduction has been assessed, what controls are in place, and what a competent HSE advisor has determined about the residual risk. The assessment creates accountability on all sides.
The alternative is what happens when no formal process exists. Jobs blocked during the day are completed overnight by people who felt they had no documented route forward. No assessment. No competent sign-off. No record of what controls were applied. The risk was taken anyway, just without any of the structure that would have made it defensible. That outcome is worse for the issuer, worse for the workforce, and worse for the organisation than a properly conducted ALARP assessment would ever have been.
ALARP Beyond Minimum Isolation Failures
One of the most common misunderstandings about ALARP in a permit context is that it only applies when minimum isolation cannot be achieved.
That view is too narrow. ALARP is a valuable tool for any job where there is an opportunity to reduce risk further, even when the minimum isolation standard has been met.
Can the temperature be reduced before the line is broken even though isolation is in place? Can unnecessary personnel be kept out of the area even though the permit is valid? Can the duration of the highest-risk phase of the work be shortened by better planning?
These questions are worth asking on every job, not just the ones that fail the isolation hierarchy. The minimum standard defines the floor below which work should not proceed. It does not define the ceiling of what is achievable in terms of risk reduction.
Applying ALARP thinking more broadly, treating it as a way to identify additional mitigation on any complex or high-risk job rather than a last resort when the standard cannot be met, changes the quality of pre-job planning across the permit system.
How routine work creates the conditions where these shortcuts become normalised is examined in Routine Work Is Where Permit Systems Quietly Fail.
What the Assessment Documents
A properly completed ALARP assessment records the options considered, the controls applied, and the basis on which the decision to proceed was made. It names the competent person who reviewed the assessment and confirms the controls are adequate.
That documentation protects the permit issuer, the HSE advisor, and the organisation. It demonstrates that the decision was made properly, that the risk was not simply accepted without analysis, and that the work proceeded on the basis of a structured and reviewed assessment rather than informal pressure.
For the permit issuer personally, the completed assessment is their protection. An issuer who blocks a job without assessment and something subsequently goes wrong because the work was completed informally, outside the permit system, has no documentation to demonstrate they handled the situation properly. An issuer who completes the assessment does.
Where the assessment concludes that the risk cannot be brought to a tolerable level, that conclusion is also documented. The job does not proceed. That decision, properly recorded, is equally important.
The ALARP assessment is examined as part of permit system reviews in the Permit System Diagnostic Toolkit. How isolation failures develop when ALARP assessments are not applied is examined in Lockout Tagout and Permit-to-Work: Where Isolation Control Fails.
The Practical Test
An ALARP assessment that takes ten minutes to complete and is signed off under time pressure is not an ALARP assessment. It is a piece of paper that gives the appearance of compliance while the decision was already made.
A genuine assessment works through each mitigation option honestly, challenges the assumptions behind each proposed control, and reaches a conclusion that the competent reviewer can defend independently of the operational pressure that prompted the assessment.
There is one question worth asking before signing off any ALARP assessment. If this job resulted in an incident, would this assessment demonstrate that every reasonable measure was taken to reduce the risk before work began?
If the answer is yes, the assessment is sound. If the answer is no, more work is needed before the permit is issued.
One further point: an ALARP assessment is not permanent. If conditions change before work resumes, the assessment is revisited, not assumed to still hold. A control that was effective yesterday may not be effective today if the plant state has changed.
Most permit systems have a mechanism to stop work. Fewer have a structured mechanism to find a safe way to restart it. ALARP is that mechanism.
How ALARP decisions are examined during an operational audit is covered in How to Audit a Permit-to-Work System: The Operational Approach.
Key concepts are summarised in the Permit-to-Work Reference Guide.