Most permit-to-work systems are built around the assumption that hazardous work will be isolated to a defined minimum standard before it begins. On paper that assumption is reasonable. In practice, on ageing plant with seized valves, inadequate isolation points, and systems that were never designed with maintenance access in mind, it is regularly wrong.
When minimum isolation cannot be achieved, permit issuers face a decision. The wrong response is to block the job without engagement and wait for the problem to resolve itself. The right response is to work through the risk systematically, identify what mitigation is achievable, and make a documented decision about whether the residual risk is tolerable.
That is what ALARP means in a permit context. Not a regulatory checkbox. A structured way to find a safe path forward when the standard route is not available.
What Happens When Issuers Block Without Engaging
A leaking valve on a steam line was causing a pressure drop across the plant. The fluid bed dryer could not reach temperature. Product quality was affected and production was falling behind schedule.
The job could not meet the minimum isolation standard. Double block and bleed was the requirement. The system did not have adequate isolation points to achieve it. The permit issuer blocked the job.
Days passed. Management pressure built. More people became involved. The conversation shifted from how to do the job safely to why the issuer was stopping production. The standoff that followed is one that anyone who has worked in a high-hazard operational environment will recognise.
The problem was not that the issuer was wrong to identify the gap. The problem was that blocking without assessment left everyone stuck. The risk did not disappear because the job was stopped. The leaking valve was still there. The pressure drop was still affecting production. And as days passed, the informal pressure to find a way forward was growing in ways that were harder to document and control than a formal assessment would have been.
This is where ALARP should have been applied from the start.
How management pressure reshapes permit behaviour more broadly is examined in Why PTW Systems Fail Under Pressure and How Operational Drift Takes Hold.
What the ALARP Process Actually Involves
ALARP (As Low As Reasonably Practicable) is a structured approach to risk reduction. In a permit context it applies specifically when the job cannot be controlled to the standard the system normally requires.
The assessment works through a hierarchy of questions. Can the temperature of the system be reduced before work begins? Can the pressure be reduced or relieved? Can the hazardous substance be removed, drained, or displaced? Can the number of people exposed during the work be reduced? Can the duration of the work be shortened?
The questions follow a hierarchy because not all risk reduction options are equal. Removing the hazard entirely is always preferable to reducing exposure to it. Reducing temperature or pressure changes the nature of the hazard itself. Reducing personnel or duration reduces the consequence of exposure if something goes wrong. Working through the options in that order ensures the assessment has genuinely considered the most effective controls before accepting compensating measures lower down the hierarchy.
Each question is answered honestly, not optimistically. The answers determine what compensating controls are available and whether, when applied collectively, they bring the residual risk to a level that is tolerable.
Get the ALARP Risk Reduction Worksheet (Free)
On the steam valve job, the assessment worked through each of those questions in turn. One isolation valve was achievable even if double block and bleed was not. Steam traps post-isolation could be opened to prove the isolation was holding. The line jacket could be removed and the system left for 24 hours while temperature and pressure were monitored to confirm the isolation was effective. The work itself was planned to include a spade insertion early in the sequence to strengthen the isolation before the main task began.
None of those measures alone was sufficient. Together, they reduced the risk to a level where a competent HSE advisor could review the assessment, sign the ALARP sheet, and determine that proceeding was justifiable. The permit was issued. The valve was replaced. The plant pressure issue was resolved.
That is how the process is supposed to work. Not as a way to justify proceeding regardless of risk, but as a structured method for identifying whether a safe path forward exists and documenting the decision properly.
Confined space entry is one of the clearest examples of where this hierarchy gets tested under real pressure. This is examined in Confined Space Entry and Permit-to-Work: When the Risk Changes After Entry Begins.
The Role of the Competent Advisor
The ALARP assessment is not a decision the permit issuer makes alone. A competent HSE advisor reviews the compensating controls identified, challenges any assumptions, and determines whether the collective mitigation is sufficient to make the risk tolerable.
That sign-off matters for several reasons. It brings independent technical judgment to a decision that is being made under operational pressure. It ensures the assessment has been challenged rather than simply completed. And it documents that the decision to proceed was made properly, by the right people, on the basis of a structured analysis rather than under informal pressure to get the job done.
The HSE advisor’s role is not to find reasons to refuse. It is to ensure the assessment is honest and the controls proposed are genuine. Where the risk cannot be brought to a tolerable level, the job does not proceed regardless of how much pressure exists to complete it.
How permit issuer responsibilities interact with HSE advisor sign-off is examined in Permit-to-Work Roles and Responsibilities: Where Accountability Breaks Down.
Management Pressure and Why ALARP Helps
Production schedules, output targets, and cost implications create real pressure on permit issuers when jobs are blocked. Some managers are significantly less risk-averse than the people responsible for issuing the permit. The longer a job remains stopped, the more people become involved, and the more that pressure intensifies.
The pressure is not always about finding the right solution. Sometimes it is simply about getting the job done, and the issuer is expected to find a way to make that happen regardless of what the risk assessment shows. That is the reality many permit issuers face, and it is one that most official guidance never acknowledges.
A properly applied ALARP process gives the permit issuer something that a straight refusal does not: a structured framework for explaining the decision and a clear path toward resolution. Rather than a standoff between management and the issuer, the ALARP assessment creates a shared problem-solving process where all parties work toward the same outcome: finding a way to complete the job safely.
That shifts the conversation entirely. Management cannot simply pressure an issuer to proceed when the issuer can show exactly what risk reduction has been assessed, what controls are in place, and what a competent HSE advisor has determined about the residual risk. The assessment creates accountability on all sides.
The alternative is what happens when no formal process exists. Jobs blocked during the day are completed overnight by people who felt they had no documented route forward. No assessment. No competent sign-off. No record of what controls were applied. The risk was taken anyway, just without any of the structure that would have made it defensible. That outcome is worse for the issuer, worse for the workforce, and worse for the organisation than a properly conducted ALARP assessment would ever have been.
ALARP Beyond Minimum Isolation Failures
One of the most common misunderstandings about ALARP in a permit context is that it only applies when minimum isolation cannot be achieved.
That view is too narrow. ALARP is a valuable tool for any job where there is an opportunity to reduce risk further, even when the minimum isolation standard has been met.
Can the temperature be reduced before the line is broken even though isolation is in place? Can unnecessary personnel be kept out of the area even though the permit is valid? Can the duration of the highest-risk phase of the work be shortened by better planning?
These questions are worth asking on every job, not just the ones that fail the isolation hierarchy. The minimum standard defines the floor below which work should not proceed. It does not define the ceiling of what is achievable in terms of risk reduction.
Applying ALARP thinking more broadly, treating it as a way to identify additional mitigation on any complex or high-risk job rather than a last resort when the standard cannot be met, changes the quality of pre-job planning across the permit system.
How routine work creates the conditions where these shortcuts become normalised is examined in Routine Work Is Where Permit Systems Quietly Fail.
What the Assessment Documents
A properly completed ALARP assessment records the options considered, the controls applied, and the basis on which the decision to proceed was made. It names the competent person who reviewed the assessment and confirms the controls are adequate.
That documentation protects the permit issuer, the HSE advisor, and the organisation. It demonstrates that the decision was made properly, that the risk was not simply accepted without analysis, and that the work proceeded on the basis of a structured and reviewed assessment rather than informal pressure.
For the permit issuer personally, a completed ALARP assessment matters for a specific reason. It demonstrates that the decision was not made under informal pressure, that the risk was properly assessed, and that the issuer discharged their responsibility competently. An issuer who blocks a job without assessment and something subsequently goes wrong because the work was completed informally has no documentation to demonstrate they handled the situation properly. An issuer who completes the assessment does.
Where the assessment concludes that the risk cannot be brought to a tolerable level, that conclusion is also documented. The job does not proceed. That decision, properly recorded, is equally important.
The ALARP assessment is examined as part of permit system reviews in the Permit System Diagnostic Toolkit. How isolation failures develop when ALARP assessments are not applied is examined in Lockout Tagout and Permit-to-Work: Where Isolation Control Fails.
The Practical Test
An ALARP assessment that takes ten minutes to complete and is signed off under time pressure is not an ALARP assessment. It is a piece of paper that gives the appearance of compliance while the decision was already made.
A genuine assessment works through each mitigation option honestly, challenges the assumptions behind each proposed control, and reaches a conclusion that the competent reviewer can defend independently of the operational pressure that prompted the assessment.
There is one question worth asking before signing off any ALARP assessment. If this job resulted in an incident, would this assessment demonstrate that every reasonable measure was taken to reduce the risk before work began?
If the answer is yes, the assessment is sound. If the answer is no, more work is needed before the permit is issued.
Most permit systems have a mechanism to stop work. Fewer have a structured mechanism to find a safe way to restart it. ALARP is that mechanism.
How ALARP decisions are examined during an operational audit is covered in How to Audit a Permit-to-Work System: The Operational Approach.
Key concepts are summarised in the Permit-to-Work Reference Guide.
Assessing Permit Systems in Practice
For organisations that want to assess how ALARP decisions are being made within their permit system and whether issuers are engaging with the process or deferring without structured assessment, see Permit-to-Work System Review – Northshore Safety Services.