Shift handover is one of the most referenced failure points in permit-to-work systems. It appears in incident investigations, audit findings, and near-miss reports across industries. Yet most permit systems treat it as an administrative step rather than a critical control point.
The problem is not that handovers do not happen. It is that what gets transferred is rarely sufficient for the incoming shift to take genuine operational ownership of the work.
The Gap Between Information and Understanding
When a permit issuer hands over a job to the incoming shift, the transfer typically happens in one of two ways.
The first is a verbal briefing, where the outgoing issuer tells the incoming issuer what is active, what the status is, and anything worth knowing. This works when both issuers are present at the same time and the outgoing issuer has been across the job throughout their shift. It does not work when the outgoing issuer left early, when the job changed status late in the shift, or when there are ten permits to hand over in fifteen minutes at the end of a busy day.
The second is documentation, where the incoming issuer reads the permit and assumes it reflects the current state of the work. This is the more dangerous of the two. A permit describes the job as it was when it was issued. It does not capture what changed during the shift, what the task performer found when they got to the workface, what isolations were difficult to achieve, or what remains incomplete.
In both cases the incoming issuer is receiving information. They are not receiving understanding. Those are different things, and the gap between them is where handover failures develop.
How permit systems behave differently under operational pressure is examined in Why PTW Systems Fail Under Pressure and How Operational Drift Takes Hold.
What Actually Gets Missed
The most consistent gap at handover is isolation status. An incoming issuer accepts a job with isolations listed on the permit and assumes they have been applied as documented. In practice that assumption is often wrong.
Isolation points noted on the permit may not have been locked off as stated. The previous issuer may have accepted a standard below the site minimum under pressure, without documenting that decision or communicating it forward. And when isolations have been physically checked at handover, discrepancies between what the permit records and what is actually in the field are not uncommon.
A reliable check for LOTO jobs is the isolation tag. When a piece of equipment is isolated a numbered tag should be applied to the lockout box. If a job is handed over and no tag is present that is an immediate signal that isolation has not been applied as documented. The job should not proceed until isolation is physically re-verified from scratch. It takes time. It causes friction. It is the right call every time.
The interaction between isolation control and permit systems is examined in Lockout Tagout and Permit-to-Work: Where Isolation Control Fails.
The second consistent gap is equipment status at handback. When a job is signed off as complete by the task performer, operations typically assumes the equipment is ready to return to service. In practice that assumption is frequently wrong.
Lines are handed back with loose flanges. Tank lids are not fully secured. Pumps are handed over before lines have been tested under pressure. Parts removed during the job have been stored elsewhere and not documented, so nobody knows what is missing until the system is restarted and something fails. Product cascades from an unsecured fitting. A pump runs dry because a valve was not reinstated. The permit was closed. The handback section was signed. None of that captured what was actually left incomplete.
The third gap is the shift where no verbal handover is possible at all. A job is active when the outgoing issuer finishes their shift. The incoming issuer arrives and the outgoing issuer has already gone home. The only information available is what is written on the permit. If that documentation is incomplete, and the permit describes the job as it was issued rather than as it currently stands, the incoming issuer is essentially blind to the status of the work they are now responsible for.
This is the highest risk handover scenario and it is more common than most sites acknowledge.
Accepting a Handover That Is Not Compliant
One of the more uncomfortable realities of shift handover is that incoming issuers sometimes inherit jobs that were not being run correctly by the previous shift.
Equipment may be isolated but not to the minimum standard. Compensating controls that should have been applied were not. The task performer has been working under conditions that the permit does not properly authorise.
An incoming issuer who accepts that job without checking inherits the liability as well as the permit. An incoming issuer who checks and finds the discrepancy is in the difficult position of having to put additional measures in place, potentially stopping work, and addressing a gap created by someone else.
The right response is always to verify. If isolations do not meet the minimum standard and no ALARP assessment has been completed, the job stops until the position is properly assessed and documented. If the handback section is incomplete and equipment has not been properly returned to service, the permit does not close until it has been.
How ALARP assessments apply when minimum isolation cannot be met is examined in the Permit System Diagnostic Toolkit.
That requires issuers who understand that accepting a handover is not a formality. It is a transfer of accountability.
What Effective Handover Looks Like
The best handover involves both issuers and both task performers at the workface at the same time.
The outgoing issuer walks the incoming issuer through the job in the field, not at the permit office, not over the phone, not through a written note. They show the isolation points, confirm what has been applied, identify anything that changed during the shift, and explain anything the permit does not capture. The outgoing task performer does the same with the incoming team.
That standard is not always achievable. Shift patterns, site logistics, and operational pressure make simultaneous workface handovers impractical in many environments. But where it is achievable it should be the expectation rather than the exception.
Where it is not achievable, documentation has to compensate. The permit needs to reflect the current state of the job, not the state it was in when it was issued. Isolation discrepancies need to be noted. Incomplete work needs to be clearly flagged. Anything the incoming issuer needs to know that is not obvious from the permit itself needs to be written down before the outgoing issuer leaves site.
The handback section of the permit is particularly important. It is frequently ignored or completed as a formality. It should be the point at which the issuer confirms physically, at the equipment, that the system is in the condition operations is about to assume it is in. Flanges tight, lids secured, lines tested, all parts accounted for, system ready to return to service.
Why restart is the most dangerous phase of the permit lifecycle is examined in Plant Restart: Managing the Most Dangerous Phase of the Permit Lifecycle.
The Permit System’s Role
Most permit systems have a handback section. Few treat it as an actual control point. Most treat it as a signature to collect before closing the permit.
The difference between a permit system that handles handover well and one that does not is rarely about the paperwork. It is about whether the system requires physical verification at the point of transfer, or whether it allows issuers to accept a handover on the basis of what is written rather than what can be confirmed in the field.
A permit system that accepts verbal handover as sufficient, that does not require isolation re-verification when documentation is incomplete, and that treats the handback section as an administrative close-out is a system that is managing handover on trust rather than control.
Trust works when conditions are stable and the people involved are experienced and careful. It stops working when the site is busy, the outgoing issuer is tired, the incoming issuer is new to the job, and production is waiting.
The handover is where that trust gets tested. Most permit systems do not have a mechanism to catch the moment when it fails.
How coordination between permits breaks down during simultaneous operations is examined in SIMOPS and Permit-to-Work: Managing Overlapping Risks in High-Hazard Operations.
The patterns that develop at handover are examined across the site’s permit system in Common Permit-to-Work Failure Patterns Across Industries. How those patterns are identified during an audit is covered in How to Audit a Permit-to-Work System: The Operational Approach.
Key concepts are summarised in the Permit-to-Work Reference Guide.
Assessing Permit Systems in Practice
For organisations that want to assess how their permit system handles shift handover and the transfer of operational control, see Permit-to-Work System Review – Northshore Safety Services.