Working at Height and Permit-to-Work: Where Controls Break Down in the Field
The permit covered the roof. The work moved to the adjacent section. Nobody had assessed it, nobody had fitted edge protection, and three people were already on it before anyone noticed the scope had changed.
Working at height accounts for the largest share of fatal workplace injuries across high-hazard industries. The permit-to-work system is one of the primary controls that should prevent those deaths. In practice, the permit tends to fail not because the hazard was unrecognised, but because the controls it specified were never confirmed in the field. A permit that names edge protection as a requirement is not the same as edge protection that has been fitted, inspected, and standing when work begins.
A permit authorises work to proceed once controls are in place. It is not confirmation that they are. The gap between those two things is where working at height incidents occur.
What the Permit Must Control
Working at height introduces a set of hazards that require active, physical management rather than procedural acknowledgment. The permit-to-work system must go beyond listing control measures and must create the conditions under which those measures are actually present before work begins.
The core hazard categories a working at height permit should address include:
- Falls from the working area, including from leading edges, roof perimeters, and open excavations at height
- Falling objects striking workers or members of the public below
- Structural integrity of the access route and working surface
- MEWP and access equipment stability, including outrigger deployment and ground conditions
- Exclusion zones below aerial work to protect people at ground level
- Access control to prevent unauthorised entry to the work area
- Rescue and emergency procedures in the event of a fall or suspension trauma
Each of these is a physical state that must be confirmed on site, not a box ticked on a form. The permit issuer carries responsibility for verifying that each control is in place before sanctioning work to proceed. That verification is the control.
The most dangerous assumption in height work is that controls specified on a permit have been implemented by the time work begins. In a significant number of incidents, they have not.
Where Working at Height Controls Fail
Height-related permit failures follow identifiable patterns. Understanding where and why these patterns emerge is more useful than a generic reminder to follow the procedure. Each of the following failure modes has appeared in incident investigations, and several are directly connected to the way permit systems operate under production pressure.
Edge Protection Not Installed Before Work Begins
Edge protection is typically a pre-start condition on a working at height permit. In practice, task performers sometimes access the work area while controls are still being erected. The window between permit authorisation and the moment work actually begins is often treated as dead time rather than a controlled period. If the issuer is not physically present at the work area when work commences, there is no one to confirm the controls are in place.
No Exclusion Zone Below Aerial Work
Permits for MEWP operations, roof access, and scaffold work routinely specify an exclusion zone at ground level. On process and manufacturing sites, the zone is often undermined by site traffic, other task performers using the area, or the absence of any physical barrier. A cordon marked on paper is not a cordon. If the only person managing the exclusion zone is the banksman, and the banksman is positioned elsewhere, the zone collapses.
MEWP Banksman Positioned in the Basket
The banksman’s role during a MEWP operation is to monitor the ground, manage the exclusion zone, and communicate with the operator. That function cannot be performed from the basket. When a banksman is in the basket, there is no one at ground level managing the hazard to people below. This is a direct failure of the permit condition, and it occurs on both contractor and directly employed workforces, often because task performers find it more convenient to have a second person in the basket than on the ground.
Scaffold or Platform Substituted to Avoid Cost or Time
A task that requires a scaffold for safe access is sometimes carried out from a ladder or MEWP instead, because erecting and inspecting scaffold takes time and resources. The permit system may not catch this substitution if the original method of access was captured in the risk assessment but was not written as an explicit condition of the permit. If the permit names the work rather than the method, a change in equipment can pass through without triggering a review.
Unauthorised Access by Observers and Auditors
Roofs, scaffolds, and elevated platforms attract people who want to check on job progress, carry out inspections, or observe work without being task performers. These individuals often do not obtain a permit because they consider themselves visitors rather than workers. Without a permit, they are not covered by the control framework. The permit issuer cannot maintain oversight of personnel on site if some of them have bypassed the permit process entirely.
Scope Creep: When the Work Moves Beyond the Permit
Scope creep is one of the most consistent failure modes in working at height incidents. A permit is issued for a defined area with a specific set of controls. During the job, the scope extends beyond that area without a formal review. The most common trigger is discovering that adjacent access is needed to complete the primary task.
Edge Protection on an Adjacent Roof
A permit was issued for roof access with edge protection specified as a pre-start condition on the permitted area. During the job, the task performers needed to access an adjacent roof section to complete the work. That section had not been included in the original permit scope. The edge protection required for it had not been assessed, specified, or installed.
The work had started before anyone walked the job to confirm the controls were in place on the permitted area. The adjacent roof access was a consequence of scope that had grown during planning, with the original permit reflecting what was planned rather than what was actually required. When the issuer checked, the permitted area had people on it and the adjacent section had no edge protection at all.
Pre-commencement verification would have caught this before work began. A permit that requires confirmation of control measures at the point of work, not at the point of issue, creates a different checkpoint. The signature is not the check. The walk is the check.
The permit system is most vulnerable to scope creep when there is time or production pressure. Task performers extend into an adjacent area because returning to the permit office to request a new or extended permit interrupts progress. The permit issuer may not be present. The work continues into areas that have not been assessed.
Preventing scope creep requires two things the permit process alone does not always provide. First, a pre-commencement check that physically confirms the boundaries of the permitted area and the controls installed within it. Second, a clear and genuinely followed instruction that any extension of scope requires a new or amended permit before work proceeds, not after.
MEWP Operations: Where the Permit Conditions Break Down
Mobile elevated work platforms introduce a specific set of conditions that a permit must address and that must be physically verified before operation begins. The conditions on the permit are the minimum. Their presence in the field is what matters.
Banksman in the Basket, No Ground Exclusion Zone
On a pharmaceutical manufacturing site, a MEWP permit specified a ground banksman and an exclusion zone below the working envelope. During the job, the banksman was in the basket with the operator. There was no one on the ground managing the exclusion zone. Site personnel and contractors were moving through the area below without restriction.
This pattern appeared on both contractor and direct employee jobs on the same site. The banksman in the basket felt useful there. On the ground, the role felt passive. The permit condition that placed a ground banksman at the exclusion zone boundary was not challenged at pre-start, and it was not enforced once work was underway. The result was an unmanaged risk to people below for the duration of the operation.
A pre-commencement check that confirmed the banksman’s position and the physical cordon would have identified the deviation before any material was lifted. The permit named the control. Nobody confirmed it was operating.
MEWP operations on process and manufacturing sites carry additional risks that a permit must explicitly address. Production activity continues around and below the work area. Pedestrian routes and vehicle access cross the working envelope. The exclusion zone must be physically established with barriers or cones and must be maintained for the duration of the lift. A banksman at ground level is not a bureaucratic requirement. They are the only person who can see the full situation below the basket.
- Ground conditions assessed, outriggers deployed where specified
- Exclusion zone physically established with barriers or cones
- Ground banksman confirmed at zone boundary before operation begins
- Overhead obstructions and services identified and marked
- MEWP pre-use inspection completed and recorded
- Emergency rescue plan confirmed, rescue equipment on site
Where the permit specifies scaffold as the required method of access, substituting a MEWP or ladder requires a formal review of the risk assessment and an updated permit. A different access method may introduce different hazards. The original controls were specified against the original method. They cannot be assumed to transfer. This is the point at which cost or time pressure most often drives an unsafe substitution, and it is the point at which the permit issuer needs to hold the line.
Unauthorised Access: The Observer Problem
Permit-to-work systems are built around the concept of authorised personnel. A permit names the task, the area, the controls, and the people covered. People who access the work area without a permit are outside that framework entirely.
On sites with active maintenance programmes and a culture of operational engagement, this is not a theoretical risk. Managers checking progress, engineers auditing scaffold compliance, supervisors wanting to see the condition of plant from above; all of them have legitimate reasons to be interested in the work area, and none of them consider themselves task performers requiring a permit.
An observer on a roof without a permit is not a minor administrative gap. They are a person at height with no assessed controls, no inclusion in the rescue plan, and no visibility to the permit issuer responsible for the area.
The practical difficulty is that these individuals often have seniority over the permit issuer. Telling a senior manager that they need a permit to step onto a scaffold can feel like an impossible instruction to enforce. The permit issuer’s authority in that moment is real, but it is rarely backed by the kind of organisational support that would make it easy to exercise.
Two things reduce the frequency of this failure. The first is a clear site rule, reinforced at inductions, that no person enters a working at height area without either being named on the permit or obtaining their own access permit. The second is a permit issuer who has been explicitly supported by management to enforce that rule, including with people who outrank them. Without that support, the rule exists on paper and is routinely bypassed in practice.
The permit issuer’s authority to challenge access is only meaningful if the organisation treats that authority as real. Where it is treated as a formality that can be overridden by seniority, the permit system loses one of its core functions.
Pre-Commencement Checks: The One Control That Catches Everything Else
A job walkdown is mandatory before any permit commences. The issuer walks the work area, confirms the scope, and satisfies themselves that the task is ready to proceed. For many jobs, that walkdown is also the pre-commencement confirmation: the controls are in place, the area is correct, and work can begin.
For MEWP operations and other jobs where equipment must be positioned and set up before the controls exist, the initial walkdown cannot confirm what is not yet there. A walkdown completed before the platform is in position and the exclusion zone is established is a scope check, not a control confirmation. The meaningful check for those jobs is the one done once the equipment is set up and ready to operate. Some issuers treated the initial walkdown as the only check and sanctioned work from there. That is the gap.
The practical approach is to walk the job when everything is ready to go. For jobs with no setup phase, this is the walkdown and the pre-commencement confirmation in one step. For MEWP and equipment-dependent jobs, waiting until the platform is in position and the cordon is set before walking the job means the walkdown doubles as the control confirmation. One visit, done at the right time, covers both. Walking the job twice, once before setup and once after, creates duplication without adding value.
That confirmation should cover:
- Edge protection installed, inspected, and in position on all permit-specified boundaries
- The exclusion zone below any aerial work physically established with barriers or cones
- Access equipment matching the method specified in the permit
- Banksman confirmed at the ground position specified on the permit
- Work area boundaries matching the area described on the permit
- No unauthorised personnel in the work area or adjacent areas with access to it
- Rescue equipment on site and rescue plan communicated to task performers
A permit system that treats the issue of the permit as the authorisation to start will produce this failure consistently. A permit system that requires a physical pre-commencement confirmation before work begins, and that gives task performers a clear instruction not to proceed until that confirmation is given, removes the ambiguity.
The confirmation needs to be recorded. The time at which work was sanctioned to begin, by whom, and against what check, should appear on the permit or on an attached pre-start record. A permit that captures issue time but not commencement time cannot tell you whether the check happened before or after work started.
Working at Height: Risk and Control Matrix
A working at height permit must identify the type of work being carried out and specify which controls apply to it. The matrix below reflects the structure used on field permits across high-hazard sites: each hazard type maps to the fall prevention and fall mitigation controls that are relevant to it. Not every control applies to every task. The permit issuer’s job is to select the controls that apply and confirm they are in place before work begins.
Fall prevention controls aim to stop a fall occurring. Fall mitigation controls reduce the consequences if a fall does occur. A robust permit requires both categories to be considered, not treated as alternatives.
| Hazard Type | Fall Prevention Controls | Fall Mitigation Controls |
|---|---|---|
| All roof access |
|
|
| Falling objects |
|
|
| Risk of fall through fragile surface (e.g. skylights) |
|
|
| MEWP (e.g. cherry picker) |
|
|
| Scaffold (all other work at height) |
|
|
| Erect / dismantle access platform from ground floor |
|
|
| Work at height using podium or pulpit ladder |
|
|
| Low-risk work from ladder or step ladder (short duration) |
|
|
| Work from a tank top |
|
|
The matrix is a starting point, not a complete risk assessment. The permit issuer must confirm that the controls selected are physically in place at the work area before sanctioning commencement. A control listed on the permit is not the same as a control that has been inspected and confirmed. The pre-commencement check is the step that closes that gap.
Why Height Incidents Persist Despite Permit Systems
Working at height incidents continue to occur on sites that have permit-to-work systems, risk assessments, and toolbox talks. The permit process is present. The controls it requires are not always present in the field at the moment they are needed.
The gap is almost always in the same place: the period between permit issue and work commencement. This is the window in which the system operates entirely on trust. The issuer trusts that the task performers will implement the controls. The task performers trust that the permit confirms the controls are in place. Neither has physically confirmed anything.
A job walkdown and a pre-commencement confirmation at the work area close that window. For straightforward jobs the walkdown is the confirmation. For jobs involving equipment setup, the confirmation only means something once the equipment is in position. Either way, the permit issuer needs to be at the work area when controls are confirmed, not at the permit office after the permit is issued.
Where permit systems fail under pressure, the field confirmation is usually the first step that gets compressed. The permit is issued, the task performers proceed, and the issuer arrives to find work already underway. At that point the check is no longer a pre-commencement confirmation. It is an observation of what the task performers decided to do in the absence of one.