Every site with a permit to work process believes it has the problem under control. Then an audit walks in, or worse, an incident happens, and someone discovers a permit that expired three weeks ago and nobody noticed. It\’s rarely a case of nobody caring. It\’s a case of the system never being built to notice on its own.
A permit to work system that exists only to record permits is not doing its job. Recording is the easy part. A spreadsheet records a permit. A binder at the gate records a permit. What neither of those does is tell you, unprompted, that something has gone past its window and needs attention right now.
A hot work permit, a confined space entry, a working at height authorisation — each of these carries a validity window because the risk profile of the work changes the moment that window closes. A permit that\’s still marked \”approved\” after its end time isn\’t a clerical error. It\’s a live gap between what the paperwork says and what\’s actually true on site. Anyone walking past sees an approved permit and assumes the controls behind it are still in place. They might not be.
This is the specific failure that catches most sites out, and it\’s worth being precise about why it happens. It isn\’t that permit approvers are careless. It\’s that nobody\’s job is to sit and watch a clock. The person who approved the permit has moved on to the next task. The person who raised it is doing the work, not monitoring its own deadline. Unless something in the system is actively checking time against status, on a schedule, the permit sits in whatever state it was last left in — indefinitely.
A permit to work system worth using does three things a binder or a spreadsheet cannot:
It checks itself. On a schedule, not just when someone remembers to look, the system compares every approved permit\’s end time to the current time. When a permit runs past its window, the system — not a person — flips it to expired, stamps the moment that happened, and notifies whoever raised it. Nobody has to remember to check, because nothing is waiting on a human\’s memory.
It knows who should approve, based on where the work is happening. A permit for hot work in one part of a site and a permit for confined space entry in another shouldn\’t route to the same generic approver just because the form looks the same. The right approval chain depends on the area, and pulling in the right area owner automatically is what keeps the approval meaningful rather than a rubber stamp. A three stage, area aware approval chain means the person actually accountable for that part of the site is the one saying yes.
It treats an extension as a decision, not a formality. A permit that\’s still live and needs more time should be extendable — that\’s normal, work runs long. But a permit that has already expired is a different situation entirely, and the system should refuse to quietly extend something that\’s no longer valid. If a permit is not live, extension should be blocked, and the system should say so, rather than let the request through and let the record become misleading.
Most people evaluating a permit to work system focus on the approval steps: who signs off, in what order, with what evidence. That part matters, but it\’s the part everyone already gets roughly right, because it\’s visible and manual processes can approximate it reasonably well with enough discipline. Automatic expiry is different — it\’s the part that manual processes cannot approximate at all, because it depends on something checking continuously, not on a person remembering to check.
This is also usually the exact gap an audit finds. An auditor doesn\’t need to catch a fraudulent approval to write up a finding — an expired permit still marked live is enough on its own, because it\’s evidence that the control that\’s supposed to keep unsafe work from continuing unmonitored isn\’t actually working. It\’s also, separately, the condition that precedes real incidents: work continuing under controls that were only ever valid for a fixed window, past the point anyone re-checked whether those controls still made sense.
If you\’re evaluating a permit to work system, the paperwork questions — templates, fields, approval steps — are the easy ones to get answers to. The harder, more important questions are about what happens when nobody is looking. Does the system check permit status against time on its own, on a schedule? Does it notify the right person automatically when something expires, or does that depend on someone opening a report? Can an expired permit be quietly extended, or does the system draw a hard line?
Get a straight answer to those questions before anything else. A system that handles approvals beautifully but leaves expiry to human memory has simply moved the same old risk into a nicer looking interface.
