Lockout/Tagout (LOTO): Paper to Digital Energy Isolation

Lockout/Tagout (LOTO), OSHA's standard for the control of hazardous energy (29 CFR 1910.147), ranked fourth on OSHA's list of most frequently cited standards for FY2025 (OSHA). In the preliminary FY2026 figures OSHA presented in September 2026, covering 1 October 2025 to 31 August 2026, it ranked third with 1,863 violations (OSHA presentation slides). This guide concentrates on program failures rather than workers refusing to apply locks: expired or generic energy-isolation procedures, stored energy that was never identified, group LOTO that no one actually controlled, and periodic inspections that exist only on paper.

This guide is the 2026 playbook for moving a LOTO program from a paper binder into a digital, audit-defensible workflow — without losing the operator-led culture that makes LOTO actually work on the floor.

Why LOTO stays on OSHA's most-cited list

The failure modes below sit at the boundary between procedure, equipment and the human applying the lock.

• Generic procedures. For example, a single "machinery" procedure used across 40 different machines whose isolation points and steps differ. 1910.147(c)(4)(ii) requires procedures that "clearly and specifically" outline the scope, purpose, authorization, rules and techniques, including specific steps for shutdown, isolation, lock placement, removal and transfer, and testing.
• Missing stored energy. Hydraulic accumulators, capacitors, springs, gravity, residual steam — identified during commissioning, forgotten by year five.
• Group LOTO chaos. For example, a contractor crew working under one padlock without a group procedure that protects each authorized worker.
• Periodic inspection theatre. Annual inspection checkbox ticked without anyone actually watching the procedure run.
• Shift-handover gap. Lock removed by the wrong person because outgoing shift didn't document why it was applied. The standard requires each device to be removed by the employee who applied it, or under a documented employer procedure when that person is unavailable (1910.147(e)(3)), and specific procedures for shift changes (1910.147(f)(4)).

Each of these is largely a process problem rather than a discipline problem. Software can help with process problems where it is configured and used, but it does not fix them on its own.

The 6 LOTO program pillars

A defensible LOTO program in 2026 rests on six pillars. A gap in any of them is a likely audit finding.

1. Energy survey & equipment register. Every piece of equipment that requires lockout has an entry: energy sources (electrical, hydraulic, pneumatic, mechanical, thermal, chemical, gravity), magnitudes, isolation points and stored-energy hazards.
2. Machine-specific isolation procedures. One per machine or per family of identical machines — never generic. Step-level, with photos, isolation point IDs and verification step. The standard requires procedures to be developed, documented and used, with specific steps for shutdown, isolation, lock placement, removal and transfer, and testing (1910.147(c)(4)). It lets an employer skip the written procedure for a particular machine only when every one of the conditions in the paragraph's exception is met, for example a single, readily identified energy source and no potential for stored or residual energy, so check the full list before relying on it.
3. Authorised-employee training & competency. Role-based: authorised employees who apply locks, affected employees who work near locked-out equipment, other employees in the area (1910.147(c)(7)). Retraining whenever job assignments change, when machines, equipment or processes change in a way that presents a new hazard, when the energy control procedures change, or when a periodic inspection (or other reason to believe) shows deviations or gaps in knowledge (1910.147(c)(7)(iii)).
4. Periodic inspection. Procedure inspection at least annually by an authorised employee other than the one(s) using the procedure, documented with deviations and corrective actions (1910.147(c)(6)). The employer must also certify each inspection, naming the machine or equipment, the date, the employees included and the inspector.
5. Contractor coordination. Outside contractors briefed on host LOTO procedures, and host briefed on contractor procedures, before any work starts; the standard requires the on-site and outside employer to inform each other of their procedures (1910.147(f)(2)). Permit-to-work integration is non-negotiable here (the permit to work template shows one permit layout, and the contractor prequalification playbook covers the wider contractor process).
6. Audit & continuous improvement. Trending of LOTO near-misses, removed-without-authorisation events, procedure-deviation frequency, refresher training compliance.

Energy isolation procedure template

A machine-specific procedure needs enough detail to apply isolation safely. OSHA 1910.147(c)(4) specifies content, not a one-page limit. Use these six questions to check completeness:

1. What is being locked out? Equipment ID, location, photo.
2. What energy sources exist? Electrical (panel ID, breaker number), hydraulic, pneumatic, mechanical, thermal, chemical, gravity. Magnitudes where known.
3. What is the isolation sequence? Step-level, e.g. "Notify affected employees → shut down equipment per normal stop → open disconnect at MCC-3 cubicle 12 → lock with personal padlock → release hydraulic pressure at port HP-2 → vent pneumatic at FRL-1."
4. What is the verification step? Try-to-start, voltmeter reading, gauge reading at zero.
5. What stored energy must be addressed? Capacitor discharge, hydraulic accumulator bleed, gravity (block of vertical components), residual steam.
6. What is the release-from-lockout sequence? Inspection, removal of tools, area clear, locks removed by each authorised employee, notification, restart.

In digital LOTO software each step is a discrete action with a checkbox, photo evidence and optional gas/voltage reading entry.

Group LOTO and shift-handover

Group LOTO and shift handover can be hard to audit on paper.

Group LOTO (1910.147(f)(3)) — used when multiple workers (often a contractor crew) work on the same equipment. The standard vests primary responsibility in an authorised employee for a set number of workers, requires that person to be able to check each group member's exposure status, requires one designated authorised employee to coordinate when more than one crew is involved, and requires each authorised employee to affix a personal device to the group lockout device, group lockbox or comparable mechanism when starting work and remove it when stopping. A lockbox is one implementation, not the only compliant method. Define responsibility, personal protection and transfer arrangements for the work.

Shift handover — 1910.147(f)(4) requires specific procedures for the orderly transfer of lockout or tagout protection between off-going and oncoming employees. A workable record has the outgoing primary authorised employee brief the incoming one, transfer the procedural lock and document the transfer, so that no device is removed by someone who cannot say why it was applied.

A digital LOTO product may support both: a group LOTO event could show live who has a personal lock attached, when each was applied, and what the outstanding hazards are, and a handover could create an audit-trail entry that links outgoing and incoming employees. Check each behaviour in a demonstration.

Digital LOTO — what "moving off paper" actually means

A digital LOTO platform replaces three paper artefacts:

• The procedure binder at the equipment — replaced by mobile retrieval of the current, version-controlled procedure by scanning an equipment QR/NFC tag.
• The paper lockout log — replaced by a live record of every active lockout, who applied it, when, and against which procedure.
• The paper periodic inspection — replaced by a structured observation form completed by an independent authorised employee with photo and deviation notes.

Capabilities to look for, and to test in a demonstration:

• Mobile-first lock placement. Authorised employee scans equipment, opens the procedure, ticks each step, photographs isolation points, captures voltmeter readings.
• Permit-to-work tie-in. A hot-work permit, confined-space entry or maintenance work order cannot be issued unless the underlying LOTO is verified open and active.
• Group LOTO management. Visual board of active group lockouts with personal-lock attachment status.
• Procedure version control. When the procedure changes, the next attempt to apply it forces the operator to acknowledge the new version. Old PDFs are not retrievable.
• Periodic-inspection scheduler. Annual inspections scheduled, assigned, observed and recorded — with auto-escalation when overdue.

Leading KPIs for LOTO

Alongside lagging indicators (citations, injuries), track a leading set:

• Procedure freshness. Percentage of machine-specific procedures reviewed within the last 24 months (this guide's own review cycle; the standard sets none). Suggested target: >95%.
• Periodic inspection compliance. Percentage of equipment with a current annual inspection. Target: 100%.
• Procedure deviations per 100 lockouts. Target: trending down quarter-over-quarter.
• Lock-removed-without-authorisation events. Target: zero — every event triggers an immediate investigation.
• Group-LOTO usage rate. Percentage of multi-worker jobs with a documented group procedure and verified personal protection, including shift changes.
• Near-miss capture rate. LOTO-related near-misses per 200,000 hours (see the near-miss reporting guide). Trending up early in a program is good — it means people are reporting.

Worked example: one periodic inspection, record by record

This is an illustration with invented details, not a template from OSHA. A plant has a hydraulic press with one electrical disconnect, one hydraulic accumulator and a gravity-loaded ram. The annual inspection of its energy control procedure is done by an authorised employee from the maintenance team who does not use that procedure. The inspector watches an authorised employee carry out the written procedure and checks it against what the standard asks the inspection to cover.

The inspection is then certified with the machine, date, employees included and inspector, as 1910.147(c)(6) requires. Any deviation that shows a gap in an employee's knowledge also triggers retraining under (c)(7)(iii), so the record should link the finding to a training task rather than a closed comment.

Questions to ask a LOTO software vendor

These questions apply to any product. The answers are the vendor's claims until you see them work on your own equipment; the site's lockout/tagout software page shows what the reviewed profiles document and does not rank them.

1. Can you show one procedure being revised, approved and then retrieved by an operator on a phone, with the old version no longer offered?
2. Can the inspection record carry the fields the certification needs: machine, date, employees included and inspector, and can the inspector be blocked from inspecting a procedure they used?
3. How does the product behave with no connection at the equipment? The site's offline-support study explains the offline labels and sets out a field test a buyer can run.
4. What does a group lockout look like when two contractors and two shifts are involved, and who sees the exposure status of each member?
5. Which links to permit-to-work and work-order systems are included, and which are configuration or paid add-ons? The integration-claims study explains what a conditional integration claim means and how to test one.
6. Can the audit trail show who changed a procedure, when and why? The audit-trail and document-control study covers how that capability is documented.

Contractor LOTO governance

Contractor coordination is where shared accountability creates real audit risk. The defensible pattern in 2026:

• Contractor competency on host LOTO procedures verified at induction, refreshed annually.
• Host briefs contractor on host procedures; contractor briefs host on any contractor-specific procedures. Both briefings recorded.
• Contractor authorised employees added to the host's group LOTO system with their own personal locks.
• Contractor LOTO events visible on the host's live LOTO board and audited the same way as host events.

This is exactly the integration point covered in our Contractor Management Software 2026 guide.

Common failure modes

Common LOTO failure patterns:

• Stored energy missed. A hydraulic accumulator or capacitor not in the procedure. Fix: energy survey discipline + photo-verified isolation point.
• Group lock confusion. Personal protection or overall responsibility is unclear, or a primary device is removed too early. Verify the group procedure against 1910.147(f)(3), using the appropriate group device, lockbox or comparable mechanism.
• Expired procedures. For example, a procedure last reviewed in 2019 for a machine modified twice since. Fix: MOC trigger that forces procedure refresh before commissioning, version control in the platform.
• "Soft" lockout. Energy disconnected but not physically locked, on the assumption no one would re-energise. Fix: zero-tolerance policy, supervisor coaching, audit.
• Shift handover lock removal. Incoming shift removes a lock without confirming why it's there. Fix: documented handover in the platform, the lock is removed by the employee who applied it or, where the standard's exception applies, under the employer's documented removal procedure, which must include verifying that the applicant is not at the facility and making sure the applicant knows before resuming work (1910.147(e)(3)); the platform should record each step.

30-60-90 day rollout

Days 1–30 — Foundation. Complete equipment register, prioritise top 20% of assets by LOTO frequency, refresh machine-specific procedures for those, identify authorised employees by role.

Days 31–60 — Digital pilot. One area or unit goes fully digital — mobile procedure retrieval, electronic lock log, group LOTO management, integrated permit-to-work. Measure procedure deviations and procedure-retrieval time.

Days 61–90 — Site rollout. Cascade to remaining areas, contractor onboarding to digital LOTO, periodic-inspection scheduler activated, leading-KPI dashboard live, audit-ready evidence pack generated.

Where LOTO fits in the wider EHS stack

LOTO doesn't live in isolation. It connects to:

• Permit-to-work software — hot work, confined space, line breaking all reference an underlying LOTO.
• Process Safety Management Software 2026 — lockout/tagout is one of the safe work practices the PSM operating-procedures element requires (1910.119(f)(4)).
• Incident Investigation & RCA 2026 — LOTO failures become learning input for the next procedure refresh.
• Best Safety Management Software — for the underlying EHS platform that hosts all of the above.
• ISO 45001 software — LOTO is one of the operational controls an ISO 45001 management system plans and maintains (ISO 45001:2018 is a voluntary standard).

FAQ

Does OSHA require digital LOTO? No. The standard is technology-neutral. But producing the evidence the standard requires — current machine-specific procedures, periodic inspections, training records, group LOTO management — can be easier to produce and keep consistent digitally, depending on how the system is configured and used.

How is LOTO different from permit-to-work? LOTO is the energy-isolation method. Permit-to-work is the authorisation envelope under which work happens. Hot work, confined space entry, line breaking and many maintenance jobs require both a permit and an active LOTO.

How often must LOTO procedures be reviewed? OSHA requires a periodic inspection of each energy control procedure at least annually, performed by an authorised employee other than the one(s) using the procedure (1910.147(c)(6)). This guide also suggests reviewing the procedure document every 24 months, or whenever the equipment changes via MOC.

Does the standard apply on construction sites? No. 1910.147 states that it does not cover construction and agriculture employment, shipyard, marine terminal and longshoring employment, electric-utility generation and distribution installations, electrical hazards covered by subpart S, or oil and gas well drilling and servicing. Other OSHA standards can still require lockout in those settings. It also excludes cord-and-plug equipment where unplugging controls the hazard and the plug stays under the servicing employee's exclusive control. Check the standard's scope paragraph before applying this guide to a construction or utility site.

Is a tag enough? Where a device can be locked out, a tag alone must provide a level of safety equivalent to a lock, and the employer must demonstrate that equivalence (1910.147(c)(3)). The tagout training requirements describe tags as warning devices that do not give the physical restraint a lock does. Read the glossary entry for LOTO and the hierarchy of controls to see where isolation sits among other controls.

Can contractors apply locks to host equipment? Yes — and they should, as part of a properly managed group LOTO. OSHA requires the host and the outside employer to inform each other of their lockout or tagout procedures (1910.147(f)(2)); verifying competency and integrating contractor locks into the host's LOTO system is the good practice this guide recommends.

Which paragraphs cover procedures and periodic inspections? Documented energy control procedures are required by 1910.147(c)(4) and the annual periodic inspection by 1910.147(c)(6). OSHA's public Top 10 list reports citations for the standard as a whole, not by paragraph.

Where does LOTO fit in OSHA's Top 10 trend? LOTO ranked fourth in FY2025 (OSHA) and third in the preliminary FY2026 figures (OSHA presentation slides). See our OSHA Top 10 Citations 2026 Prevention Playbook for the wider pattern across the most-cited standards.

Sources

• eCFR, 29 CFR 1910.147, the control of hazardous energy (lockout/tagout)
• eCFR, 29 CFR 1910.119, process safety management
• OSHA, Top 10 Most Frequently Cited Standards, FY2025
• OSHA, Top 10 most cited standards, preliminary data for 1 October 2025 to 31 August 2026 (presentation slides, NSC Safety Congress & Expo, September 2026)
• ISO, ISO 45001:2018 Occupational health and safety management systems

Corrected 23 September 2026: statistics without a primary source were sourced, labelled as examples or removed, and the regulations cited now link to their official texts.

Updated 4 October 2026: the OSHA Top 10 figures and the paragraphs of 29 CFR 1910.147 cited here were re-checked against OSHA's list and the eCFR text. The documentation exception, the group lockout and shift-change wording, the lock-removal exception and the standard's scope were corrected, and a worked inspection example and vendor questions were added.