Updated 22 September 2026

Software Guide · Reviewed 22 September 2026

Control of work software: the interfaces, not the permit

A permit is one document inside a wider system. Control of work is what surrounds it: the task risk assessment the permit conditions come from, the isolation that makes the work safe, the other jobs happening nearby, and the handover when the shift changes before the work finishes. Products are easy to compare on permit features and hard to compare on those interfaces — which is where control actually fails. This guide is about evaluating the joins. For a product-by-product comparison of the permit workflow itself, we keep that on a separate page.

Jump to the 21 products

Editorial responsibility: Dimitris Mitsios (Founder of The QHSE Standard; product marketing at Tekmon) · Tekmon pays for sponsored placements on this site (disclosure) · How pages are made · LinkedIn · Content date: 22 September 2026

On this page (8 sections)

What a permit is, and what it is not

Great Britain's HSE describes a permit to work as a documented procedure authorising specified people to carry out specific work within a set time frame, setting out the precautions required, based on a risk assessment. The important phrase is the last one: the permit records decisions made elsewhere. A platform that issues permits beautifully but cannot show where the conditions came from has automated the paperwork, not the control. Great Britain HSE: permit-to-work systems (COMAH technical measures)

HSE's HSG250 covers the surrounding system — planning, competence, training, monitoring, audit and review — and is written for the petroleum, chemical and allied industries. It is the reference to assess a proposed workflow against, and it is worth doing that before a demonstration rather than after, so you are testing the vendor against your system rather than adopting theirs. HSE HSG250: guidance on permit-to-work systems

Where the work involves hazardous energy, isolation is governed by its own requirements, and in US process safety terms so is the wider programme. These are separate obligations that a permit references rather than replaces. US OSHA: control of hazardous energy (lockout/tagout); US OSHA: process safety management of highly hazardous chemicals, 29 CFR 1910.119

Four interfaces where control is lost

Risk assessment to permit conditions

The permit's precautions should be traceable to an assessment of that task, not selected from a template list. Ask to see the assessment from a permit, and what happens to an open permit when the assessment it derives from is revised.

Permit to isolation

Establish whether an isolation certificate can be signed off, or an isolation removed, while a permit depending on it is still open. Ask what the system does rather than what the procedure says people should do.

Concurrent work nearby

Two permits that are each safe can be unsafe together. Establish how conflicts are detected — by location, by asset, by system — who is shown them, and whether detection depends on someone entering a location accurately.

Shift handover

Most hazardous work outlives the shift that started it. Ask what an incoming issuer sees about a live permit, what they must acknowledge, and whether an unacknowledged permit remains valid.

A demonstration script for the joins

Raise a permit from a task risk assessment

Start at the assessment, not the permit form. Confirm the precautions carry through and that the permit records which assessment and which revision it came from.

Revise the assessment while the permit is live

Change a control in the underlying assessment. Establish what happens to the open permit: suspended, flagged, or silently unchanged. Silence here is the answer you needed.

Attempt to remove the isolation

Try to de-isolate while the dependent permit is open, as a user with the relevant role. If the system permits it, your control is procedural and depends on people, which is a finding worth having before purchase.

Raise a conflicting permit nearby

Create a second permit for adjacent work. Establish whether the conflict surfaces, to whom, at what point in the approval, and what happens if the location was entered slightly differently.

Hand over mid-job and force a failure

Change shift with the permit live, then have the incoming issuer act without acknowledging it. Finally, take the field device offline and establish what a holder can and cannot do disconnected, and what the control room sees meanwhile.

Where to compare the products

The vendors serving this category are the same ones compared in detail on our permit-to-work software guide, which sets out each product's documented workflow scope, offline limits and commercial boundaries with its sources and check dates. Rather than repeat that comparison here, use it for the product evidence and use this page for the interfaces to test.

The adjacent capabilities each have their own evaluation and are frequently separate modules on a quote: energy isolation, risk assessment, job safety analysis, management of change and shift handover. Ask for each to be named individually in the proposal; a suite name does not establish that they are all included, or that they are integrated with one another rather than merely sold together.

Questions that separate candidates

Can a permit record which risk assessment and revision it derives from?

What happens to an open permit when its underlying assessment changes?

Can an isolation be removed while a dependent permit is open?

How are conflicting concurrent permits detected, and by what attribute?

Who is shown a conflict, and at which approval step?

What must an incoming issuer acknowledge at handover?

Is an unacknowledged live permit still valid?

What can a permit holder do on a disconnected device?

What does the control room see while a field device is offline?

Which of isolation, JSA, MOC and handover are in the quoted scope, named individually?

Sources and evaluation limits

4 sources

Permit definition and system requirements: Great Britain HSE: permit-to-work systems (COMAH technical measures); HSE HSG250: guidance on permit-to-work systems. Hazardous energy control and the US process safety programme requirements that sit around it: US OSHA: control of hazardous energy (lockout/tagout); US OSHA: process safety management of highly hazardous chemicals, 29 CFR 1910.119.

This page does not attribute specific incidents to specific causes. Major accident investigations identify multiple contributing factors and their findings belong to the investigating authorities, not to a software guide; naming disasters to introduce a product category implies a causal claim we have not established and could not support. If you want the findings, read the reports directly rather than a vendor's summary of them.

No product was tested hands-on and none is ranked here. The guidance cited is written for particular jurisdictions and industries — confirm what applies to your operation with the people accountable for it. Software does not discharge a duty; it holds the evidence that one was discharged.

Every researched product for this process (21)

Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

Every catalogue profile meeting the published process rule, checked against the vendor's own documentation on the date shown. Not a recommendation or a complete market map; confirm the module and workflow with the vendor.

Software categories to explore

Use this Process to define the work, then explore these software types. Confirm the exact workflow and module with each vendor.

Control of Work

See all software categories

Lockout/Tagout (LOTO): Paper to Digital Energy Isolation
Article on moving lockout/tagout from paper to digital.
DSEAR — definition, software & FAQs
Definition of the Dangerous Substances and Explosive Atmospheres Regulations.
Permit to Work Template (Hot Work + Confined Space)
Free template for a permit to work.

Frequently Asked Questions

What is the difference between control of work and permit to work?

A permit to work is a documented authorisation for specific work in a specific period, setting out precautions derived from a risk assessment. Control of work is the wider system that produces and surrounds it: task planning, the assessment itself, isolation, coordination of concurrent work, competence, handover, monitoring and audit. Buying a permit tool does not give you a control of work system, and the gaps are at the joins.

Do we need a dedicated control of work platform?

It depends on whether your failures are in the permit or between the permit and something else. If permits are issued correctly but isolations, assessments and concurrent work are tracked in separate places that nobody reconciles, integration is the thing you are buying. If the permit process itself is the problem, a permit tool may be sufficient and considerably cheaper. Establish which before scoping.

What should a demonstration prove?

Not that the software can issue a permit — all of them can. Prove the interfaces: that a permit traces to its assessment, that revising the assessment does something visible to an open permit, that an isolation cannot quietly be removed underneath a live permit, that conflicting nearby work surfaces to someone, and that a handover requires acknowledgement. Try to break each one deliberately.

How does offline working affect control of work?

It affects who knows what, and when. Establish specifically what a permit holder can do on a disconnected device, whether an authorisation can be granted offline, and what the control room sees in the meantime. A system where field status is invisible for hours is making a different trade-off from one where offline action is blocked, and both are defensible — but only if chosen deliberately.

Which standards apply?

That depends on your jurisdiction, industry and the hazards involved, and it is a judgement for the people accountable for your safety case rather than for a software guide. The HSE guidance cited here is written for the petroleum, chemical and allied industries in Great Britain; the OSHA references are US requirements. Confirm what governs your operation, then evaluate whether the platform can evidence it.