Skip to main content
    QHSEtech
    All templatesCompliance · 3 pages · Updated 21 October 2026

    Stop Work Authority Policy and Event Record Template

    PDF ExcelFree, no email

    Three-page Stop Work Authority policy and stop-work event record. Page 1 is a one-page policy to fill in, sign and post: scope, who may stop work (anyone, including contractors, agency workers and visitors), how to call a stop, what happens next, a no-retaliation commitment that covers a good-faith stop that turns out to be unnecessary, and who may authorise the restart and on what evidence. Pages 2 and 3 record one stop: who called it and how, the trigger and hazard, the immediate action, a finding about the condition, the decision to modify, resume or abandon, the restart with its basis and time, follow-up actions, feedback to the person who stopped the work, any report of pressure (by reference only) and sign-off. The Excel file is a running log of stops with a sheet of measures that are our own suggestions. The form sets no time limits and is not evidence that any law is met.

    What's inside

    Page 1: the policy

    1. Scope: all work on the named sites and everyone there (employees, contractors and their subcontractors, agency workers and visitors), with the statement that the policy narrows no legal right to refuse dangerous work
    2. Who may stop work: anyone, with no permission, role or certainty needed; anyone told to stop stops at once and asks afterwards
    3. How to call a stop: your words or signal, the radio channel or phone number, an app or form, and making the task safe only if that can be done safely
    4. What happens next: an orderly stop by the person in charge, a joint look at the condition at the place, the decision to modify, resume or abandon, the record, follow-up actions, feedback and the lesson, with boxes for the role that attends and the time limits your procedure sets
    5. No retaliation: covers a good-faith stop that turns out to be unnecessary, says stops are never counted against the person, crew or contractor who called them, and names the route for reporting pressure
    6. Who may authorise the restart, and on what evidence: the restart authority and a deputy, what they check and record before a restart, and where to escalate a stop that cannot be resolved
    7. Approval: the signature of the most senior manager for the sites, the next review date and where the policy is posted

    Page 2: the stop-work event record

    1. The stop: time, place, task, permit or work order reference, who called it (name for feedback only), their employer, whether they are an employee, contractor, subcontractor, agency worker or visitor, and how the stop was called
    2. Trigger and hazard: what made them stop, in their own words, the kind of hazard and who could have been harmed
    3. Immediate action: how the work was stopped and made safe, whether the permit was suspended, who took over, any injury or damage, and who was told
    4. Looking at the condition: who looked, and a finding about the condition (hazard confirmed, already controlled, no hazard found, not resolved yet) with the evidence
    5. Decision: modify the work, resume as planned or abandon and replan, what changes before the restart, and who decided

    Page 3: restart, actions, feedback and sign-off

    1. Restart: who authorised it, whether they hold restart authority under the policy, the date and time, the checks made and the basis of the decision
    2. Follow-up actions: action, owner, due, done and checked, whether the same hazard was stopped before, and any incident or near-miss reference
    3. Feedback and the lesson: whether the person who stopped the work was told what was found and done, by whom, when and how, whether they were thanked and are satisfied, and who the lesson was shared with
    4. Pressure or reprisal: whether any was reported, with a reference to the restricted route only
    5. Review and sign-off: reviewer's notes, four signatures, the date closed and where the record is kept

    The Excel file: a running log with one line per stop and a sheet of seven measures to read from it, six from our Stop Work Authority guide and one added for this template, each marked as our own suggestion. It has no formulas.

    The wording, the section titles and the tick options are ours, to change.

    What requires or shapes this record

    Stop work authority is required as such by only a few rules, and this template does not say that any law requires it. The clearest case is the US offshore rule for oil, gas and sulphur operations on the Outer Continental Shelf: 30 CFR 250.1930, part of the safety and environmental management systems (SEMS) rule of the Bureau of Safety and Environmental Enforcement, asks for stop work procedures, makes stopping work both a duty and a right of all personnel when imminent risk or danger exists, without fear of reprisal, and asks for the decision to resume to be put in writing. The legal right to refuse dangerous work is a different and narrower protection: in the US, 29 CFR 1977.12(b)(2) protects a good-faith refusal only in narrow conditions, among them that a reasonable person would judge the danger of death or serious injury to be real and that there is no time to use OSHA's normal enforcement route. Outside rules like the offshore one, a stop work programme is a voluntary practice built above that floor, and OSHA's recommended practices recommend one. The other rules that touch stopping work, in the US, Great Britain, the EU and ILO Convention No. 155, are set out in our Stop Work Authority programme guide and our stop work authority software guide, both linked below, so they are not repeated here. A signed policy or a completed record does not show that you meet any of them. This is general information, not legal advice.

    • 30 CFR 250.1930(a) to (e) and 250.1931(a) and (b) (US Bureau of Safety and Environmental Enforcement, SEMS rule; eCFR text up to date as of 19 October 2026, opened 21 October 2026)

      Applies to oil, gas and sulphur operations on the US Outer Continental Shelf. Section 250.1930(a) asks for stop work procedures that make it possible to stop work creating imminent risk or danger at once, and that give all personnel both the duty and the power to stop work, or to turn down an assigned task, when such a risk exists, without fear of reprisal. The rule defines that risk as anything in the workplace that could reasonably be expected to kill or seriously injure someone, or to cause significant harm to the environment. Paragraph (b) makes the person in charge of the work responsible for stopping it in an orderly and safe manner, and says that anyone told to stop must do so immediately. Under paragraph (c), the person on the facility who holds ultimate work authority decides when work may resume, on finding that the danger was never there or has gone, and the decision to resume is put in writing as soon as practicable. Paragraph (d) asks for the stop work procedures and expectations to be written into every job safety analysis as standard wording, and paragraph (e) for training on them when new personnel are oriented and a review whenever a meeting focuses on safety. Section 250.1931(a) and (b) (https://www.ecfr.gov/current/title-30/chapter-II/subchapter-B/part-250/subpart-S/section-250.1931) asks the programme to identify who holds ultimate work authority and to make sure everyone knows who holds it, including when it passes to someone else. Policy sections 2, 4 and 6 and record section 6 are modelled on these paragraphs, in our own words. The policy's threshold is lower than the rule's (a belief that work is unsafe), and an offshore operator must check its own procedures against the rule itself.

    • 29 CFR 1977.12(b)(1) and (b)(2) (US OSHA; eCFR text up to date as of 19 October 2026, opened 21 October 2026)

      Paragraph (b)(1) says that the Occupational Safety and Health Act does not, as a general rule, entitle employees to leave the job over conditions that might be unsafe, and that an employer would not ordinarily breach section 11(c) by disciplining an employee who refuses normal work over alleged hazards. Paragraph (b)(2) protects a narrower case: an employee who has no reasonable alternative and, in good faith, refuses to face a dangerous condition, where a reasonable person in that position would judge the danger of death or serious injury to be real, the urgency leaves no time to deal with it through OSHA's normal enforcement route and, where that was possible, the employee first asked the employer to fix the condition and did not get it fixed. That is the floor that OSHA's rule on section 11(c) sets, judged after the event. The policy on this template sits above it: it asks for no proof of danger and protects a stop that finds nothing, which is why its scope section says it narrows no legal right.

    • OSHA, Recommended Practices for Safety and Health Programs: Worker Participation, action items 2 and 5 (page opened 21 October 2026)

      These are recommended practices, not a standard. The page says that every worker at a worksite should take part in the safety and health programme, including people employed by contractors, subcontractors and temporary staffing agencies. Under action item 2 it recommends giving every worker the power to start, or to ask for, a temporary suspension or shutdown of any activity or operation they believe is unsafe, responding promptly to reports, reporting back to workers routinely and frequently on the action taken, and making clear that no worker will face retaliation for raising a concern. Under action item 5 it warns that participation is suppressed when investigations focus on blaming individuals rather than the conditions behind an incident, or when reporting could cost someone an incentive-based prize, reward or bonus, and says other policies should not discourage participation. The policy's who-may-stop, no-retaliation and feedback sections, the record's finding about the condition rather than the person, and the rule against counting stops against the person, crew or contractor who called them follow these points in our own words. Visitors are our own addition to the list of who may stop.

    Each source checked on 21 October 2026. Not legal advice; check the text in force for your site.

    Field by field

    Page 1 is a policy, not a form: the boxes are for your own names, roles, channels and time limits, and the wording is ours to adapt. Pages 2 and 3 record one stop, from the call to the feedback. The tick options, the hazard list and the section titles are ours: change them to fit your site, and keep them the same from one record to the next so that stops can be compared. The record asks about the condition, never about whether the person who stopped the work was right. The form sets no time limit or threshold; where a box asks for one, your own procedure supplies it.

    Who may stop work
    Why: The authority only works if nobody has to check first whether they are allowed to use it. OSHA's recommended practices name workers of contractors, subcontractors and staffing agencies among those who should take part in a safety programme, and this policy adds visitors. It also says that anyone told to stop does so at once, as the offshore SEMS rule requires of people told to stop, and asks why afterwards.
    Common mistake: Limiting the authority to employees, supervisors or named competent persons, so the contractor or visitor who sees the danger first waits for someone else.
    Words or signal to call a stop
    Why: One phrase or signal that every person on site recognises, including people who do not share a language, plus a radio channel or phone number for when the crew cannot be reached, makes a stop quick to call. The policy asks people to make the task safe only if they can do so without putting themselves at risk.
    Common mistake: Asking the person to fill in a form or find a manager before the work actually stops.
    What happens next
    Why: A fixed sequence keeps a stop from turning into an argument at the task: an orderly stop by the person in charge, a joint look at the condition at the place, a decision, the record, actions and feedback. The boxes for the role that attends and the time limits are blank because your own procedure sets them; the limits in our Stop Work Authority guide are our own examples, not a rule.
    Common mistake: Leaving the roles and time limits unnamed, so nobody owns the next step.
    No retaliation
    Why: The offshore SEMS rule grants the authority without fear of reprisal, and OSHA's recommended practices warn that blame-focused investigations and incentive prizes suppress reporting. The policy says plainly that a stop that turns out to be unnecessary is a normal outcome, because the offshore rule's restart wording itself covers danger that does not exist, and it names a route for reporting pressure outside the line of the person concerned.
    Common mistake: Promising no retaliation in the policy while the record or a bonus scheme grades stops as justified or unjustified.
    Restart authority (role)
    Why: Offshore, the person holding ultimate work authority on the facility decides when work resumes, and only once the danger is found to be absent or gone; the decision is put in writing, and everyone must know who holds that authority, including when it changes hands. Elsewhere your own procedure names the role. The policy lists what that person checks before a restart, and names a deputy and an escalation route.
    Common mistake: Letting the supervisor who wants the job back restart it alone, with no record of who decided or why.
    Signed by (the most senior manager for these sites)
    Why: A signature from the top tells supervisors that the policy outranks the schedule. The next review date and the record of where the policy is posted show that it is kept current and that people can see it.
    Common mistake: Signing it once and filing it in a manual that contractors and visitors never see.
    Who called the stop
    Why: Role, employer and whether the person is an employee, contractor, subcontractor, agency worker or visitor show whether everyone on site actually uses the authority. The name is asked for only so that the feedback reaches the right person.
    Common mistake: Reporting stops by named person, or leaving the employer blank so that contractor stops cannot be counted.
    What made them stop the work, in their own words
    Why: The concern as the person saw it is the starting point of the record, and it is the part most easily lost when a reviewer rewrites it. The kind of hazard is ticked separately so that stops can be grouped later.
    Common mistake: Writing the reviewer's conclusion, such as "no issue", in place of what the person saw.
    Permit suspended?
    Why: A stop on permitted work should leave the permit unusable until the restart, so that another crew or shift cannot pick the job up from the permit board. Section 3 also asks who took over, whether anyone was hurt and who was told, with times.
    Common mistake: Stopping the work but leaving the permit live.
    Finding about the condition (not about the person)
    Why: Hazard confirmed, already controlled, no hazard found and not resolved yet are equal outcomes. The offshore rule's restart wording allows for a danger that was never there, not only one that has been removed, so a stop that finds nothing is part of how the authority is meant to work.
    Common mistake: A "justified? yes or no" box, which grades the person who stopped the work.
    Decision
    Why: Modify, resume as planned and abandon lead to different next steps: a change to put in place, nothing to change, or a new plan. The record asks what changes before the restart, or why nothing needs to, and who decided.
    Common mistake: Ticking resume as planned when controls were in fact changed, so the change is never recorded or checked.
    Restart authorised by
    Why: The name, the role, whether that person holds restart authority under the policy, the time, the checks made and the basis together make up the written restart decision. The restart time also gives the stop-to-restart figure for the log.
    Common mistake: Closing the record without the restart time and basis, so nobody can show who decided.
    Follow-up actions
    Why: An owner, a due date, a done date and a check keep the change from fading once the work has restarted. The question whether the same hazard was stopped before shows when earlier changes did not hold.
    Common mistake: Closing the record when the work restarts, with actions still open and unowned.
    Feedback to the person who stopped the work
    Why: OSHA's recommended practices say to report back to workers routinely on the action taken in response to their concerns. The record asks whether the person was told what was found and done, by whom, when and how, whether they were thanked and whether they are still concerned.
    Common mistake: Giving feedback only when a hazard was confirmed, so people whose stops found nothing never hear back.
    Pressure or reprisal
    Why: A report of pressure after a stop needs a route outside the line of the person concerned, with few readers. The record holds only a reference, so the event record can be shared for learning without exposing the report.
    Common mistake: Writing allegations into a record that the whole site can read.
    Where this record is kept, who may read it, and for how long
    Why: Offshore, the SEMS rule has record-keeping requirements of its own, which our stop work authority software guide sets out; elsewhere your own policy decides. The record names the person who stopped the work, so limit who can read it.
    Common mistake: No retention period, or records that name people kept in an open shared folder.

    Worked example

    IllustrativeFour invented stops at an invented water treatment works during a pump replacement project, as they would appear in the stop log. The site manager is the restart authority and the shift supervisor the deputy (invented site, people, references and times).

    Ref and time stoppedWho stopped, and howTrigger and hazardImmediate actionFindingDecision and what changedRestart (who, when)Follow-up actionsFeedback and lesson
    SW-031, Tuesday 09:55, pump house: lifting a pump motor outContractor fitter (mechanical contractor), by calling "stop" to the crane operatorThe crane's rear outrigger pad stood on a drain cover that could give way under the loadLoad landed at 09:57; lifting permit suspended; supervisor and site manager told at 09:58Hazard confirmedModify: outrigger moved onto spreader mats on solid ground; lift plan redrawn with the drain covers markedSite manager (restart authority), Tuesday 10:50, after checking the mats and briefing the crew on the new planAdd buried services and drain covers to the lift plan checklist (lifting coordinator, Friday)Fitter told the finding and thanked at the restart briefing; lesson given at Thursday's contractor briefing
    SW-032, Wednesday 14:20, control room: cable terminations in a motor control panelApprentice electrician (employee), by calling "stop" to the electrician leading the jobNot sure that the voltage tester had been proved before the dead testWork held with the panel still isolated and locked off; site manager told at 14:22No hazard found: the isolation record showed the tester proved before and after the testResume as planned: nothing to changeSite manager (restart authority), Wednesday 14:40, after reading the isolation record with the electrician and the apprenticeNoneApprentice thanked on the spot and shown the isolation record; recorded as a normal outcome
    SW-033, Thursday 07:40, chemical dosing room: floor cleaningAgency cleaner, by phone to the shift operatorA smell of chlorine near the dosing pumpsCleaner left the room; the operator kept others out, started the extraction fan and told the shift supervisor at 07:43Hazard confirmed: a weeping joint on a dosing lineAbandon: cleaning cancelled for the day; joint repaired under a permit; cleaning replanned for FridayShift supervisor (deputy restart authority, site manager off site), Friday 07:30, for the replanned cleaning, after the repair permit was closed and the room checked with a gas detectorInspect the other dosing joints (maintenance planner, Monday); add a smell check to the cleaning instruction (facilities lead, two weeks)Cleaner told by the shift supervisor on Friday, with the agency; lesson shared with operators and the cleaning contractor
    SW-034, Friday 11:05, site yard: tipper lorry reversing to the spoil heapVisitor (client engineer on a site walk), by raising a hand and calling to the driverLorry reversing toward two surveyors taking levels, with no banksman (signaller)Lorry stopped; surveyors moved clear; site supervisor and site manager told at 11:07Hazard confirmedModify: banksman assigned and the survey area coned offSite manager (restart authority), Friday 11:20Mark a pedestrian route round the spoil heap (site supervisor, Monday)Engineer thanked by the site manager the same day; lesson in Monday's toolbox talk. Same hazard stopped before: SW-027

    Everything here is invented to show the method. Stop SW-032 found nothing wrong and is recorded and thanked like the others, as the policy asks. No time limits are shown for the record or the feedback because those come from your own procedure.

    When a spreadsheet stops being enough

    Paper and a spreadsheet work while stops are few and one person reads every record. They stop working when a stop has to reach the person in charge on another part of the site within minutes, when an open stop needs to show against the permit it halted so that nobody restarts the job from the permit board, when restart authority passes to a deputy at a shift change, and when feedback to the person who stopped the work falls due and nobody is reminded.

    A software record can let a contractor or visitor raise a stop from a phone, notify the roles your policy names, suspend the linked permit, require a named restart decision with its time and basis before the record or the permit can be closed, remind the reviewer that feedback is due, and report stops by site, shift and contractor rather than by person. Ask whether a stop has its own record type, and what prevents anyone other than the restart authority from closing it. Our stop work authority software guide explains why it lists no products. The list below applies the rule used by the near-miss reporting software guide. Nothing in the list shows that any product keeps a stop-work record, so test each one with a stop of your own.

    Same rule for every product: tagged “Incident Management”, “Incident Reporting” or “Near Miss Reporting”, with a sourced near-miss reporting capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 21 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.