Moving From Paper Permits to Digital

The failure mode when a site moves permits from paper to digital is rarely the software. It is that the switch happens before anyone writes down what the permit rules actually are — so an undefined system gets encoded, and the ambiguities that a human issuer used to resolve on the spot become defaults nobody chose.

This is a staged plan that puts the rule-writing first. It assumes you have already decided to switch; if you are still weighing it, our comparison of permit to work books versus a digital system covers where paper still wins.

This guide covers UK practice and references HSE guidance. Legislation and standards may differ in other jurisdictions.

Stage 0 — write the rules down first

Before evaluating anything, produce four documents. If they already exist, this stage takes an afternoon. If they do not, this is the real work of the migration, and it is owed whether or not you ever buy software.

Which work needs a permit. A specific list for your site, not a generic one. The boundary cases are what matter: does changing a light fitting at 3m need a height permit? Does draining a pump need a cold work permit? Every ambiguity you leave is one the software will resolve for you, silently.

Who may issue what. Named individuals, permit types, areas, and limits. HSE's HSG250 lists among the essentials "clear identification of who may authorise particular jobs (and any limits to their authority)." Our guide to who can issue a permit to work covers how to write this.

What each permit type must record. Against the thirteen elements in HSG250's Figure 1 — see what every permit form must record.

Your close-out rule. What must be true before a permit closes, and what happens to permits at end of shift.

That fourth one is where most migrations quietly go wrong. On paper, an unfinished job at 18:00 is resolved by a conversation. In a system, it is resolved by whatever the configuration does by default — and if nobody chose, the default may well be "permit stays open." Decide it deliberately.

Stage 1 — fix the system on paper

Run the corrected rules on paper for a month.

This feels like a delay and it is the single highest-return step. It separates "our permit process has problems" from "our software has problems," which is impossible to untangle once both change at the same time. If close-outs are being missed now, they will be missed digitally, and you will blame the tool.

Measure three things during that month, because they are your baseline:

• Permits issued
• Permits closed out properly
• Time from request to permit in hand

Without the baseline you cannot tell afterwards whether the switch helped. Most sites do the migration and then have no way to answer whether it was worth it.

Our free permit cost calculator turns your permit volume and admin time into a cost for the current system, which is the number the business case is actually made against — and the one you re-run in Stage 6 to see whether it moved. Close-out rate matters just as much, but the calculator doesn't model it, so track that one directly against the baseline above.

Stage 2 — evaluate against HSE's conditions, not a feature list

HSG250 sets six conditions that operators "must be sure" of before introducing an electronic permit system. They make a better scorecard than any vendor comparison because they were written by the regulator rather than the market:

• a suitable system (for example password-protected electronic signatures) is in place to prevent unauthorised issue or acceptance
• permits cannot be issued remotely without a site visit
• systems are in place to prevent permits already issued from being altered without the alterations being communicated to all concerned
• the facility exists for paper permits to be produced for display at the job site
• training is provided to ensure that operators assess the specific job and do not rely on "cutting and pasting" existing sections from other permits
• suitable back-up systems are available in the event of a software failure or power outage

Two of these are commercially awkward, which is why they are the ones to press on.

Remote issue. Being able to authorise from anywhere is a headline feature and a direct conflict with this guidance. Ask how the system discourages issuing without attending. If the honest answer is "it doesn't," you are buying a convenience that HSE guidance specifically warns against, and you will need a compensating rule of your own.

Cut and paste. Templating is the main efficiency gain on offer and the main route to degraded permits. A system that pre-populates last week's hazards has automated rubber-stamping. Ask what it does to force a fresh hazard assessment per job.

Add two practical conditions of your own:

• Offline. Where are permits actually issued? Tank interiors, basements, plant rooms and rural sites do not have signal. A system that assumes connectivity fails where permits matter most.
• Export. Can you get completed permits out, readable, without paying? These are records you may need years after you stop being a customer.

Stage 3 — decide what happens to historic permits

Three options, and the default choice is usually right:

• Leave them. Historic paper stays in the archive; the new system starts from a date. Simplest, and almost always correct.
• Scan the recent window. The last twelve months, indexed by date and permit number, so retrieval is fast for the period most likely to be requested.
• Re-key everything. Effectively never worth it. Historic permits are read a handful of times; re-keying is weeks of work for retrieval speed on records nobody requests.

Whichever you choose, keep the paper. HSG250 says permits "should be retained at site by the issuing authority for at least 30 days after completion, and then archived for a specified period to enable an effective monitoring and audit process" — scanning does not license destroying the originals, and your retention obligations are unchanged by the format switch.

Record the cut-over date explicitly. For any investigation spanning it, someone needs to know which system holds which period. Write it on the front of the archive box.

Stage 4 — run in parallel, briefly

Two to four weeks, one permit type, one area, one or two issuers.

Pick the highest-volume routine permit type, not the highest-risk one. You are testing the workflow, and hot work or confined space entry during a pilot means the riskiest job on site is also the one running on an unfamiliar process.

During parallel running, both systems are live. That is deliberately uncomfortable and it should not last: a long parallel period means people pick whichever is easier, and the record splits across both. Set the end date at the start.

What you are watching for is not whether the software works. It is:

• Does the register match reality when you walk the site?
• Are issuers going to the job, or authorising from the office because it is now easy?
• Is anyone accepting pre-filled hazards without reading them?
• What happens at 18:00 on an unfinished job?

Stage 5 — cut over, and keep the pad

On cut-over, three things need to be true: everyone who issues or accepts has been trained, the authorisation list is loaded and correct, and the back-up is real.

The back-up is a blank pad of paper permits and a written rule for when to use it. HSG250 requires "suitable back-up systems … in the event of a software failure or power outage," and this is the cheapest form of it. The rule should say who decides to fall back, and how those permits get into the register afterwards.

Train issuers and authorisers separately from general users. Their failure modes are different — a permit user who is confused asks; an issuer who is confused signs. Our permit to work training guide covers what each role needs.

Stage 6 — check it after a month

Compare against the Stage 1 baseline:

• Close-out rate. Should be up, and should now be a number you can read rather than estimate.
• Time from request to permit. Usually down, and the number to quote internally.
• Permits issued. If this jumped sharply, ask whether the work changed or whether permits are being issued for jobs that never warranted one. Over-permitting is a real failure mode: it dilutes attention and makes the important permits ordinary.
• Remote issue. If the system records it, check it. This is the drift that starts immediately and is invisible on paper.

Then fold the system into your normal review. HSG250 recommends that the permit-to-work system "should be audited regularly, by competent people, preferably external to the site or installation," with system reviews "undertaken at least every three years." The permit to work audit guide covers what that audit looks at, and the permit to work register guide covers keeping the register honest once it maintains itself.

The short version

1. Write the rules down before you shop.
2. Run the corrected rules on paper for a month, and measure.
3. Score options against HSG250's six conditions plus offline and export.
4. Leave historic permits alone; record the cut-over date.
5. Pilot the highest-volume routine permit type, with an end date.
6. Keep a pad of paper permits as the back-up the guidance asks for.
7. Re-measure after a month against the baseline.

PermitPad is building a permit-to-work system for small and mid-sized UK contractors, designed around the HSG250 conditions above — including offline issue, free export of completed permits, and a close-out that cannot be skipped. Join the waitlist to see it when it launches.

Key references

• HSG250: Guidance on permit-to-work systems — HSE, first edition 2005. Paragraph 9 (essential features), paragraph 51 (conditions for electronic permit systems), paragraph 58 (retention), paragraphs 61 and 63 (audit and review). Guidance, not law
• Health and Safety at Work etc. Act 1974, section 2 — the duty to provide and maintain safe systems of work

Disclaimer

This guide is for general information only. How a permit-to-work system should be structured, and what a migration involves, depends on your specific work activities, site conditions and sector. Always consult a competent H&S professional and the applicable legislation and sector guidance for your circumstances.