Who Can Issue a Permit to Work?

There is no certificate that makes someone a permit issuer. UK law does not name the role, no ticket qualifies you for it, and no register exists. The employer decides who may issue permits, and is accountable for that decision being sound.

What HSE guidance does provide is the standard to decide against: an issuer must have enough knowledge of the hazards on the specific plant to identify them and set the right controls, and their authority must have written limits. This guide covers the roles involved, who can hold each, and how to write authorisation rules that survive an audit.

This guide covers UK requirements and references HSE guidance. Legislation and standards may differ in other jurisdictions.

The short answer

A permit may be issued by a person the employer has assessed as competent for the specific hazards and plant involved, and formally authorised in writing to issue permits of that type. Competence here means demonstrable knowledge and the ability to apply it — not a qualification.

Two things follow, and both are commonly missed:

• Authorisation is per permit type and per area, not general. Someone competent to issue a cold work permit on a plant they know is not thereby competent to issue a confined space entry permit.
• The list must be written down. An authorisation that exists only as "everyone knows Dave signs the permits" cannot be audited, cannot be limited, and does not survive Dave leaving.

Where the duty comes from

No statute creates a "permit issuer." The duty sits one level up, on the employer.

Section 2(1) of the Health and Safety at Work etc. Act 1974 provides that "it shall be the duty of every employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all his employees," and section 2(2)(a) extends that to "the provision and maintenance of plant and systems of work that are, so far as is reasonably practicable, safe and without risks to health."

A permit-to-work system is a safe system of work. Appointing someone incompetent to run it is an employer failure, not an individual one — which is why the authorisation decision, and the evidence behind it, matters more than any certificate the individual might hold.

HSE's HSG250 lists among the essential features of a permit-to-work system "clear identification of who may authorise particular jobs (and any limits to their authority) and who is responsible for specifying the necessary precautions." Note both halves. Naming the issuer is half the requirement; bounding their authority is the other half, and it is the half most sites omit.

HSG250 is guidance rather than law — it states that "following the guidance is not compulsory and you are free to take other action. But if you do follow the guidance you will normally be doing enough to comply with the law." In practice, an inspector comparing your system against it is the situation to plan for.

The roles HSG250 names

HSG250 observes that role titles vary enormously between companies, and suggests common ones to reduce confusion — particularly for workers moving between sites. The set it proposes:

Role	What the person does
Originator	Requests the job. Wants the work done; does not authorise it
Issuing authority	Issues the permit to the performing authority. Also called responsible person, permit co-ordinator, permit issuer
Permit authoriser	Provides an extra level of authorisation where the hazard warrants it
Area authority	Co-ordinates and controls the issue and return of permits across an area; holds the overview
Performing authority	Accepts the permit on behalf of those doing the work
Permit user	Works under the terms of the permit
Isolating authority	Carries out and confirms isolations
Site checker	Verifies conditions at the work site

Crucially, HSG250 adds that these are roles, not headcount: "In some permit-to-work systems, a number of the roles listed in Table 1 may in fact be fulfilled by the same person, eg on a small site with few permits the same person may act as area authority, issuing authority and permit authoriser at the same time."

So a small contractor does not need eight people. It needs one competent person who understands that they are wearing several hats — and a written rule about which hat cannot be worn at the same time as another.

The one separation you should not collapse

The person doing the work must not be the person authorising it.

Everything else can reasonably combine on a small site. This one cannot, because the whole control depends on a second person independently checking conditions before work starts. A welder who issues their own hot work permit has produced a piece of paper, not a control. HSG250 describes the issuing authority's job as confirming that "the work site has been examined, and all precautions specified to be taken before work commences (including isolations) have in fact been taken and will remain effective while the permit remains in force" — a self-check cannot satisfy that.

Where a site genuinely has one person, the answer is not to collapse the roles. It is to bring the authoriser in from elsewhere: a visiting supervisor, the client's site manager, or a designated person from head office who attends. If nobody can attend, the honest conclusion is that the work should not proceed under a permit that afternoon.

What competence actually means here

HSG250 sets the standard in terms of capability rather than certification: "It is essential that people authorised to issue permits-to-work have sufficient knowledge about the hazards associated with the relevant plant, to allow them to identify those hazards and control measures (eg isolations) correctly."

That gives you a practical test. Before authorising someone to issue permits of a given type, satisfy yourself that they can:

• Name the specific hazards of that work on your plant, not generic ones
• Explain what isolation is required and how it is proved
• Recognise when a job needs a permit at all, and when it does not
• Identify when two permits interact, and what to do about it
• Describe what close-out requires and refuse to sign one that has not happened
• Say no to a job that cannot be made safe, including when a supervisor is pushing

The last one is a competence requirement, not a personality trait. An issuer without the standing to stop work is not functioning as a control. If the person you have in mind cannot refuse the site manager, authorise someone who can.

HSG250 also addresses drift: "If authorised people are relocated to former workstations, then refresher training should be given and recorded before they are reauthorised." Competence is plant-specific and it decays. Our permit to work training guide covers what each role needs to be taught and how to evidence it.

Contractors and subcontractors

A visiting contractor's supervisor will usually act as performing authority — accepting the permit — rather than issuing it. Issue normally stays with the site.

HSG250 places matching duties on the contractor's own management, who should "ensure that they understand the permit-to-work systems and other arrangements that apply to the particular locations at which they or their employees are to work," and "ensure that up-to-date records of trained performing authorities are kept."

That second one is worth asking for. If a subcontractor cannot tell you who among their people is trained to accept a permit, you do not yet have a working chain of acceptance. Our guide to the permit to work coordinator role covers how the oversight side of this works day to day.

Writing your authorisation rules

Six things to record, and it is a page, not a manual:

1. Named individuals, not job titles alone. "The duty supervisor" is not an authorisation.
2. Which permit types each may issue. Hot work, confined space, electrical isolation, height, excavation — listed explicitly, with anything absent meaning not authorised.
3. Which areas or plant each authorisation covers.
4. Any limits. Value, duration, whether a second authoriser is required for high-hazard work, times of day.
5. The evidence on which each authorisation was granted, and the date.
6. A review date, and the trigger events that force early review — plant changes, role changes, an incident, return after a long absence.

HSG250 puts the accountability for this squarely on the top of the organisation: the site occupier should ensure that "a senior manager is assigned responsibility to ensure an appropriate permit-to-work system is introduced." The authorisation list is that senior manager's document, not the issuer's.

Keep it with your permit register so that the two are audited together — a register showing permits issued by someone absent from the authorisation list is one of the faster ways to fail an audit. Our permit to work audit guide covers what else gets checked, and the PTW readiness checker scores your current system against the HSG250 essentials in a few minutes.

PermitPad is building a permit-to-work system where authorisation is enforced rather than assumed — issuers are named per permit type, and a permit cannot be issued by someone outside the list. Join the waitlist to see it when it launches.

Key references

• HSG250: Guidance on permit-to-work systems — HSE, first edition 2005. Paragraph 9 (essential features), paragraphs 29-30 (roles and their combination), paragraph 33 (employer duties), paragraphs 36-38 (responsibilities and competence). Guidance, not law
• Health and Safety at Work etc. Act 1974, section 2 — general duties of employers, including safe systems of work

Disclaimer

This guide is for general information only. Competence and authorisation requirements depend on the specific work, plant and sector involved. Always consult a competent H&S professional and the applicable legislation and sector guidance for your circumstances.