What Risk Controls Should Be Mandatory on a High-Risk Work Order?

A high-risk work order is a maintenance job where one missed control can kill, seriously injure, or start a major fire. Every high-risk work order should carry seven mandatory risk controls before anyone picks up a tool. They are a task risk assessment, a signed permit, verified isolation, competent people, environment checks, supervised execution, and a verified close-out.

Most facilities record these controls on separate paper forms. That is where gaps appear. A Computerized Maintenance Management System keeps the controls inside the work order itself, so the job cannot move forward until each one is confirmed.

Key Takeaways

• Seven controls, no exceptions: A high-risk work order needs a risk assessment, permit, isolation, competent crew, environment checks, supervised execution, and verified close-out.
• Enforce, don’t list: A checkbox that anyone can skip is not a control.
• Eliminate before you protect: The hierarchy of controls puts elimination and substitution ahead of PPE.
• One record: Linking the permit, isolation, and sign-offs to the work order gives you a single audit trail.

What Counts as a High-Risk Work Order?

A work order is high-risk when the task can cause death, permanent injury, fire, explosion, or a major release if a control fails. Maintenance teams flag these jobs by hazard type, not by cost or priority code.

• Stored or live energy: Electrical, hydraulic, pneumatic, and spring-loaded systems.
• Confined spaces: Tanks, vessels, pits, and ducts with limited exit or poor air.
• Hot work: Welding, cutting, brazing, and grinding near flammable material.
• Work at height: Roofs, scaffolds, and any task with a fall risk.
• Pressurized systems: Steam, gas, chemicals, and process lines.

Controls follow the hierarchy of controls: eliminate the hazard, substitute it, engineer it out, apply administrative controls, and use PPE last. ISO 45001 requires organizations to apply this order. Many teams jump straight to PPE and skip the strongest protections.

A job earns the high-risk label from its hazard, not from its priority.

The Seven-Lock Control Method for Every High-Risk Work Order

The Seven-Lock Control Method is a fixed sequence of seven controls that a high-risk work order must pass before work starts. Skip one lock and the chain breaks.

The Seven-Lock Control Method:

• Assess (Lock 1): Record the task risk assessment.
• Authorize (Lock 2): Issue a signed, time-limited permit.
• Isolate (Lock 3): Lock out energy and prove it is dead.
• Qualify (Lock 4): Check valid training for every role.
• Protect (Lock 5): Test the air and plan for fire and rescue.
• Supervise (Lock 6): Keep stop-work authority and clean handovers.
• Close (Lock 7): Cancel the permit and keep the evidence.

To see how your current permits measure up, run them against the safety compliance checklist.

1. Task Risk Assessment Linked to the Work Order

A task risk assessment is the first mandatory control because it decides every other control on the job. The assessor lists hazards, rates severity and likelihood, and applies the hierarchy of controls before approval.

• Scope: Define the exact task, location, tools, and crew.
• Hazards: Name energy sources, atmospheres, heights, and neighboring work.
• Residual risk: Record what risk remains and who accepts it.

The assessment belongs on the work order, so the crew reads it at the job site, not in a filing cabinet. No assessment on the work order means no approval.

2. Signed Permit to Work From an Authorized Person

A permit to work is a written authorization that defines what work is allowed, where, when, and under which controls. The UK HSE’s HSG250 guidance treats it as a formal system. It states the work to be done and the precautions to take. It is more than a form to sign.

• Time limit: The permit expires at the end of the shift or task.
• Single scope: One permit covers one job, one location, and one crew.
• Separate roles: The issuer and the performer never sign as the same person.

Dedicated permit-to-work software routes approvals to mobile devices and ties each permit to its work order. A permit without an expiry time is an open invitation to skip checks.

3. Verified Energy Isolation

Lockout/tagout is a procedure that isolates hazardous energy and locks it off before anyone services equipment. OSHA estimates that complying with its control of hazardous energy standard prevents about 120 fatalities and 50,000 injuries each year.

• Isolate and lock: Shut off every source and apply a personal lock and tag.
• Release stored energy: Bleed pressure, discharge capacitors, and block moving parts.
• Test before touch: Try to start the equipment and confirm zero energy.

A common mistake is locking out but never testing. Teams that follow lockout/tagout properly require a recorded test result before the job can proceed.

4. Competent and Verified People

Only trained, authorized workers should be assigned to a high-risk work order, and their certificates must be valid on the day. Hot work, confined space entry, electrical work, and work at height each need specific training.

• Valid certification: Check expiry dates at assignment, not at the annual audit.
• Named roles: Identify the entrant, attendant, fire watch, and supervisor.
• Contractors: Hold outside crews to the same induction and permit rules.

Role-based access and expiry reminders in a CMMS can stop a lapsed certificate from reaching the job. Competence counts as a control only when the system checks it.

5. Environment, Fire, and Rescue Controls

Atmosphere testing, fire protection, and a rescue plan must be in place before entry or ignition. They cannot wait until something goes wrong. OSHA’s confined space rules require atmospheric testing and rescue arrangements before permit-required entry.

• Gas testing: Record readings and the tester’s name, and retest after any break.
• Fire protection: Clear combustibles, place extinguishers, and post a fire watch.
• Rescue plan: Confirm the rescue method and contact before anyone enters.

Many confined-space deaths are would-be rescuers, which is why the rescue plan sits on the permit.

6. Supervised Execution With Stop-Work Authority

Stop-work authority is the right and duty of every worker to halt a job they believe is unsafe. A supervisor must also re-approve the permit whenever scope, weather, crew, or conditions change.

• Change triggers: Any change in scope, crew, or conditions pauses the job.
• Communication: Test radios or phones before work and check in on a set schedule.
• Handover: The incoming shift reads the live permit status before taking over.

The 1988 Piper Alpha disaster, which killed 167 men, shows the cost of failure. The Cullen inquiry found weaknesses in the permit system and shift handover. The night crew did not know a safety valve had been removed from a pump they started.

7. Verified Close-Out and Audit Trail

A high-risk work order closes only after the permit is cancelled, isolations are removed in order, and the area is handed back safe and clean. The closing signatures prove who confirmed what, and when.

• Permit cancellation: Issuer and performer both sign off.
• Isolation removal: Each person removes their own lock, then the supervisor confirms the area is clear.
• Evidence: Photos, readings, and signatures stay attached to the work order.

Auditors, insurers, and investigators ask for the timestamped record first. A control with no record is hard to defend.

Common Mistakes That Defeat Mandatory Controls

Most high-risk incidents trace back to a control that existed on paper but failed in practice. Maintenance teams see the same five mistakes again and again.

• After-the-fact permits: The crew starts first and the supervisor signs later.
• Self-approval: One person issues the permit and performs the work.
• Untested isolation: The lock is on, but nobody tries to start the machine.
• Scope creep: The crew adds an extra task under the original permit.
• Permit reuse: An old permit is copied for a new job.

Each mistake disappears when the system, not memory, enforces the order of steps.

Risk Control Matrix by Hazard Type

This matrix shows which controls apply to each hazard, who verifies them, and what evidence the work order should hold.

Adapt the limits and roles to your site rules and local regulations.

Challenge and Fix: Enforcing Controls on a High-Risk Work Order

This scenario is illustrative, not a named customer case. A three-shift manufacturing plant issued hot work and isolation permits on paper, separate from its maintenance system.

The challenge: paper permits kept apart from work orders

• Late paperwork: Supervisors sometimes signed permits after the crew had started.
• Lost context: Night shift could not see which isolations day shift had applied.
• Weak evidence: Auditors found signatures but no times, readings, or isolation records.

How Cryotos solves it inside the work order

With Cryotos work order management, each high-risk job can carry its risk assessment, permit, and checklist as required steps.

• Required steps: Configure the workflow so the job cannot advance until each control step is signed.
• Mobile approvals: Authorizers approve from their phones with timestamps.
• Live status: Incoming shifts see open permits and isolations on the work order.
• Audit trail: Signatures, readings, and photos stay on one record.

Supervisors can no longer sign after the fact, because every approval carries its own timestamp. Safety managers pull permit and sign-off records from reports instead of searching clipboards before an audit.

Maintenance teams using Cryotos have reported up to 30% reduction in unplanned downtime and 25% faster repair turnaround, gains that come from the same disciplined work order flow.

Frequently Asked Questions

What are the minimum risk controls required on a high-risk work order?

At minimum, a high-risk work order needs a task risk assessment, a signed permit, verified isolation, competent people, environment and rescue checks, supervised execution, and a verified close-out. Local law may add requirements, so check OSHA, the HSE, or your regional regulator.

Who should approve a high-risk work order?

A trained authorized person who is independent of the crew doing the work should approve it. Many sites add a second signature from the area owner for hazardous locations.

Is a permit to work the same as a work order?

No. A work order tells the team which job to do, while a permit to work authorizes it to start under specific controls. Linking the two keeps one record for the whole job.

How often should controls on a high-risk work order be reviewed?

Review them at every shift change and whenever scope, conditions, or crew change. Many permits expire after one shift, which forces that review.

Do low-risk work orders need the same controls?

No. Match the controls to the hazard. Low-risk jobs follow standard safe-work steps, and applying a full permit to every job creates permit fatigue, which teaches people to ignore the process.

Mandatory controls protect people only when the system enforces them. Schedule a free demo to see how Cryotos keeps every control inside the work order.