Permit to work

A permit to work is one of the most familiar documents on an Australian worksite, and one of the most misunderstood. Many organisations treat the signed permit as the safety control itself. In practice it is an authorisation and a record, and its legal value depends on the system and the discipline behind it’s implementation. The distance between holding a permit and holding a defensible one is where most compliance exposure sits.

This article sets out what a permit to work is for, the common types and their purposes, where the legal obligations actually come from, and the nuances that separate a compliant permit system from a paper exercise.

Key points

• Only the confined space entry permit is required by the Australian WHS Regulations. Other permits are recommended controls that help discharge the broader duty to manage risk.
• A permit authorises high-risk or non-routine work once hazards have been assessed and controls verified.
• Permit controls must come from the risk assessment, and high risk work requires verified, recorded competency.
• Records must be contemporaneous and attributed, and kept for the period set by the relevant regulation.
• Requirements differ by jurisdiction. Victoria’s scheme differs in substance from the harmonised states.

Last updated 19 June 2026. About 12 minutes to read.

In this article

• What a permit to work is and what it does
• Are permits to work legally required?
• Types of permit to work and their purposes
• A permit is an administrative control
• Permit controls must come from the risk assessment
• Competency and authorisation obligations
• Keeping permit records that withstand scrutiny
• Permit requirements differ by jurisdiction
• Closing out a permit correctly
• What makes a permit to work system effective
• Permit obligations in summary
• How Safetysure can help
• Frequently asked questions

What a permit to work is and what it does

A permit to work is a formal, documented authorisation that high-risk or non-routine work may proceed. A competent person issues it only after the hazards have been assessed and the relevant controls confirmed as being in place.

The instrument does several jobs at once. It forces a deliberate check before work starts. It defines the scope, location, personnel, and time window of the work, and confines the work to what has been authorised. It coordinates the people who might be affected, including other trades and contractors. It records who authorised the work and on what basis. At the end it closes the loop, confirming the work is complete, all personnel have withdrawn, and the area has been left safe.

Understood this way, a permit is a coordination and accountability device for work that still carries risk after stronger controls have been applied.

Are permits to work legally required?

The most common misunderstanding concerns the legal status of permits. Under the harmonised Work Health and Safety Regulations, only one activity carries a mandated permit. A person conducting a business or undertaking (PCBU) must not direct a worker to enter a confined space without first issuing a confined space entry permit (regulation 67, Work Health and Safety Regulation 2011 (Qld), mirrored across the harmonised jurisdictions). For hot work, work at heights, excavation, and isolation, no regulation compels a permit.

That absence is frequently misread as meaning permits are optional. The better reading is that permits become the means by which a business discharges duties that are mandatory. The primary duty of care requires a PCBU to ensure health and safety so far as is reasonably practicable (section 19, Work Health and Safety Act 2011 (Qld)). The duty to manage risks requires elimination where reasonably practicable, and minimisation where not (section 17). Where a permit is a reasonably practicable control for a high-risk task, the failure to use one can itself amount to a breach.

Codes of practice reinforce the point. An approved code is admissible in proceedings, and a court may rely on it to determine what was reasonably practicable in the circumstances (section 275). For hot work, the model Welding Processes Code of Practice points to AS 1674.1 for hot work permit guidance. Although no regulation compels it, a permit is plainly expected in practice.

Types of permit to work and their purposes

The workflow is similar across permit types. Each one exists to control a particular hazard. The most common types used in Australian workplaces are set out below. Only the confined space entry permit is required by regulation. The remainder are recommended controls that help a business meet the duty to manage risk.

Other permits appear in particular industries, including those for demolition, asbestos removal (paired with a regulator notification), restricted lifting operations, and radiation work. A single job often requires more than one permit at once, for example confined space, hot work, and isolation together on the same task.

Free resource: Download a permit to work template to adapt for your own site and permit types.

A permit is an administrative control

A permit sits low in the hierarchy of control. Regulation 36 ranks control measures, and administrative controls, the category a permit falls into, rank second from the bottom, above only personal protective equipment. Safe Work Australia is explicit that administrative controls do not remove the hazard at its source and depend on human behaviour and supervision.

The practical consequence matters. A permit cannot stand in for higher-order controls such as elimination, substitution, isolation, or engineering. A frequent failure is to treat the signed permit as the safeguard, when its proper function is to manage the residual risk that remains once stronger controls are in place. A permit system asked to carry more safety weight than an administrative control can bear is a system already exposed.

Permit controls must come from the risk assessment

A permit is only as sound as the risk assessment beneath it. The law fixes this relationship for confined spaces. A risk assessment must be conducted by a competent person and recorded in writing (regulation 66), and the control measures stated in the permit must be based on that assessment (regulation 67(3)).

The principle extends well beyond confined spaces. Where permit controls are generated independently of the risk assessment, the two can drift apart over time. A permit whose controls do not match its own risk assessment is difficult to defend, and the gap is exactly what an investigator looks for. The risk assessment should remain the system of record, with the permit drawing its controls from it rather than restating them from memory.

Competency and authorisation obligations

Who does the work, and who authorises it, attracts specific duties. For high risk work, a worker must hold the relevant high risk work licence (regulation 81), subject to limited training exceptions undertaken under supervision (regulation 82).

The duty does not stop at the worker. A PCBU must not direct or allow high risk work unless it has seen written evidence that the worker holds the relevant licence, and it must keep a record of that evidence for at least one year (regulation 85). For confined spaces, both the risk assessment and the permit must be completed by a competent person (regulations 66 and 67). Separation of duties belongs to the same discipline: as a matter of good practice, the person raising a permit, the person issuing it, and the person supervising the work should be three different people, so that no one approves their own work.

Competency is therefore an evidenced verification, carried out and recorded before work begins, rather than a box ticked once.

Keeping permit records that withstand scrutiny

Permits often resurface long after the work, in an investigation, a regulator’s inquiry, or a coronial process. Their value as evidence depends on how the information was captured at the time.

A gas reading illustrates the standard. A defensible record states more than the fact that the atmosphere was tested. It captures the instrument used, confirmation that the instrument was calibrated and bump-tested, the actual readings against the relevant thresholds, the time the readings were taken, and the identity of the person who took them. The confined space atmosphere requirements are specific. Oxygen must sit within a safe range, and where the level falls below 19.5 per cent by volume, air-supplied respiratory equipment becomes mandatory (regulation 71).

Records should be contemporaneous, attributed, and resistant to later alteration. Retention obligations vary by record type:

A permit that cannot show what was checked, by whom, and when offers little protection on the day it is needed most.

Permit requirements differ by jurisdiction

Australian work health and safety law is harmonised, but not uniform, and permits are one area where the differences matter. Queensland, New South Wales, and the other harmonised jurisdictions share near-identical confined space permit requirements. Victoria operates a separate scheme, under the Occupational Health and Safety Act 2004 (Vic) and the Occupational Health and Safety Regulations 2017 (Vic).

The Victorian confined space entry permit (regulation 63) differs in substance from the harmonised version. It is framed around employer and employee duties rather than the PCBU model, sets a different mandatory field set, and addresses the question of who is inside the space through a separate procedure rather than the “all persons have left” acknowledgement used elsewhere. A permit form that is compliant in Brisbane or Sydney can be deficient in Melbourne. Organisations operating across borders should confirm that each permit reflects the jurisdiction in which the work is actually performed.

Closing out a permit correctly

Closing a permit well is as important as issuing it well. A permit governs the work for its entire duration, well beyond the moment it is signed. For confined spaces, the permit must include an acknowledgement that the work is complete and all persons have left the space, completed by a competent person (regulation 67).

Work that is paused, varied, extended, or handed to a new shift needs a controlled step rather than an informal arrangement. A single confined space permit may cover multiple entries by multiple people across a shift, so a reliable record of who is inside the space at any time is essential. Permits that pass their valid-to time without a recorded close-out should be flagged and followed up rather than left open.

What makes a permit to work system effective

A permit is only as effective as the system around it. Several practical elements separate a working system from a stack of forms:

• Define which tasks need a permit. Document the activities that require a permit, and the locations, departments, and times they apply to. Routine tasks performed frequently may sit outside the permit system where detailed work instructions and training already control them.
• Authorise and train issuers. Only trained, competent people should issue permits, and records of that training and competency should be kept.
• Maintain a permit register. Record every permit in a single register. A responsible manager should review the register at the end of each shift or day and resolve any permit left open.
• Keep control during the work. Permits should be displayed at the work front, and continuous oversight maintained while work proceeds.
• Cross-reference interacting permits. Where two activities could affect one another, for example hot work near a confined space, the permits should be linked so the interaction is managed rather than missed.
• Use formal suspension and handover steps. Work that is paused needs a suspension procedure, and a permit running beyond one shift needs a documented handover to the incoming supervisor.
• Hand back to operations. On completion, confirm the plant or area is in a safe condition and formally returned to operations before it is reinstated.

Close-out then completes the cycle, and records should be retained for the period required, commonly at least two years and longer for the specific record types noted above.

Permit obligations in summary

The duties sit across several roles. A PCBU holds the primary duty to ensure health and safety so far as is reasonably practicable, together with the specific duties around confined spaces, licence verification, and record-keeping described above. Officers hold a due diligence duty to ensure the business has, and uses, appropriate resources and processes to manage risk, which extends to the systems that govern high-risk work (section 27). Workers must take reasonable care and comply with reasonable instructions, including the conditions set out in a permit (section 28).

A permit system is one of the clearest places where these separate duties meet a single, daily workflow. A sound system helps each duty holder discharge their obligations and produces the evidence that they did. Treated as paperwork, it achieves neither.

How Safetysure can help

Safetysure works with organisations to make permit systems both compliant and workable. We review existing permits and permit-to-work procedures against the obligations that apply in each relevant jurisdiction, and we identify where a form, a process, or a record falls short of what the law expects.

We also help design systems that keep the risk assessment as the source of truth, gate work on verified competency, and capture records that will withstand later scrutiny. Our related services include confined space safety, SWMS review, and WHS auditing.

A permit is only as good as the system and the discipline behind it, and the value of getting it right is measured on the day something goes wrong. To review your permit to work system, or to design one that holds up, contact our WHS team or book a permit system review.

Frequently asked questions

Are permits to work legally required in Australia? Only one is. The WHS Regulations require a confined space entry permit before a worker enters a confined space (regulation 67). For hot work, work at heights, excavation, and isolation, no regulation mandates a permit, although a permit is often the reasonably practicable way to meet the primary duty of care (section 19).

What types of work usually need a permit? High-risk or non-routine work, most commonly confined space entry, hot work, isolation (lockout-tagout), energised electrical work, work at heights, and excavation. Many organisations also use a general or cold work permit for other non-routine tasks.

Who can issue a permit to work? A competent person authorised by the business. For confined spaces, the risk assessment and the permit must be completed by a competent person (regulations 66 and 67). Good practice separates the roles of raising, issuing, and supervising a permit, so that no one approves their own work.

How long is a permit to work valid? A permit applies only for the scope, location, and time period stated on it, and for confined space work it is often limited to a single shift or entry. Work that continues beyond the stated period, or that is paused or handed over, requires re-authorisation rather than an informal extension.

How long must permit records be kept? It depends on the record. Evidence of a high risk work licence must be kept for at least one year (regulation 85). A confined space permit should be kept until the work is complete, or for at least two years if a notifiable incident occurs. Certain health monitoring records must be kept for thirty or forty years (regulations 378, 418, and 444).

Does a permit to work remove the need for other controls? No. A permit is an administrative control and sits low in the hierarchy of control (regulation 36). It manages the residual risk that remains after higher controls such as elimination, substitution, isolation, and engineering have been applied.

Is a permit to work the same as a risk assessment or a SWMS? No. A risk assessment identifies hazards and the controls for them. A safe work method statement sets out how high risk construction work will be carried out. A permit authorises a specific task to proceed at a specific time, drawing its controls from the risk assessment. The three work together.

Sources and further reading

• Work Health and Safety Act 2011 (Qld) (sections 17, 19, 27, 28, 275)
• Work Health and Safety Regulation 2011 (Qld) (regulations 36, 66, 67, 71, 81, 82, 85)
• Work Health and Safety Regulation 2025 (NSW) (regulation 67)
• Occupational Health and Safety Regulations 2017 (Vic) (regulations 63, 66)
• Model Code of Practice: Confined Spaces (Safe Work Australia)
• Model Code of Practice: How to Manage Work Health and Safety Risks (Safe Work Australia)

This article provides general information on work health and safety obligations and does not constitute legal advice. Specific obligations should be confirmed against the legislation in force in the relevant jurisdiction.