Control of Work: 5 Ownership Gaps That Turn Permits Into Paperwork

Control of work is the decision layer that decides when a task may start, stop, continue, or change. Most sites talk about it as if the permit itself were the control. It is not. The permit records a decision, while the real control lives in the ownership chain that holds when the field no longer matches the page.

Control of work is the set of decisions, checks, and ownership rules that keep a high-risk task aligned with the conditions that were approved. It matters because work changes after approval. The permit does not stop that drift by itself.

Across more than 250 cultural transformation projects, Andreza Araujo has seen the same failure pattern repeat in different sectors. A document can look complete while the exposure has already moved, and a team can remain calm while the control has quietly shifted from the field to the form. In Safety Culture: From Theory to Practice, that gap appears whenever the organization rewards neat paperwork more than the condition that the paperwork was supposed to hold.

This article is for supervisors, maintenance leaders, EHS managers, and plant leaders who want a practical way to read control of work as a live system, not an administrative ritual. It sits close to management of change, because both disciplines ask the same question from different angles: when the work changes, who still owns the risk?

Why the permit is not the control

A permit can be correct and still fail. That sounds obvious until the team starts treating the signed form as proof that the task remains safe all the way to completion. The form may describe the work as it was understood at the start, but the work itself may change after a shift handover, a weather shift, a staffing change, a missing part, or a competing job in the same area.

James Reason's work on latent failures is useful here because it pushes attention away from the last visible act and toward the system that made the act possible. If the permit is treated as the control, the organization mistakes recordkeeping for barrier management. If the permit is treated as one input to a control chain, the site keeps a chance to catch drift before a crew is exposed.

When a permit becomes the only thing that travels from planning to execution, the work has already separated from the decision that was supposed to govern it.

Gap 1: the signer, the supervisor, and the operator are not the same person

The first ownership gap appears when the person who signs the permit is not the person who sees the field every hour. That gap matters because signatures do not supervise. They only record consent. If the supervisor who knows the task best is absent, or if the operator who will feel the friction is not asked to verify the conditions, then the permit becomes an accountability transfer rather than a control transfer.

In practice, this happens when the approval sits with one function, the field execution sits with another, and the line of sight into actual conditions belongs to a third. The result is predictable: everyone can point to a responsible role, while nobody owns the moment where the task no longer matches the original assumptions.

Andreza Araujo's The Illusion of Compliance is relevant because it describes what happens when a clean process creates the appearance of control without the substance. A site can pass a document review and still fail the work review, which is why the control owner must be the person who can actually stop or reshape the task when the conditions change.

Gap 2: the field changes after approval

Control of work breaks down most often after approval, not before it. A permit issued in the morning can be obsolete by the afternoon if the crew, the sequence, the weather, the equipment state, or the surrounding work changes. This is why control of work and hot work permits deserve the same question every time: what changed between the signoff and the task?

A strong site does not assume that the first approval remains valid forever. It revalidates when the task shifts. That is especially important when a job starts inside one controlled boundary and then spills into another, such as when the crew discovers a blocked access point, a live adjacent line, or an unexpected congestion problem that was not in the original plan.

Patrick Hudson's maturity thinking helps here because it reminds leaders that better organizations do not rely on luck or memory to keep a control alive. They create a habit of rechecking the control when the situation changes, since the risk does not care that the permit was correct two hours ago.

Gap 3: exception becomes routine before anyone names it

The third gap is the one leaders normalize most easily. A crew asks for one exception. The exception is granted because production is behind, the job is almost finished, or the part is not available until tomorrow. Then the same exception appears again, and the site starts treating it as a normal way to work.

That pattern matters because an exception that repeats is no longer an exception. It is the operating model. Once that happens, control of work has stopped being a safeguard and has become a story the organization tells itself about how carefully it works. The paperwork still looks disciplined, but the field already learned a different rule.

This is the point where leaders need to connect the permit to management of change. If the exception alters the job sequence, the isolation point, the access route, or the supervision requirement, then the site is no longer doing the original task. It is doing a different task under a familiar label.

Gap 4: supervisors audit the form instead of the barrier

Many control of work reviews stop at signatures, dates, and completeness. Those are useful, but they are not enough. A supervisor should be asking whether the barrier is still real in the field, whether the isolation is still visible, whether the access route is still controlled, whether the gas test is still fresh, and whether the rescue plan still fits the current state of the job.

That distinction matters most in permit-driven work such as excavation and hot work, where a clean form can hide a weak boundary. The permit may say the right thing, but if the barrier has been moved, defeated, opened, or forgotten, the field is telling a different story. A complete form is not the same as a live control.

Across more than 250 projects, Andreza Araujo has observed that the strongest leaders do not ask only whether the permit was filled out correctly. They ask whether the control still exists at the point where the exposure is supposed to stop. That question is harder to fake, which is why it is more useful.

Gap 5: closeout happens before exposure ends

Control of work often closes too early. The permit is signed off, the work package is archived, and the team moves on while the area is still changing. That is a mistake because the hazard does not disappear just because the document has reached its end state. It disappears when the physical condition, the energy state, and the access state are actually safe.

This is where shift handover becomes part of the control system. If one crew leaves behind an open boundary, a temporary bypass, a partially isolated line, or an incomplete restoration step, the next crew inherits exposure without inheriting the context. The handover must therefore name the remaining risk, the owner, and the next verification point.

James Reason is again useful because a late failure often begins with an early assumption that the task is already under control. It is not enough to say the permit is closed if the field is still open.

Comparison: paper control versus field control

What leaders should change in the next 30 days

If a site wants control of work to function as a real barrier, leaders should make five changes immediately. First, name one control owner for every high-risk task, and make that person visible to the crew. Second, require revalidation whenever the task, crew, adjacent work, or energy state changes. Third, record exceptions separately so the team can see when the site is drifting away from standard control.

Fourth, review one live permit each week against the field, not only against the archive. Fifth, make supervisors explain the barrier in plain language before they approve the task. If the barrier cannot be explained without hiding behind a form, the barrier is probably weaker than the form suggests.

Those moves are practical for a shift supervisor, but they matter just as much for a plant manager or EHS director because control of work is not an EHS corner case. It is a leadership question about whether the organization can keep its promises while conditions keep changing.

FAQ

What is control of work?

Control of work is the set of decisions, checks, and ownership rules that keep a high-risk task aligned with the conditions that were approved. It includes the permit, but it also includes revalidation, supervision, field verification, and handover.

Is a permit the same as control of work?

No. A permit records the authorization. Control of work is the live system that keeps the authorization true after conditions change. A permit without field verification is only a document.

When should a task be revalidated?

Revalidation should happen when the crew changes, the sequence changes, adjacent work changes, the energy state changes, or the task pauses long enough for conditions to drift. The site should treat change as a trigger, not as an inconvenience.

Why do exceptions become dangerous?

Because repeated exceptions train the site to accept a different standard. Once that happens, the exception is no longer temporary. It becomes the normal way of working, even if the paperwork still says otherwise.

What should a supervisor check first?

The supervisor should check the live barrier, not only the form. If the barrier is gone, moved, defeated, or no longer relevant, the task needs a new decision before work continues.

Conclusion

Control of work fails when the organization treats paperwork as the control and the field as a formality. The better model is simpler and harder: one owner, one live barrier, one revalidation trigger, and one rule that says a task cannot continue when the conditions no longer match the approval.

That is the same discipline Andreza Araujo describes in Safety Culture: From Theory to Practice and The Illusion of Compliance. The site is only in control when the field, the permit, and the ownership chain still agree. For more practical safety conversations, keep Headline Podcast in your leadership routine and pair this article with management of change before the next restart.