Control of Work Explained: 4 Layers That Keep Permits Real

Control of work is the system that decides who may start, continue, stop, or restart a task when the field has already changed from the assumption on paper. It matters most when shift handover, contractor overlap, temporary changes, or simultaneous operations make a permit too thin to carry the real decision.

Control of work is the live governance around hazardous tasks. It matters because a permit, briefing, or checklist only works when the site can still match the plan to the field, and when supervisors can stop the job before the paperwork becomes fiction.

Definition

In practical safety management, control of work is the chain that connects authorization, field verification, handover, and close-out. It is broader than a permit-to-work system because it also covers the conditions that make the permit valid, the change points that can break it, and the checks that prove the task still belongs in the current window.

ISO 45001 expects operational controls to be planned and kept effective, which is why control of work belongs inside the management system rather than beside it. James Reason's work on latent failure helps here because the visible mistake at the job site often starts earlier, in a weak handover, a rushed restart, or a missing field check. Across more than 250 cultural transformation projects supported by Andreza Araujo, the pattern is the same: the job rarely fails at one obvious moment, because the control chain weakens step by step first.

If you want the upstream version of that thinking, the article on how to run a what-if review before a process change shows how leaders should judge the risk before work starts. Control of work is the downstream companion, because it keeps the approved plan honest once the field starts moving.

The 4 layers

The four layers below show where control of work usually succeeds or breaks. They are simple enough for a supervisor to review in minutes, although each one carries a different failure mode.

1. Authorization

Authorization answers a simple question: who may do the task, under what conditions, and for how long. When authorization is vague, the team treats the permit as permission to start rather than a boundary for the work.

That is where many paper systems fail. The crew has a form, the form has a signature, and the site still has no clear rule for who owns the next stop point if the conditions change.

2. Field verification

Field verification checks whether the worksite still matches the permit. The point is not to repeat the form, but to confirm that the isolation, access, atmosphere, tools, and neighboring tasks still match what the authorizer thought they were approving.

This layer fails when verification becomes a glance. If the supervisor cannot point to the condition that was checked, the job is running on trust rather than control.

3. Handover and restart

Handover is where control of work often drops without anyone noticing. Shift change, meal break, temporary pause, or contractor swap can all break the thread unless the next person knows what changed, what remains open, and what must be rechecked before restart.

Restart deserves its own gate because the job is not the same job after a pause. Andreza Araujo's field experience, which is reflected in Safety Culture: From Theory to Practice, is useful here: the strongest teams are not the ones that keep moving at all costs, but the ones that can pause without losing the logic of control.

4. Close-out and learning

Close-out confirms that the task is actually finished, that the site has been returned to a safe condition, and that exceptions have been captured. Without close-out, the team keeps carrying the risk into the next shift because nobody knows whether the temporary control was removed, revised, or left behind.

This layer also protects learning. If close-out only means filing the form, then the organization gets records without understanding, which is the fastest way to repeat the same control failure on the next job.

How to differentiate in practice

People often mix control of work with nearby terms that are related but not identical. The list below keeps the boundaries clear enough for field use.

Control of work

The live system that decides whether the task can start, continue, pause, or restart safely. It fails when the field no longer matches the conditions that justified the work.

Permit-to-work

The authorization record for a specific hazardous task. It fails when the permit is treated as proof of safety instead of proof of a controlled decision.

Field verification

The site check that confirms the real conditions still match the approved plan. It fails when the check is rushed or copied from the form without looking at the work.

Close-out

The final step that confirms the task is complete and the temporary controls are removed or handed over. It fails when the job ends on paper but not in the field.

When to use control of work vs a what-if review

Use a what-if review before the task starts, when the team still has time to test scenarios and change the plan. Use control of work during execution, when the question is no longer hypothetical and the site needs a live decision about whether the job can keep going.

The two tools belong together, not in competition. A good what-if review keeps the plan credible, while control of work keeps the plan true once the pressure of the field starts to bend it. That is also why the companion article on permit revalidation at shift change sits in the same cluster.

What leaders should fix first

Start with the handover points, because that is where control of work usually loses precision. Then check whether the permit says who may stop the job, what event forces a recheck, and who owns the restart decision if the work is interrupted.

Next, test one permit in the field rather than in the office. If the supervisor cannot show the boundary, the isolation, the current risk, and the next stop point on site, the control exists on paper only.

A site that cannot explain its control of work in plain words is usually carrying more risk than its records admit.

FAQ

What is control of work?

Control of work is the live system that keeps hazardous tasks inside clear boundaries. It connects authorization, field verification, handover, and close-out so the team can stop or restart the job when conditions change.

Is control of work the same as a permit-to-work?

No. A permit-to-work is one record inside the wider control of work system. The broader system also covers the checks that keep the permit valid after the field starts to move.

Why does handover matter so much?

Because most failures appear after a pause, not at the first start. If the next person does not know what changed, the task restarts with a weaker control base than the one that was originally approved.

What should a supervisor ask before restart?

The supervisor should ask what changed, what still needs to be checked, and who owns the next stop point. If those answers are unclear, the work should not restart yet.

What is the simplest first improvement?

Make one stop point visible in the field and require a fresh verification after every interruption. That small rule makes the control chain easier to see and harder to fake.

Read more from Headline Podcast