Control of Work Explained: 5 Tests for Job Readiness

A permit can be signed while a job remains unready. The gap appears when the document is treated as proof of control instead of as evidence of a decision that still needs to hold in the field.

Control of work matters most when several parties share a hazardous task, because responsibility can become blurred between operations, maintenance, contractors, and the EHS function. Across more than 250 cultural transformation projects, Andreza Araujo has repeatedly seen that the strongest paperwork cannot compensate for unclear authority or unverified protection.

What is control of work?

Control of work is the disciplined process used to decide whether a job can start, continue, pause, or stop under defined conditions. It connects the work scope to hazard controls, authorization, field verification, communication, and recovery, so the organization can prove that protection exists where the exposure exists.

The phrase is sometimes reduced to permits, signatures, or approval screens. That reduction is dangerous because a permit can remain technically complete after the job has changed. A control-of-work process stays active from planning through closeout, which means the decision must be revisited when the conditions that supported it no longer exist.

James Reason's work on latent failures helps explain why this distinction matters. A visible mistake may be the final movement in a chain whose earlier weaknesses include vague scope, poor handover, missing maintenance information, or authority that is too distant from the workface. Control of work should expose those weaknesses before the task becomes live.

Why does the permit often look stronger than the job?

Documents create a sense of completion because they preserve a visible record. The field presents a harder question. Can the supervisor show that the isolation is effective, the exclusion zone is intact, the right people understand the limits, and the response plan can work under the actual conditions?

This is where the job safety analysis should connect with control of work. The analysis describes how exposure may develop. The control process confirms that the agreed barriers, authority, and communication are available before the team relies on them.

A supervisor who asks only whether the form is complete will miss the operational question. The question is whether the team can still explain the decision without reading the form aloud.

What are the 5 decision tests?

The five tests below are not another checklist to complete after the permit is signed. They are questions that reveal whether the control-of-work decision is coherent enough to release the job.

1. Scope test

The scope test asks whether everyone means the same job. It covers the location, equipment, task limits, interfaces, energy sources, and conditions that are outside the approval. A broad phrase such as “repair the line” is not a usable scope when the work could involve isolation, opening, lifting, testing, and recommissioning.

The test passes when the person doing the work can describe the boundary in plain language and the supervisor can identify what would require a new decision. If two people describe different work while pointing to the same permit, the job is not ready.

2. Authority test

The authority test asks who can release the job, who can pause it, and who can change the decision. A contractor may control the method, while the operating organization controls the plant condition. That interface needs an explicit owner, because responsibility cannot be transferred merely by adding another signature.

The safety ownership boundary becomes useful here. Accountability means the organization retains responsibility for the conditions it controls, while blame looks for a person to carry a decision that the system left unclear.

3. Barrier test

The barrier test asks whether the protection described in the risk review is present, suitable, and verified. A procedure can require isolation, guarding, ventilation, or a spotter, but the requirement alone does not make the barrier real. The supervisor needs evidence that the barrier exists in the place and condition where the exposure will occur.

This test should stay connected to critical control verification, although the field question is more immediate than a dashboard question. What matters before release is not whether the control was reported last month. What matters is whether the control protects this task now.

4. Change test

The change test asks what would make the original decision invalid. Weather, staffing, simultaneous work, equipment condition, production pressure, and unexpected access constraints can alter the exposure without changing the task name. If the team cannot name the changes that require a pause, the control process has no practical trigger.

Change control also needs a route that workers can use without negotiating through several layers of authority. The decision log can preserve why the work was changed, who accepted the revised condition, and what evidence should be checked before the task resumes.

5. Recovery test

The recovery test asks what happens when the work does not proceed as planned. A rescue plan, a safe stop, a return to a stable state, and a route for escalation are separate parts of the answer. They should be understood by the team before the first exposure, not discovered after an alarm or failed control.

Recovery is also a test of realism. If the plan depends on equipment that is not available, a person who is not present, or an access route that the job itself blocks, the job is not ready even when the preventive controls look adequate.

How do you differentiate control of work from related tools?

Related tools answer different questions, which is why combining their names into one approval step creates confusion. A job safety analysis examines how exposure may arise and how the work should be performed. A permit-to-work records authorization under defined conditions. A risk register keeps organizational exposure visible across activities. Control of work connects those outputs to the live decision to release, pause, or stop a specific job.

When should a supervisor refuse to release the job?

A supervisor should refuse release when the scope is unclear, the accountable authority is absent, a critical barrier is assumed rather than verified, or the team cannot explain the stop condition. Refusal is not a rejection of production. It is a decision that the organization has not yet shown how the exposure will be controlled.

The refusal should be specific enough to act on. “Safety concern” does not tell the planner what to correct. “The isolation has not been independently verified, and no one can state who owns the re-energization decision” gives the next decision-maker a usable reason to pause.

What should leaders measure after the job?

Leaders should examine the quality of decisions, not just the number of permits issued or closed. Review whether the original scope survived contact with the field, whether workers used the change trigger, whether barriers were verified by the right person, and whether recovery arrangements matched the actual work area.

That review is stronger when it records a changed assumption and the evidence that corrected it. A control-of-work process becomes credible when inconvenient findings improve the next decision instead of being removed from the record to preserve a clean completion rate.

Recommendation

Use the five tests before release and again whenever conditions change. Start with scope, then confirm authority, verify barriers, define the change trigger, and test recovery. Do not ask the form whether the job is ready. Ask the people who own and perform the work to show why the decision still holds.

Andreza Araujo's experience across 25+ years in executive EHS supports a practical conclusion. Control of work is not a document category. It is the operating discipline that keeps a risk decision connected to the conditions that make the job dangerous.

Control of work is ready when the scope is shared, authority is explicit, barriers are verified, changed conditions have a stop trigger, and recovery can work in the actual field. A signed permit records that decision, but it cannot replace it.