Permit-to-Work vs JSA vs Field Verification: which gate should own the job?

A signed permit can look disciplined while the task still drifts. A JSA can look complete while the crew has already adapted to the field. Field verification can also fail if nobody has authority to stop the job when the plan and the reality no longer match. The question is not which document looks more mature. The question is which gate should own which decision.

Across more than 250 cultural transformation projects, Andreza Araujo has seen the same pattern repeat. Teams put the right words on paper, then let the wrong gate carry the burden of proof. During Andreza Araujo's PepsiCo South America tenure, where the accident ratio fell 50% in six months, the move that mattered was not a better form. It was a tighter decision path between plan, hazard, and field condition.

In Safety Culture: From Theory to Practice and The Illusion of Compliance, Andreza's point is consistent. Control only exists when the work still matches the rule that was approved. James Reason's work helps here too, because latent conditions often sit quietly until a job changes and the paperwork does not.

Key Takeaways

• Use permit-to-work to authorize hazardous work, not to prove the task was fully understood.
• Use JSA to expose task hazards and control steps before the crew starts, not to replace field checks.
• Use field verification when the task, location, or sequence has changed and the plan needs live proof.
• Give each gate one clear owner, because the wrong gate cannot rescue weak ownership in the other two.
• When field reality and paperwork disagree, field verification should decide the next step.

Evaluation Criteria

The comparison works best when leaders judge the three gates by the same criteria. First, what decision does the gate actually own? Second, what evidence does it need before work continues? Third, what failure does it create when people treat it as stronger than it really is? Fourth, who can stop or restart the job after the gate has spoken?

That last question matters because a process without decision rights is only a record. In more than 250 projects, Andreza Araujo has repeatedly found that the field trusts the gate only when the owner can act on the answer. A form without authority usually turns into administrative comfort.

Permit-to-Work

The permit-to-work is strongest when the organization needs a formal authorization step for hot work, confined space entry, line breaking, energized interface, high-risk maintenance, or another job where the right to proceed matters as much as the task itself. It tells the operation who approved the work, under which assumptions, and with which basic safeguards in place.

The weakness appears when leaders confuse approval with proof. A permit can be signed, routed, and filed while the crew still lacks a clean sequence, a live isolation check, or a clear stop condition. That is why permit-to-work should own authorization and coordination, not the whole risk analysis. The article on permit handover before high-risk maintenance is useful here because handover exposes how easily the permit can drift away from the work.

In The Illusion of Compliance, Andreza Araujo warns against treating documentation as safety. The permit is a gate, not a shield. It should say who may begin, what must already be verified, and what condition requires the job to stop. If those lines are weak, the permit looks orderly while the exposure remains live.

JSA

The JSA is strongest at the planning stage because it forces the team to name the task steps, the hazards in each step, and the controls that belong to each exposure. That makes it the best tool for turning a broad job into a sequence that can be discussed, challenged, and improved before the crew is already committed.

The weakness appears when the JSA is written by someone who does not know the job or when the analysis is copied from the last similar task. In that case, the form records a generic hazard list while the real crew manages a different sequence, a different access point, or a different interface. A JSA can still be useful in that state, but only if a supervisor and crew member test it against the work they actually intend to do.

The JSA should own hazard analysis and control selection. It should not own authorization, and it should not pretend to be field proof. When a task changes after the JSA was written, the next step should be a fresh look, not a quiet assumption that the first analysis still applies. The article on temporary field change screening helps because changed conditions are where a strong JSA often starts to decay.

Field Verification

Field verification is the strongest gate when the plan may no longer match reality. It asks whether the isolation is still in place, whether the route is still clear, whether the crew still understands the change, and whether the control that mattered on paper still exists in the field. It is the closest thing to proof that the job can continue under the current conditions.

The weakness appears when field verification is treated as a walkaround without consequence. A leader who can only observe, but cannot stop the job or force a restart decision, has reduced verification to theater. That is exactly the kind of gap James Reason would recognize as a latent condition waiting for a trigger. The walk sees the symptom, but the system still allows the hazard to remain.

In more than 250 projects, Andreza Araujo has seen field verification change behavior only when it is connected to decision rights. When the verifier can say stop, hold, or restart, the crew learns that the field matters more than the file. That is why field verification should own mismatch decisions, restart decisions, and escalation when the job has changed in ways the earlier gate did not capture.

Decision Matrix

The matrix below separates the three gates by role rather than by prestige. Each one is useful, but each one becomes weak when it is asked to do someone else's job.

The practical reading is simple. Permit-to-work tells the operation who may proceed. JSA tells the crew what could go wrong and how the team intends to control it. Field verification tells everyone whether the plan still deserves to move forward. The mistake is to treat any one of those as complete on its own.

Which Gate Owns Which Decision

Use permit-to-work when the main problem is permission, interface control, or formal release of a hazardous task. Use JSA when the main problem is task clarity, sequence clarity, or hidden exposure in the step list. Use field verification when the main problem is drift, change, or weak confidence in the current condition. The three gates can sit together, but they should not blur into one another.

For a high-risk maintenance job, the most serious mistake is usually not missing paperwork. It is letting the job advance after the field changed. The permit can still be valid, and the JSA can still look tidy, yet the work is no longer the work that was reviewed. That is why the field has to have a louder voice than the document when the two disagree.

For leaders who want a practical companion, the article on screening a temporary field change before work continues shows how to catch drift before it becomes normalized. It fits this comparison because changed conditions are where permit, JSA, and field verification finally separate into their real functions.

Recommendation by Context

That recommendation pattern fits a practical safety culture. Andreza Araujo's executive experience shows that operations improve when leaders stop asking one gate to solve every problem. The organization gets calmer, but only because decision ownership becomes sharper.

When the operation needs a stronger review sequence, combine this article with the guide on permit handover and the guide on temporary field changes. Together they show where the task is authorized, where it is analyzed, and where it is proven in the field.

FAQ

Is permit-to-work the same as JSA? No. Permit-to-work authorizes the job, while JSA analyses the hazards and controls for the steps inside that job. They should connect, but they do not do the same work.

Who should own field verification? The person who can stop, hold, or restart the task should own field verification. If the verifier cannot change the decision, the verification is too weak for serious work.

What if the permit is signed but the field changed? The job should pause and the field should be checked again. A signed permit does not override a changed condition.

Which gate should stop the job? Any gate can trigger a stop, but field verification is the one that should end the argument when the plan no longer matches reality.

How does Andreza Araujo read these tools? She treats them as decision points, not paperwork. In her books and project work, the real test is whether the field still matches the control basis that was approved.

The safest next step is to stop asking one gate to do three jobs. Use permit-to-work for authorization, JSA for hazard analysis, and field verification for live proof. Then make the field the final test when the task changes.

Follow Headline Podcast for more risk-management and safety leadership articles that turn process into decisions.