A Permit to Work is Triggered by Activity Type, Not Risk Score — And Confusing the Two Voids It

Many circulating risk-assessment templates trigger a permit at a given score, so crews conclude a low-scoring task does not need one. Table 1 of Code of Practice 21.0 requires the permit by type of work regardless of any score — and its "cold work" category expressly includes work at height, excavation, isolation and scaffolding.

The rule as the code states it

Table 1 of Code of Practice 21.0 lists the work types that require a permit: hot work, confined space entry, work at extremes of temperature, and "cold work" — the last of which expressly includes work at height, excavation, energy isolation, and scaffold erection and dismantling.

No risk score appears anywhere in that table. The permit requirement arises from the type of work; the risk assessment determines the controls inside the permit, not whether one exists.

Activity type

↓

① The permit

Read straight off Table 1 — no calculation, no score

→ Required / not required

② The hazards

Per hazard: likelihood × consequence = score

→ Band and required action

✕ The score never feeds path ①

The score decides what controls go inside the permit, not whether one exists.

How the confusion arises

Circulating templates write a rule of the form "score 10 or above requires a permit to work". It is easy to apply and superficially reasonable, but it produces the wrong answer in the most common case: a short welding task with good controls may assess at 6 — so the crew concludes it is below the threshold and needs no permit, while Code of Practice 28.0 requires a hot work permit for all hot work outside a designated area.

The flaw is that good controls lowered the score, and the incorrect rule converted that reduction into an exemption — making sound planning the reason a procedural control was dropped.

The roles as the code names them

The roles are the Permit Control Manager and the Authorized Person. Clause 3.5.2 requires the Authorized Person and the permit holder to be two different people — one person signing both roles removes the permit''s control function.

Note that "OSH Manager" is not a role named for this purpose in the framework, common as it is in circulating templates.

What the risk assessment should say

State the permit type required by activity type, independently of the computed score.
Contain no wording tying the existence of a permit to a numeric threshold.
Use the role names as the code gives them, not internal company titles.

Frequently Asked Questions

Does a very short task need a permit?

If it is one of the types listed in Table 1, yes. Duration is not a criterion in the requirement.

Can the Authorized Person also be the supervisor carrying out the work?

No. Clause 3.5.2 requires the Authorized Person and the permit holder to be different people.

Does a reduced score after controls remove the need for a permit?

No. The score expresses the level of risk; the permit is a procedural control based on the type of work. A lower score does not change the type of work.