Your e-permit system digitized the form, not the control
If your e-permit rollout raised issuance speed and completion rates without adding field verification steps, you improved paperwork, not safety.
Permit-to-work is one of the oldest hard controls in industrial safety, and it is one of the most misunderstood. The permit is not the control. The permit is a receipt. The control is the set of physical conditions the permit is supposed to certify: an isolation that actually holds, an atmosphere that actually tested clean, a fire watch that is actually standing there. Digitize the receipt and you get a faster, cleaner, better-audited receipt. That is genuinely useful. It is also not the same thing as a safer job, and confusing the two is how a plant runs a beautiful dashboard straight into an incident.
What the standards actually require
Read the standards and you find that every permit regime is built around verification of a condition, not completion of a document.
For confined space entry, 29 CFR 1910.146 requires the employer to document the completion of pre-entry measures by preparing an entry permit, but the operative act is the entry supervisor determining that acceptable entry conditions are present and signing to authorize entry. The standard also requires atmospheric testing in a specific order (oxygen first, then combustible gases and vapors, then toxic contaminants) and an attendant stationed outside for the duration of entry. None of that is the form. The form records that it happened.
For hazardous energy control, 1910.147 requires machine-specific procedures and, critically, verification that isolation is effective before work begins. The standard also requires a periodic inspection of each energy control procedure at least annually, performed by an authorized employee other than the one using the procedure, precisely because a written procedure drifts from field reality over time.
For hot work, 1910.252 requires the area to be inspected and made fire-safe before cutting or welding is authorized, a fire watch wherever more than a minor fire could develop, and that watch maintained for at least a half hour after work stops to catch smoldering fires. Again: the permit authorizes; the fire watch is the control.
Where digitization helps and where it quietly does not
E-permit systems are good at the things software is good at. Issuance is faster. Handwriting illegibility disappears. Expired permits can auto-close. The audit trail is complete and time-stamped, which matters when you are reconstructing an event or defending a recordkeeping position. Approvals route to the right people instead of sitting in a truck.
Here is the problem. Every one of those gains is a gain in the paper layer. The hazard checks live in the physical layer, and software touches that layer only if you deliberately design it to. A dropdown that says the gas test was performed is not a gas test. A checkbox confirming the fire watch is posted is not a person watching for fire. A field marked “isolation verified” is not a try-out of the start button against a locked energy-isolating device.
Worse, e-permits change the incentives around volume. When issuing a permit takes ninety seconds instead of fifteen minutes, you issue more of them, and your completion and on-time-closure metrics climb. Leadership reads rising throughput and falling exceptions as improvement. What has actually happened is that the friction which used to force a pause got engineered out, while the verification that was always the weak link stayed exactly as weak as it was on paper. You have automated the theatre and left the control alone.
The tell
The diagnostic is not whether the system is fast or the dashboards are green. It is whether the digital act is bound to a verified physical condition, or floats free of it.
The verification test
Pull ten recently closed permits and walk each one backward to the field. For every attestation on the screen (atmosphere tested, energy isolated, fire watch posted, area made fire-safe), ask: what evidence outside the permit itself proves the condition was verified, and could the permit have been completed and closed without that verification happening? If the honest answer is that a competent person could tap through every field without ever confirming a physical condition, your e-permit system improved paperwork, not control.
The fix is not to abandon digitization. It is to bind the software to the physical world at the points that matter: require captured gas-meter readings rather than a typed number, tie hot-work closure to a timed post-work watch the system will not let you skip, make isolation verification a distinct step with a named verifier, and audit against the field rather than against the database. A permit system earns the word “control” only when a completed permit cannot exist without a verified condition behind it. Until then, you have bought speed and legibility, which are worth having, and told yourself you bought safety, which you did not.