Lockout/tagout that survives a rushed shift change
The written procedure isn't the control. The handoff between shifts is where energy isolation actually fails, and it's the part audits rarely test.
Most lockout/tagout audits check two things: does a written procedure exist, and are locks applied. Both can be perfect on paper while the real failure mode goes unmeasured, the moment a partially completed isolation is handed from one crew to the next.
Where the standard meets the shift
OSHA’s energy-control standard, 29 CFR 1910.147, requires documented procedures and, specifically, provisions for shift changes so that protection is continuous when personnel change. The letter of it is easy to satisfy: a line in the procedure, a lockbox, a signature. What the standard can’t legislate is whether the incoming lead actually holds the outgoing lead’s mental model of what is isolated, what isn’t, and why.
That gap is where the risk lives. A lock on a breaker is a fact. “This system is de-energised except for the accumulator that still holds pressure” is knowledge, and knowledge is exactly what a rushed, end-of-shift handoff drops. When the transfer of understanding depends on a tag rather than a conversation, the control has quietly moved from the isolation to the paperwork, and paperwork doesn’t answer questions.
Field check
Walk a live shift change on a line that's mid-isolation. Ask the incoming lead, unprompted: which energy sources are locked, by whom, and what's left to verify? If the answer comes from reading the tag rather than from the person, your continuity of protection depends on a document surviving a handoff, the weakest link in the whole procedure.
The fix isn’t more forms. It’s treating the handoff as a controlled step in its own right, a verified, face-to-face transfer with a walk-down of the isolation state, not a signature collected on the way out the door. Cheap to require. Almost never audited.