Contractor permits and keeping work accountable

A contractor arrives, signs in at reception, and disconnects a smoke detector to grind a bracket off a riser cupboard. Nobody told the building manager. Nobody isolated the panel. The detector is reconnected at the end of the day, or it is not, and three weeks later a fire risk assessment flags a dead zone on the second floor that nobody can explain. Most of the worst near-misses in occupied buildings start exactly here: competent work, done by competent people, with no permit and no record that ties the work to the person who authorised it.

A permit to work is the document that closes that gap. It is not bureaucracy for its own sake. It is the agreement, written down before a job starts, that says what is being done, where, by whom, for how long, and what has to be made safe first and put back afterwards. When it is done well, the permit is also the audit trail. When it is skipped, the building manager is left reconstructing events from memory and a visitor logbook.

What a permit actually controls

The permit exists to control the moment when normal building operation is suspended. Hot work suspends the assumption that nothing on site can ignite. Isolating a sprinkler valve suspends the assumption that suppression is live. Propping open a fire door for a cable pull suspends compartmentation. Each of these is reasonable for the duration of a job and dangerous if it outlasts the job by an hour.

So the permit pins down the things that have to be true before work starts and after it ends:

• The exact location and scope, narrow enough that scope creep is visible.
• The systems being isolated or impaired, and who authorised the impairment.
• The controls in place during the work, including fire watch for hot work.
• The named, competent person doing the work and the person signing them on and off.
• The time the permit opens and the time it must be handed back.

The handback matters as much as the issue. A permit that is never formally closed is a system that may still be impaired. The discipline of signing the work back in, and confirming detectors are live and doors are shut, is what stops a temporary measure becoming a permanent hazard.

The accountability problem in tall and complex buildings

In a single low-rise office, the manager often sees the work happen. In a higher-risk building, several trades may be on different floors, working for different freeholders, leaseholders and managing agents, with a concierge who changes shift halfway through. The Building Safety Act 2022 puts the duty to manage building safety risks on the Accountable Person, and the practical reality of that duty is that you have to be able to say who did what to the building and when. A permit regime is how an Accountable Person turns a diffuse stream of third-party work into something they can stand behind.

This connects directly to the golden thread. Under the regime the Building Safety Regulator oversees, the golden thread is meant to be an accurate, up-to-date record of building information held through occupation. Contractor work changes the building. If a riser is re-routed, a fire stop is breached and remade, or a compartment line is altered, that is a change to the very information the golden thread is supposed to hold. A permit that records the work feeds the record. A permit that lives in a contractor's van does not.

A permit that people will actually fill in

The fastest way to kill a permit system is to make it so heavy that front-line staff route around it. The aim is a form that takes a few minutes for routine work and escalates only where the risk warrants it. A practical tiering looks like this.

The point of the table is not the exact rows. It is that the level of control follows the level of risk, and that someone named has to sign at each level. A permit nobody signs is a note, not a control.

Tie the permit to the building, not the inbox

Where permits go wrong after the fact is storage. The job is done, the form is scanned, it lands in an email thread, and six months later nobody can find it. The record only earns its keep if it is attached to the building it describes and searchable by date, location and contractor.

That is where a permit stops being paper and becomes part of the building's history. If you can pull up a floor and see every permit raised against it, you can answer the question a regulator or an insurer eventually asks: who has touched this system, and was it made safe each time. Holding permits alongside the compliance calendar and the building's audit record means the work shows up where the next person looks, rather than where the last person filed it. It also feeds the wider point we have made about keeping a fire safety log people will actually maintain: a log is only as good as the events that reach it.

A note on competence and verification

A permit assumes the person doing the work is competent to do it. That assumption needs checking, not asserting. Before high-risk work, confirm the contractor's qualifications, insurance and method statement, and keep that confirmation with the permit. It is a small step that turns "we used an approved contractor" into "here is the evidence we checked, dated, on this job". When something goes wrong, that difference is the difference between a defensible position and a hopeful one.

Closing the loop

Treat the permit as the spine of contractor management, not an afterthought stapled to it. Issue before work starts, control during, hand back at the end, and store against the building so the record survives the people who created it. Done consistently, it gives you the one thing reactive permit-chasing never will: a clear, dated answer to who changed the building and whether it was made safe. In SAMRISK, that record sits with the building it belongs to, so the next manager inherits the history rather than the mystery.