The gap surfaces the moment somebody asks for the document. The program says hazardous energy will be controlled and a safe work condition established before work begins. Then an auditor asks for the lockout procedure for that specific 480 V switchgear lineup, the energised work permit signed last quarter, and the list of who is qualified to open it. Three separate documents — and in most facilities at least one does not exist.
We write the procedural layer: equipment-specific lockout/tagout, the steps for establishing and maintaining an electrically safe work condition, energised work permits and the approval chain behind them, qualified-person rosters, and the host–contractor coordination documents multi-employer sites depend on.
29 CFR 1910.147, OSHA’s control of hazardous energy standard, is what most manufacturing, utility, data centre and process clients are measured against. Asked for their LOTO program, employers produce a binder. The binder is usually the written program — the policy layer. The standard also expects procedures written for the specific machine or equipment, periodic inspection of those procedures, and training differentiated by role.
The gap is rarely in the policy. It is in the equipment-specific procedures and the inspection record — the only two elements that require somebody to walk the floor every year with a document in hand.
| Element | What 1910.147 expects | The document that proves it | Where it usually fails |
|---|---|---|---|
| Written energy control program | Documented program covering energy control procedures, training and periodic inspection. | The signed, dated, revision-controlled program document. | Rarely. It exists almost everywhere — often unrevised for a decade. |
| Equipment-specific procedures | Procedures for the specific machine or equipment: scope, purpose, authorisation, rules and technique of energy control. | A per-asset procedure keyed to the identifier on the nameplate and disconnect. | Constantly. Missing, or written for equipment since replaced. |
| Periodic inspection | Inspection of the procedure at least annually, by an authorised employee other than the one using it. | A dated record naming the procedure, employees checked and inspector. | The most common finding. Nobody owns it, so it is not done. |
| Authorised / affected / other training | Three levels: the authorised employee applying the lock, the affected employee whose machine is locked out, and others in the area. | Records stating which of the three levels each employee received, and when. | Often. One “LOTO training” sign-in sheet does not show who is authorised. |
In practice, nobody — which is why it is missing. Maintenance assumes EHS owns it; EHS assumes the area supervisor does. The fix is organisational: name a role rather than a person, put the inspection on the same calendar as another recurring obligation so it survives turnover, and require an inspector who does not use the procedure being inspected — which by itself forces two trained people per procedure.
1910.147 sits in Part 1910, general industry. Work performed under 29 CFR 1926 — construction — falls under a different part with its own electrical provisions at 1926 Subpart K. Employers who do both, and plant owners whose contractors work under the construction standard, cannot assume one hazardous-energy program discharges both obligations. We establish which part governs each category of work and write the procedures so it is unambiguous.
Two locks, two programs, two sets of assumptions. The contractor arrives with their own LOTO program and locks; the host has procedures the contractor has never read; nobody has agreed whose device goes on first or who verifies removal. Group lockout has to be written before the outage, not negotiated at the switchgear at 6am — the same coordination problem 110.5 addresses.
NFPA 70E devotes Article 120 to establishing an electrically safe work condition, and 110.2 requires the employer to establish, document and implement a policy for it that puts hazard elimination first. Together they say something specific: the safe condition is a documented commitment carried out through a repeatable sequence, not a judgement call made at the panel.
The 2027 edition also treats test instruments and equipment as their own requirement at 110.6. A meter not checked on a known source before and after the test is not evidence of anything, and a procedure that does not say so leaves the crew to invent the step.
Every source identified from current drawings; disconnecting means opened and, where the design permits, verified open; stored energy released or restrained; lockout devices applied; then absence of voltage confirmed on every conductor with an instrument rated for the circuit and proven to work immediately before and after the test.
A condition established at 7am is not a condition at 3pm unless someone is accountable for it. The procedure must say who may operate the disconnect while work is in progress, what re-verification follows any interruption, how shift handover transfers custody of the isolation, and what happens when the job runs past the shift.
Clients often propose to solve verification by buying equipment — permanently mounted absence-of-voltage indication, better meters, more test points. Useful, but none of it answers what an investigator asks: who was authorised to do this step, what sequence were they trained to follow, what record shows it was followed, and what did the procedure require when the reading was ambiguous. A tool produces a reading. A procedure produces a defensible decision, repeated the same way on every shift.
NFPA 70E provides a sample energised electrical work permit in Informative Annex J. Annexes are informative rather than mandatory, which clients read as optional. The useful reading is different: the annex shows what a defensible permit captures, and an auditor who finds one missing those elements will ask why.
Only when energised work is genuinely justified — because de-energising would introduce a greater hazard, or is infeasible given equipment design or operating limitations. Testing and troubleshooting are treated differently from repair and replacement, and your procedure must say which recurring tasks fall on which side. A permit raised weekly for the same routine task is not a control; it documents a design or scheduling problem nobody has fixed.
The circuit, equipment and location; the work to be performed; the justification for why de-energising is not possible; the shock and arc flash risk assessment results, including boundaries and the PPE selected; how unqualified persons are kept out of the area; evidence of a job briefing; and the approval signatures. A permit with a blank justification field is worse than none — it is a written admission that the assessment was skipped.
The signature block usually routes to a plant manager or facility director — often the least electrically trained person in the chain, asked to approve a risk assessment they cannot evaluate on equipment they have never opened. We write the chain so the technical evaluation is signed by someone qualified on that equipment, and management authorisation is a separate, honestly labelled line accepting the business decision rather than pretending to verify the engineering.
NFPA 70E defines the qualified person in Article 100 and sets training requirements in 110.4. Both are written around demonstrated ability on specific equipment and specific work methods — not around having sat in a class. That is where the documentation problem starts.
We build the roster as a controlled document with a named owner and a review cycle, and write the rules that change it: new equipment, new work method, a job change, an observed deficiency, or a period away from the work. That last one quietly invalidates rosters — the person is still listed but has not performed the task in three years.
| What employers hold | What a defensible roster shows |
|---|---|
| “Attended NFPA 70E training, March.” | Named person, qualified for stated tasks, on stated equipment classes, determined by a named evaluator on a stated date. |
| One list covering “electricians.” | Task-level granularity: operating a disconnect is not the same qualification as racking a breaker or opening an energised enclosure. |
| No stated expiry. | Defined review cycle plus written retraining triggers tied to events, not only to the calendar. |
| Employees only. | Contractor personnel covered by an equivalent, verified arrangement before they are given access. |
Building the roster honestly usually shrinks it. Employers find four people qualified for a task they assumed twelve could do, which turns a paperwork exercise into a staffing conversation. That is the point — better found during a document review than during an outage.
NFPA 70E addresses host and contract employer responsibilities in 110.5. It is not a one-way duty on the contractor. Each party owes the other, and what is owed is informational and documentary — which means it is provable, or provably absent.
Hazards the contractor could not reasonably be expected to know: the equipment’s condition of maintenance, known deficiencies, the incident energy analysis results for equipment they will open, site procedures and permit rules, and recent modifications that make the drawings unreliable.
The practical failure: this is said at a gate briefing and never recorded. Afterwards the host cannot show what was communicated and the contractor cannot show what they were told. We turn it into a signed site hazard information package held in the contract file.
Assurance that their employees have been instructed in the hazards the host communicated and in the host’s safety-related work practices, and notification back to the host of hazards their own work introduces or unanticipated hazards found in the host’s equipment.
The practical failure is the return leg. Contractors find a missing barrier, an unlabelled disconnect or a compromised enclosure, mention it to a foreman and move on; nothing reaches the host’s maintenance system. We write the reporting route, the acknowledgement record, and a documented coordination meeting before outage or energised work.
Both are published NIOSH Fatality Assessment and Control Evaluation (FACE) reports. Summaries below reflect what the reports themselves state, including their own recommendations. Nothing is added, inferred or dramatised.
A 30-year-old electrician was working on a hotel’s main service disconnect breaker panel following Hurricane Hugo damage. After initially de-energising all breakers, the victim apparently re-energised the main switch and then contacted an energised 480-volt bus bar and conductor. He stopped breathing approximately two minutes after contact and died at a hospital. Incident date January 8, 1990.
Failure to maintain the de-energised status during work; lack of verification that the system was de-energised before work commenced; inadequate safety protocols and worker training.
That employers develop, implement and enforce a comprehensive safety program including worker training in recognising and avoiding hazards, and that electrical systems be de-energised and tested to verify that they are de-energised prior to any work being performed.
The isolation was performed, then defeated by the person it protected. This is the clearest argument for writing the maintenance half of the safe work condition: custody of the isolation, who may operate the disconnect while work is in progress, and mandatory re-verification after any interruption. A procedure that ends at “verify absence of voltage” would not have prevented this.
Read NIOSH FACE 90-22 →An electrician was relocating conduit and wiring for a CO₂ refrigeration system. He disconnected what he believed was the energised wire and taped it, then used an uninsulated steel fish tape to pull new conductor through the conduit. While removing the tape from the wire and holding the grounded fish tape, he contacted the energised conductor, completing a circuit to ground. Incident date July 29, 1987.
Power to the compressor motor circuit remained on — only the controls circuit had been disconnected; panel box markings were illegible; and the worker failed to test the circuit with an available volt meter before working on it.
That disconnecting means and circuits be adequately identified; that employers reinforce their standard operating procedures concerning circuit testing; and that employees and employers be trained in cardiopulmonary resuscitation.
A test instrument was on site and unused, and the panel identification that would have told him which circuit he had opened was illegible. Both are procedural, and both are auditable in an afternoon: does the written procedure make testing a required step with a named responsible person, and does your labelling keep disconnect identification legible after modifications.
Read NIOSH FACE 87-63 →A note on numbers: we do not repeat the widely circulated claim that five to ten arc flash explosions occur every day in the United States. NFPA’s own Fire Protection Research Foundation has stated the origins of that figure are unclear. For context that is sourced, the U.S. Bureau of Labor Statistics Census of Fatal Occupational Injuries recorded 130 fatal injuries from exposure to electricity in 2024, and 142 in 2023.
Editable documents in your own template and revision control, written against the NFPA 70E 2027 edition and the OSHA part that governs the work. Not a licensed template you have to keep paying for.
Written per asset for the equipment we agree is in scope, keyed to your equipment identifiers, with the isolation points listed and the verification steps stated in order.
The form, the schedule and the assignment rule that makes the annual inspection happen — including who may inspect which procedure.
The establish-and-maintain sequence, test instrument rules, shift handover and re-verification triggers, written for your equipment classes.
The permit form, the justification test that governs when one may be raised, and a signature routing that puts the technical evaluation with someone qualified to make it.
Task and equipment granularity, a named owner, a review cycle, and the written retraining triggers that keep it honest between reviews.
Site hazard information package, contractor assurance record, the return-reporting route, and the pre-outage coordination meeting agenda.
We read what exists: the program, any LOTO procedures, permits raised in the last two years, training records, your incident energy study, and the contractor agreements. Remote, before we arrive.
Onsite at the equipment with the people who work on it. Isolation points confirmed, labelling checked against the study, and real practice compared with the written procedure — which is where the document has to start.
Documents drafted in your template, then reviewed with the maintenance and EHS owners together. Two review rounds are in scope; we expect the first draft to be argued with.
The crews are trained on the documents we wrote, not a generic deck — so the class matches the procedure they will be handed. Delivered onsite or live virtual. See training →
Those are two different elements of 29 CFR 1910.147. The program is the policy; the procedures are written for the specific machine or equipment. Having one does not satisfy the other, and the equipment-specific layer is the one most often missing or out of date. The standard treats certain limited situations differently, so part of the review is establishing which equipment requires a documented procedure.
We write procedures under both parts, but separately and labelled, because Part 1910 and Part 1926 are different frameworks with different electrical provisions — 1926 Subpart K on the construction side. The common failure is a general industry program applied unexamined to construction activity, or a plant assuming its contractors are covered by the plant’s program.
No. We do not perform incident energy analysis engineering studies and we do not produce arc flash labels — that is engineering work. We review the study you hold, audit whether field labelling matches it, and write the procedures, permits and training that make it usable. Where the study is missing or stale, we say so in writing.
Yes, and more than usual this cycle. Chapter 3 of the 2027 edition has been restructured and renumbered, and a new Article 310 covering direct current electrical hazards has been added — content that was not in the previous edition. Any procedure or training deck citing prior-edition Chapter 3 article numbers now points at the wrong articles. It is a concrete, checkable finding.
Led by a Certified Safety Professional (CSP) with 35+ years in EHS and electrical safety. The walkdown, the interviews and the drafting are done by the people you speak to on the phone. There is no junior consultant handoff. More about the practice →
What a permit must capture under the 2027 edition, and who should be signing it.
Read the article →Why equipment condition changes what your procedures and PPE selection can assume.
Read the article →The host and contractor coordination problem, seen from the contractor’s side of the fence.
Read the article →How equipment and staffing changes silently invalidate procedures and rosters.
Read the article →A scoping conversation costs nothing and takes about thirty minutes. If procedures are not what you need, we will say so. Fixed scope, quoted up front.