Control of Work (CoW) systems are designed to keep people safe in high-hazard industries. They provide structure for authorising tasks, managing isolations, and ensuring that risks are properly controlled. For Control of Major Accident Hazards (COMAH) sites in the UK, CoW systems underpin much of the day-to-day work, especially in Maintenance, Inspection, and Testing (MIT) tasks and during site turnarounds.
Why robust CoW Systems matter
CoW systems play a vital role in managing risks that could otherwise lead to serious harm. They govern activities which are intrusive and often require instances a break of containment, where getting it wrong could result in unwanted scenarios.
These systems are designed to prevent unsafe work from starting, ensure hazards are understood, and provide assurance that controls are in place. However, the effectiveness of such systems depends on people.
| Lessons Learned: Piper Alpha The 1988 Piper Alpha disaster remains one of the worst offshore accident in history, killing 167 people. A key factor was a breakdown in Control of Work. A condensate pump was restarted while its pressure safety valve was removed for maintenance. Failures in the permit-to-work system and poor shift handover meant that the night shift operators were unaware of the missing pressure safety valve. This incident shows how weaknesses in permits, isolation management, and communication can turn routine maintenance into a catastrophic event. The lessons learned from this still underpin today’s safety regulations and reinforce why robust CoW systems are essential. |
In their paper, Jamie Henderson, Neil Hunter and David Embrey highlight some common Human Factors (HF) issues with CoW systems that they have observed in their consultancy work. This blog focuses primarily on one important Cow system – Isolation Management. summarising issues across the main phases of isolation: planning, equipment preparation and installation, confirming and maintaining isolation, and reinstatement.
Examples of HF issues during the maintenance and reinstatement process
| Planning | Preparation and installing the isolation | Confirming and maintaining isolation | Reinstating the plant |
| • Own isolation • Challenges with identifying failures when planning • Possible variations from isolation standards | • Expectations on isolation methods | • Second checks • Dependency on checking processes • Purpose and clarity of second check • Handover | • Misapplication of locks in the field • Emphasis on importance of reinstatement |
HF issues during planning
The planning process involves preparing documents such as permits and isolation certificates, assessing risks and determining the required isolation
For simpler isolations, it is possible that there may be a single individual responsible for planning and installing the isolation (own isolation). Although this is efficient, it can create risks as any failures that occur can only be recovered by that same individual.
Other issues that can arise during this time are undetected errors and normalisation of deviations. If a valve is misidentified during the planning process it could affect the isolation. If there are problems with plant (e.g. design flaws or passing valves)this can lead to the need for workarounds, which, if the problems are not addressed, can become the exception rather than the norm.
HF issues related to preparing equipment and installing the isolation
Once planning is complete, the team prepares equipment for intrusive work, by carrying out actions such as draining, venting, purging, and installing the isolation.
At this stage, clarity on the expected isolation method is vital. Double Block and Bleed (DBB) is often considered best practice, short of a positive isolation, but practical implementation can vary in important ways. For example, only proving that the outboard isolation valve holds is quicker than proving both the inboard and outboard valves, and ultimately looks the same, but may result in a lower standard of isolation if the inboard valve is passing. Therefore, expectations around isolation standards should be explicit, clearly communicated, and realistically supported with adequate time and resources.
HF issues related to confirming and maintaining the effectiveness of isolation
Before intrusive work begins, the system must be confirmed to be safe. Many organisations now require an independent check of isolations, which can be a valuable safeguard, if applied well.
The second checker should, as far as possible, be independent from the person that performed the original task (e.g. by being from a different job role, or carrying out the check at a different time). The purpose of the check also needs to be clear. Too often, the expectations for providing a second signature are ambiguous. It can be interpreted as everything from acknowledging awareness that the task has been completed (e.g. following verbal feedback from the person that did the task) to confirming that the checker has visited the equipment in the field and carried out their own visual inspection.
Senior Consultant Dominic Furniss has written a dedicated blog on this subject, which you can view here.
HF issues during reinstatement
Once maintenance is complete, isolations must be removed and the system reinstated. This stage often receives less attention than preparation, but its consequences can be just as, or more, significant. Preparation tends to be prioritised because failures at this stage have immediate safety consequences for the technician breaking containment, inadvertently breaking into a live system. Failures in reinstatement, on the other hand, may have less immediate risks for the operating team, but can create the conditions for the release of a Major Accident Hazard (e.g. if leak tests are inadequate).
Conclusion
CoW processes are an important tool in risk reduction. However, care must be taken in their implementation to prevent them becoming overly complex. Multiple overlapping systems, permits, isolation certificates, risk assessments, lock registers, can bury critical steps in paperwork. In the worst cases, this can lead operators to seek shortcuts or reclassify tasks to avoid the burden, ultimately undermining safety.
When Human Factors are embedded from the start, CoW systems become more than just paperwork. They become living systems that support safe and efficient work, reduce the likelihood of error, and strengthen organisational performance. The key is to maintain balance by keeping them clear, proportionate, and trusted, so that people use them as intended, not work around them.
Want to learn more? You can download and read the full paper here.
Looking for expert Human Factors support? Explore how our consultancy services can help improve your system and embed Human Factors best practices here.
