ISO 45001 and High-Risk Maintenance: Are Lockout/Tagout Controls Actually Effective?

The machine is switched off. The maintenance permit is signed. A lock is attached to the isolation point. But has every hazardous energy source actually been controlled?

This question exposes one of the most serious challenges in industrial maintenance safety.

Manufacturing facilities depend on maintenance activities to keep machinery, utilities and production systems operating reliably. These activities may involve electrical equipment, rotating machinery, hydraulic systems, pneumatic circuits, pressurized vessels, elevated equipment and stored mechanical energy.

Maintenance personnel may need to enter guarded areas, remove protective covers, access moving components or work directly on equipment that normally operates under hazardous conditions.

In such situations, preventing unexpected energization, startup or the release of stored energy can be essential to protecting workers.

Lockout/tagout, commonly known as LOTO, is one widely recognized approach to controlling hazardous energy during relevant servicing and maintenance activities.

However, the presence of a lock, tag or completed permit does not automatically demonstrate that energy isolation is effective.

Hazardous energy may remain in electrical circuits, hydraulic accumulators, pneumatic systems, springs, elevated loads, thermal equipment or other components.

Isolation points may be incorrectly identified. Multiple energy sources may be overlooked. Contractors may misunderstand equipment boundaries. Verification may be performed inadequately.

For organizations implementing ISO 45001 lockout tagout controls, the central issue is whether hazardous energy risks are effectively managed, rather than whether the required forms have been completed.

A signed isolation checklist is evidence of an activity. It is not, by itself, proof that the equipment is in a safe condition.

What Is Lockout/Tagout in Industrial Maintenance?

Lockout/tagout refers to arrangements used to prevent hazardous energy from causing unexpected equipment operation or energy release during relevant servicing and maintenance activities.

Lockout generally involves securing an energy-isolating device in a safe position using an appropriate locking arrangement.

Tagout involves applying a warning or identification device to communicate that equipment must not be operated or energized.

The specific use and legal status of lockout and tagout depend on applicable requirements.

In some jurisdictions, a tag alone may not provide an equivalent level of protection to a lock where lockout is required or feasible.

Organizations should determine suitable controls based on their equipment, risk assessments, operating conditions and applicable legal obligations.

Effective hazardous-energy control may also require identifying all energy sources, dissipating stored energy, preventing reaccumulation and verifying isolation before work begins.

Why High-Risk Maintenance Requires Special Attention

Maintenance work often differs from normal production activities.

During routine operations, equipment guarding, interlocks and automated controls may limit worker exposure to hazardous machinery.

Maintenance activities may require these protective arrangements to be opened, removed or temporarily modified under controlled conditions.

Workers may enter areas where unexpected movement or energy release could cause serious injury.

Examples include:

• Cleaning or repairing industrial mixers
• Replacing conveyor components
• Servicing hydraulic presses
• Repairing electrical distribution equipment
• Maintaining pneumatic machinery
• Working on pressurized systems
• Clearing equipment jams
• Servicing automated robotic equipment
• Maintaining machinery with elevated or suspended components

These tasks require controls appropriate to the actual hazards involved.

Organizations should not assume that stopping the equipment through its normal operating controls is sufficient.

1. Switching Off a Machine Is Not the Same as Isolating Energy

One of the most important distinctions in maintenance safety is the difference between stopping equipment and isolating hazardous energy.

A normal stop button may interrupt an operating command without physically isolating all energy sources.

For example, an electrically powered machine may stop moving when the operator presses the stop button.

However, electrical power may remain available to the control system or drive equipment.

Depending on the equipment design, unexpected operation may still be possible.

Similarly, an emergency stop is generally intended to respond to hazardous operating conditions. It should not automatically be treated as a substitute for an appropriate energy-isolation arrangement.

The necessary controls depend on equipment design, the task being performed and applicable requirements.

The absence of movement does not establish the absence of hazardous energy.

2. Hazardous Energy Is Not Limited to Electricity

Electrical isolation is important, but industrial equipment may contain multiple forms of hazardous energy.

Maintenance risk assessments should consider relevant sources and stored-energy conditions.

Electrical Energy

Electrical circuits, capacitors, batteries and other components may retain or supply hazardous electrical energy.

Mechanical Energy

Rotating components, compressed springs, tensioned belts and moving assemblies may create hazards even after a machine stops.

Hydraulic Energy

Pressurized hydraulic systems and accumulators may retain energy capable of producing unexpected movement or fluid release.

Pneumatic Energy

Compressed air systems may remain pressurized after equipment shutdown.

Thermal Energy

Hot surfaces, steam systems and heated process equipment may retain hazardous temperatures.

Gravitational Energy

Elevated machine parts, suspended loads and raised equipment components may move unexpectedly if not adequately supported or restrained.

Chemical and Process Energy

Some equipment may contain hazardous substances, reactive materials or process conditions requiring additional isolation and control arrangements.

A reliable maintenance isolation process should consider the actual energy sources associated with the equipment and task.

3. Stored Energy: The Hazard That Remains After Shutdown

Stored energy can create serious hazards even after an external energy supply has been isolated.

Consider a hydraulic press that has been disconnected from its electrical power source.

The equipment may still contain hydraulic pressure.

If maintenance work exposes components to this pressure, an unexpected release may occur.

Similarly, a raised mechanical assembly may retain gravitational potential energy.

A compressed spring may remain capable of sudden movement.

Appropriate control arrangements may involve releasing, restraining, blocking, supporting or otherwise safely controlling stored energy.

The methods must be appropriate to the equipment and performed by competent, authorized personnel in accordance with approved procedures.

Organizations should not assume that electrical isolation alone eliminates all maintenance hazards.

4. Why Isolation Verification Matters

Energy isolation arrangements should include appropriate verification that the intended hazardous-energy controls are effective.

The verification method depends on the equipment, task and type of energy involved.

For example, suitable verification may involve checking the effectiveness of isolation using equipment-specific methods established by competent personnel.

Electrical verification requires appropriate electrical safety procedures and suitable test instruments.

Mechanical, hydraulic, pneumatic and other energy sources may require different verification methods.

Organizations should not rely on a generic checklist that assumes one verification method is suitable for every machine.

Verification should also consider whether energy can accumulator or be introduced from another source during maintenance.

An isolation arrangement should be evaluated by its ability to control hazardous energy, not merely by whether a lock is visibly attached.

5. Multiple Energy Sources and Complex Equipment

Modern industrial machinery may have several interconnected energy sources.

An automated production line may include electrical drives, pneumatic actuators, hydraulic equipment, stored mechanical energy and interconnected control systems.

Maintenance personnel may focus on the primary electrical supply while overlooking secondary energy sources.

Additional challenges may arise when equipment is connected to shared utilities or when several machines operate as an integrated system.

For example, isolating one conveyor motor may not control adjacent powered equipment capable of creating movement or exposing workers to hazards.

Organizations should evaluate equipment boundaries and interactions when developing maintenance controls.

Illustrative Hazardous-Energy Assessment Matrix

This table is illustrative and does not replace equipment-specific risk assessments or approved technical procedures.

6. Group Maintenance: Who Controls the Isolation?

Complex maintenance work may involve multiple workers, departments or contractors.

For example, an electrical technician, mechanical fitter and external maintenance specialist may work on the same equipment during a shutdown.

The organization should establish arrangements that protect each exposed worker and coordinate the activities appropriately.

Depending on applicable requirements and equipment arrangements, this may involve individual locks, group isolation systems, designated responsibilities and controlled handover procedures.

Important questions include:

• Who is authorized to establish the isolation?
• How are all affected workers informed?
• How is individual protection maintained?
• How are changes in personnel managed?
• How is isolation maintained during shift changes?
• Who verifies that work is complete before restoration?
• How are contractors integrated into the arrangements?

The organization should avoid relying on informal assumptions about who is responsible for isolation.

7. Contractor Maintenance: Coordination Is a Critical Control

External maintenance contractors may bring specialist technical expertise.

However, they may not be familiar with the facility’s equipment, utilities, operating conditions or internal safety arrangements.

ISO 45001:2018 Clause 8.1.4.2 addresses contractor-related OH&S arrangements, while Clause 8.1.4.3 addresses outsourcing.

Organizations should coordinate relevant activities and manage OH&S risks associated with contractor work.

For example, a contractor may believe that a machine has been fully isolated because the main electrical supply is disconnected.

However, the equipment may remain connected to a shared pneumatic system.

If responsibilities and isolation boundaries are unclear, hazardous conditions may remain.

Suitable arrangements may include:

• Communicating equipment-specific hazards
• Clarifying isolation responsibilities
• Coordinating permit-to-work arrangements where appropriate
• Confirming competence and authorization
• Verifying relevant controls before work
• Managing changes in work scope
• Controlling restoration and handover

Contractor engagement does not automatically eliminate the organization’s own responsibilities under applicable OH&S requirements.

8. Permit-to-Work and LOTO: Related but Different Controls

Permit-to-work systems may be used to authorize and coordinate certain high-risk activities.

However, a permit and an energy-isolation arrangement serve different purposes.

A permit may document the work scope, hazards, precautions, responsibilities and authorization conditions.

Lockout/tagout and other energy-control measures address the prevention of hazardous energization or energy release.

Where both are used, the organization should ensure that the arrangements are coordinated.

A permit should not be treated as proof that isolation has been correctly established unless the necessary checks have actually been performed.

Similarly, applying a lock does not automatically address every hazard associated with the maintenance task.

Additional controls may be needed for confined spaces, work at height, hot work, chemical exposure or other relevant risks.

9. A Practical Industrial Scenario: Unexpected Conveyor Movement

Consider a hypothetical manufacturing facility where maintenance personnel are replacing a damaged conveyor component.

The conveyor has been stopped and the maintenance permit has been approved.

A lock has been applied to the main motor isolation point.

However, the maintenance team has not fully evaluated the interaction between the conveyor and an adjacent automated transfer system.

During the work, the adjacent equipment initiates movement that creates a hazardous condition in the maintenance area.

The investigation identifies several weaknesses:

• The equipment boundary was not adequately defined.
• Interconnected machinery hazards were not fully considered.
• The isolation procedure did not reflect the actual system configuration.
• Verification focused only on the primary motor.
• Maintenance personnel relied on the completed permit as evidence of safety.

The scenario demonstrates how a documented isolation process may be insufficient when it does not reflect actual equipment interactions.

The appropriate corrective actions would depend on the verified causes and relevant technical requirements.

Potential actions could include reviewing equipment-specific procedures, improving hazard identification, clarifying responsibilities and strengthening verification arrangements.

10. What Does ISO 45001 Require for Operational Control?

ISO 45001:2018 includes requirements for hazard identification, assessment of OH&S risks, planning actions and operational control.

Clause 8.1 addresses operational planning and control.

Clause 8.1.2 addresses eliminating hazards and reducing OH&S risks through the hierarchy of controls.

Clause 8.1.4 addresses procurement, contractors and outsourcing.

These requirements provide a management system framework for establishing and maintaining suitable controls.

However, ISO 45001 does not provide a universal equipment-specific lockout/tagout procedure.

Organizations should determine relevant technical requirements from applicable legislation, regulatory guidance, equipment information, recognized standards and their own risk assessments.

11. Applying the Hierarchy of Controls to Maintenance Safety

The hierarchy of controls provides a structured approach to eliminating hazards and reducing OH&S risks.

Maintenance planning should consider whether hazards can be eliminated or risks reduced through engineering and other suitable controls.

For example, equipment may be designed to allow certain inspections or adjustments without exposing workers to hazardous moving parts.

Where exposure cannot be eliminated, appropriate isolation and other controls may be necessary.

Administrative measures such as procedures, permits and training can support risk management, but they should not be used as substitutes for necessary physical or engineering controls.

Personal protective equipment may provide additional protection against certain hazards but does not itself eliminate hazardous energy.

12. Competence and Authorization: Can Workers Apply the Controls Correctly?

Effective hazardous-energy control depends on the competence of personnel performing relevant activities.

Workers should understand the hazards associated with the equipment and their assigned responsibilities.

Organizations should consider whether training and competence arrangements cover:

• Recognition of relevant hazardous energy sources
• Understanding of equipment-specific procedures
• Roles and responsibilities
• Appropriate isolation and verification methods
• Stored-energy hazards
• Group maintenance arrangements
• Contractor coordination
• Restoration and handover requirements
• Actions required when conditions differ from the approved work plan

Training attendance records may provide evidence of training delivery.

However, competence should be evaluated through suitable methods relevant to the work and associated risks.

13. Change Management: When Old Isolation Procedures Become Unsafe

Industrial equipment and operating arrangements change over time.

Machines may be modified, control systems upgraded, additional utilities connected or production lines reconfigured.

These changes can affect hazardous-energy sources and isolation arrangements.

For example, an automated packaging line may receive an additional pneumatic actuator.

If the isolation procedure is not reviewed, maintenance personnel may continue using instructions that do not account for the new energy source.

ISO 45001:2018 Clause 8.1.3 addresses management of change.

Organizations should evaluate relevant changes and their effects on OH&S performance.

Maintenance isolation arrangements should be reviewed when changes affect equipment hazards or required controls.

14. What Should an ISO 45001 Auditor Examine?

An auditor should evaluate whether the organization’s hazardous-energy controls are suitable, implemented and effective in relation to the applicable requirements.

Reviewing signed LOTO checklists alone may not provide sufficient evidence.

Maintenance Energy Isolation Audit Matrix

This matrix is an illustrative auditing aid and does not replace technical inspection requirements or applicable legal obligations.

15. Leading Indicators for Hazardous-Energy Control

Organizations should avoid evaluating maintenance safety solely through injury statistics.

A period without incidents does not automatically demonstrate that hazardous-energy controls are effective.

Useful indicators may include:

• Completion of relevant isolation procedure reviews
• Results of field verification activities
• Identification of outdated isolation instructions
• Completion of relevant competence evaluations
• Contractor coordination findings
• Reported isolation-related near misses
• Corrective-action effectiveness
• Verification of controls following equipment modifications

These indicators should be interpreted alongside actual operational conditions and risk information.

16. Common Lockout/Tagout Management Mistakes

Mistake 1: Treating the Stop Button as an Isolation Device

Stopping equipment does not necessarily isolate all hazardous energy sources.

Mistake 2: Focusing Only on Electrical Energy

Mechanical, hydraulic, pneumatic, thermal and gravitational energy may also create hazards.

Mistake 3: Overlooking Stored Energy

Hazardous energy may remain after external supplies have been disconnected.

Mistake 4: Using Generic Procedures for Complex Equipment

Isolation arrangements should reflect relevant equipment configurations and hazards.

Mistake 5: Failing to Verify Isolation

Applying a lock is not equivalent to confirming that relevant energy hazards are controlled.

Mistake 6: Unclear Group Maintenance Responsibilities

Multiple workers require appropriately coordinated protection and responsibilities.

Mistake 7: Poor Contractor Coordination

External personnel may be unfamiliar with site-specific hazards and isolation boundaries.

Mistake 8: Treating Permits as Proof of Physical Safety

Work authorization should be supported by actual implementation and verification of required controls.

Mistake 9: Failing to Update Procedures After Equipment Changes

Modifications may introduce new energy sources or alter isolation arrangements.

Mistake 10: Measuring Safety Only Through Incident Counts

Preventive verification and control effectiveness are important considerations.

17. How to Strengthen Hazardous-Energy Control

Step 1: Identify High-Risk Maintenance Activities

Determine which tasks expose workers to hazardous energy.

Step 2: Assess Relevant Energy Sources

Consider primary, secondary and stored energy associated with equipment and tasks.

Step 3: Establish Suitable Equipment-Specific Controls

Develop arrangements consistent with applicable requirements and equipment characteristics.

Step 4: Define Responsibilities

Clarify authorization, coordination and relevant worker protection arrangements.

Step 5: Establish Appropriate Verification Methods

Ensure isolation effectiveness is confirmed using suitable methods performed by competent personnel.

Step 6: Coordinate Contractors

Communicate relevant hazards and establish clear interfaces between site personnel and external providers.

Step 7: Manage Equipment Changes

Review isolation arrangements when modifications affect equipment or associated risks.

Step 8: Evaluate Competence

Confirm that relevant personnel can perform assigned activities safely.

Step 9: Verify Controls in Practice

Use appropriate inspections, audits and field evaluations to identify weaknesses.

Step 10: Improve Based on Evidence

Investigate incidents, near misses and control failures, then evaluate the effectiveness of necessary corrective actions.

18. ISO 45001 Maintenance Isolation Readiness Checklist

1. Have relevant hazardous-energy sources been identified?
2. Are high-risk maintenance activities appropriately assessed?
3. Are equipment-specific controls established where necessary?
4. Are stored-energy hazards considered?
5. Are appropriate isolation verification arrangements defined?
6. Are relevant workers competent and authorized?
7. Are group maintenance activities coordinated?
8. Are contractors integrated into relevant work-control arrangements?
9. Are procedures reviewed following equipment changes?
10. Are isolation-related incidents and near misses investigated?
11. Are corrective actions evaluated for effectiveness?
12. Can the organization demonstrate that controls work in actual maintenance conditions?

Frequently Asked Questions

What is lockout/tagout in industrial safety?

Lockout/tagout refers to arrangements used to prevent unexpected equipment energization, startup or hazardous energy release during relevant servicing and maintenance work.

Does ISO 45001 require lockout/tagout?

ISO 45001 requires organizations to manage OH&S hazards and risks through suitable controls. It does not prescribe one universal LOTO procedure for all workplaces. Specific requirements may arise from applicable legislation and technical standards.

Which ISO 45001 clause relates to maintenance safety?

Relevant provisions include hazard identification and risk assessment, operational planning and control under Clause 8.1, elimination of hazards and reduction of risks under Clause 8.1.2, management of change under Clause 8.1.3 and contractor-related requirements under Clause 8.1.4.

Is switching off equipment sufficient for safe maintenance?

Not necessarily. Stopping equipment may not isolate hazardous energy or control stored-energy hazards.

What is stored energy?

Stored energy is energy retained within equipment or systems that may create hazards after normal operation has stopped, such as hydraulic pressure, compressed air, spring tension or elevated loads.

Why is isolation verification important?

Verification helps establish whether the relevant energy-isolation arrangements are effective before hazardous maintenance activities proceed.

Can a permit-to-work replace lockout/tagout?

A permit-to-work may support authorization and coordination, but it does not automatically replace necessary hazardous-energy controls.

How should contractors be included in LOTO arrangements?

Organizations should establish appropriate coordination, hazard communication, responsibilities and verification arrangements consistent with the work and applicable requirements.

What should an ISO 45001 auditor examine during a LOTO audit?

Relevant evidence may include risk assessments, equipment-specific procedures, competence arrangements, contractor coordination, management of change and implementation of actual energy controls.

Does a zero-incident record prove effective energy isolation?

No. Incident statistics alone do not establish that hazardous-energy controls are suitable or consistently implemented.

How Shark Certification Can Support ISO 45001 Management System Improvement

High-risk maintenance activities require effective hazard identification, appropriate operational controls, competent personnel and reliable coordination.

Organizations implementing ISO 45001 can evaluate whether their management systems adequately address hazardous-energy risks, contractor interfaces, management of change and the effectiveness of maintenance safety arrangements.

Shark Certification supports organizations through management system auditing, training and related management system services.

Relevant assessment activities may include reviewing OH&S risk management, operational controls, contractor arrangements, internal audit effectiveness and corrective-action processes.

For more information about ISO 45001 management system requirements and audit readiness, visit Shark Certification.

Conclusion: A Lock Is Not Proof of Effective Isolation

Lockout/tagout can be an important part of industrial maintenance safety.

However, a lock, tag or completed permit does not automatically establish that hazardous energy has been controlled.

Organizations should evaluate the actual energy sources, equipment configuration, stored-energy conditions, worker responsibilities and verification arrangements associated with maintenance work.

ISO 45001 provides a management system framework for identifying hazards, reducing OH&S risks and evaluating operational controls.

Effective implementation requires attention to what happens in the workplace, not only what appears in procedures and records.

The question is not whether the isolation checklist was signed.

The question is whether every relevant hazardous-energy risk was appropriately controlled before work began.