Canceled Confined Space Permits: Retention and Program Review

The entry is over. Workers have left the space, the supervisor has closed the job and the permit is no longer active. The canceled permit still has a job to do. Under the federal OSHA general-industry permit-required confined-space standard, an employer retains canceled entry permits and uses them to review whether its permit-space program protects employees. Problems encountered during an entry belong on the pertinent permit so the review has something more useful than a stack of signed forms.

This is a post-entry guide for employers whose general-industry work is covered by 29 CFR 1910.146. It does not decide whether a particular tank, vault or pit is a permit space. It does not tell an entry supervisor to declare a hazardous space safe. Those decisions require the employer's actual hazard evaluation, entry controls, monitoring and rescue arrangements. Construction, agriculture and shipyard employment fall outside the scope of this specific standard. A live Complys guide to confined spaces in construction covers the separate construction framework. Do not apply this general-industry retention rule to a construction permit without checking the rule that actually governs that work.

Why the permit is more than an entry ticket

An entry permit records the conditions and authorisation for a particular permit-space entry. The employer's written permit-space program sets the wider system. Section 1910.146 requires an employer that decides its employees will enter permit spaces to develop and implement the written program. The program includes a system for preparing, issuing, using and canceling permits. The permit is therefore a control during work and evidence after work that the program was followed, or that it needs repair.

The distinction explains why a canceled permit cannot simply be shredded as soon as the entrant exits. A reviewer may need to know whether monitoring showed an unexpected condition, whether a planned control held, whether an attendant had difficulty communicating, or whether entry had to be stopped. The regulation specifically connects retained permits to program review. An apparently routine permit can also reveal a recurring weakness when several entries are viewed together. A single form may show a late cancellation; a sequence of forms may show that the written procedure does not fit how the work is actually scheduled.

An employer should identify which records are formal entry permits under its program and which are related worksheets, test records or contractor documents. The legal retention statement below applies to each canceled entry permit under section 1910.146. It does not by itself establish one federal retention term for every associated record, nor does it replace other recordkeeping rules that may apply to exposure or medical information. Keep the record groups distinguishable so a one-year permit schedule is not accidentally used to discard another record with a different duty.

Know when the entry supervisor must cancel

Section 1910.146, paragraph e5 gives two cancellation triggers. The entry supervisor must terminate entry and cancel the entry permit when the entry operations covered by the permit have been completed. The same action is required when a condition not allowed under the permit arises in or near the permit space. These are different reasons for closing a permit, and the employer's records should preserve which one occurred.

A completed job does not mean a permit remains open until someone gets around to filing it. The permit authorised the defined entry, for its defined task and time. Once that work is complete, the supervisor terminates the entry and cancels the permit. A later return to the same space is a new entry decision under the program, not an automatic extension of the old paper. The standard also limits a permit's duration to the time required to complete the assigned task or job. A team should not use an old permit as a standing authorisation simply because the job name is familiar.

If a condition arises that the permit does not allow, the supervisor terminates entry and cancels the permit. The issue is not solved by marking the form complete while people remain in the space. The employer's procedures for prohibited conditions, entrant exit, rescue and reassessment still matter at the site. This article focuses on the record and review that follow; it is not a substitute for the actual response to a hazardous condition. Preserve the condition and the action taken in the entry record so the later program review can test whether the controls were sufficient.

An administrative signature or digital status should represent the real closeout event. A system can label a permit canceled without proving the entrant left or the entry supervisor acted when required. Conversely, a crew can leave safely but fail to close the formal permit, leaving the record ambiguous. Make the supervisor's cancellation decision and the actual end of entry traceable. A business may choose a required field for time and reason, but section 1910.146 does not prescribe a national software button or one identical closeout template for every workplace.

Retain each canceled permit for at least one year

Section 1910.146, paragraph e6 requires the employer to retain each canceled entry permit for at least one year. The stated purpose is to facilitate the permit-space program review required by paragraph d14. The rule also requires problems encountered during an entry operation to be noted on the pertinent permit so the employer can make appropriate revisions to its program.

At least is important. One year is a minimum under this provision, not a command to delete the document on its first anniversary. A company's broader record-retention policy, a contract, litigation hold or another legal requirement may call for longer retention. This guide does not establish those additional periods. It does establish that routinely deleting canceled permits after a shift, after a monthly audit or when a project folder is closed would not meet the one-year minimum.

The period attaches to canceled entry permits. If a form is still marked open in a system even though the entry ended, the answer is not to start a vague one-year timer while leaving the formal closeout undone. Resolve the status accurately. Keep the canceled permit in a form that a reviewer can retrieve and read, including its legible monitoring, authorisation and closeout information. If the company scans paper, check the whole form, not just the first page. If the company exports from software, check attachments and comments that contain the problems noted during the entry.

An internal register can make retention auditable. Useful fields include space identifier, entry date, permit identifier, entry supervisor, cancellation date and reason, a flag for problems, the location of the retained record and the planned review cycle. Those are suggested employer process fields. The federal rule states the duty to retain and review, not a required national register layout. Avoid inventing an OSHA approval stamp, certificate or electronic feature from this practical suggestion.

Write down problems while they are still clear

Section 1910.146 says that any problems encountered during an entry operation must be noted on the pertinent permit so appropriate program changes can be made. This is not limited to injuries. A prohibited condition, monitoring anomaly, unexpected inflow, communication failure, contractor coordination problem, a change in the work or a difficult rescue arrangement may all be worth describing where they occurred. Whether a particular event demands additional immediate action depends on the event and the program's controls. A later program review cannot see a problem that the permit simply labels normal.

Record facts rather than conclusions that the evidence cannot support. State what changed, when it was discovered, who was told, whether entry was terminated, and what control was applied or revised. If monitoring results matter, preserve the actual results and context. A generic comment such as issue resolved gives little information for the next entry. A detailed comment should still avoid unnecessary personal or medical information in a permit that more people may handle than an incident investigation record.

The note should connect to the permit for the affected entry. A separate investigation or maintenance ticket can carry more detail, but a link or reference should make that detail findable. Otherwise a reviewer examining retained permits might see no reason to revisit the procedure. It is also useful to document a decision that a reported concern was investigated and did not indicate a program deficiency. Explain the basis rather than silently clearing the flag. These are sensible review practices; the core legal requirement is to note encountered problems on the pertinent permit and use them to improve the program where needed.

Do not wait for the annual review if the problem indicates the current controls may fail at the next entry. Paragraph d13 requires the employer to review entry operations when there is reason to believe the measures taken under the permit-space program may not protect employees, and to revise the program to correct deficiencies before subsequent entries are authorised. The rule's note gives examples, including unauthorised entry, a permit-space hazard or prohibited condition not covered by the permit, an injury or near miss, a change in space use or configuration, and employee complaints about program effectiveness.

That immediate-response review is separate from the scheduled review using canceled permits. An employer should not place a near miss in a folder marked discuss next year and continue identical entries without examining whether its program still protects entrants. Conversely, a scheduled review is not only for permits with dramatic failures. Routine permit patterns can also help test whether the program is functioning.

Review the program using the retained permits

Paragraph d14 requires the employer to review its permit-space program using the canceled permits retained under paragraph e6 within one year after each entry, and revise the program as necessary. The note to the paragraph allows a single annual review to cover all entries performed during a 12-month period. It also says that if no entry is performed during a 12-month period, no review is necessary under that paragraph. Do not describe this as an unconditional yearly audit regardless of entry activity.

The review's purpose is to ensure employees participating in entry operations are protected from permit-space hazards. Looking at a single compliance score or checking that every form has a signature would be too narrow if the permits reveal repeated deviations. Compare what the written program required with what the actual permits and problem notes show. Were unacceptable conditions detected? Were permits terminated when they should have been? Were roles and coordination clear? Did permit duration match the assigned job? Were control measures recorded consistently enough to understand what happened? These are review prompts, not a federal checklist that replaces the paragraph's protection test.

Where the review finds a weakness, document the needed change, the person responsible and how the change reaches entry supervisors, attendants and entrants before it matters. The regulation calls for revision as necessary. It does not say every review must produce a rewritten program, nor that a signed no-change decision automatically proves adequacy. A concise, evidence-based conclusion is more useful than a generic review complete notation. Preserve enough detail to show what permits were considered and why the employer concluded its program should stay the same or change.

If an employer carries out multiple entries, plan the review calendar so a combined review covers them within the rule's period. A business with no entry during a 12-month period does not need to manufacture a d14 review for that inactive period, though it still needs to evaluate the workplace and manage any future entry under the applicable program. A long dormant program should be checked against current conditions before entry resumes. That last check is prudent employer process and may be driven by other provisions of section 1910.146, such as evaluating spaces and hazards before entry; it is not an invented annual d14 deadline.

Separate four decisions in the closeout workflow

The easiest way to lose the rule's meaning is to collapse all post-entry work into one closed status. Four distinct decisions deserve separate attention.

| Decision | Owner question | Legal anchor | | --- | --- | --- | | Terminate entry | Has the covered work finished, or has a prohibited condition arisen? | Section 1910.146, paragraph e5. | | Cancel the permit | Has the entry supervisor formally closed the authorisation for that entry? | Section 1910.146, paragraph e5. | | Retain and annotate | Is the canceled permit retrievable for at least one year, with encountered problems noted? | Section 1910.146, paragraph e6. | | Review the program | Do retained permits or warning events show controls that need revision? | Section 1910.146, paragraphs d13 and d14. |

The workflow does not certify a space safe for a new entry. That is a fresh hazard and permit decision under the employer's actual program. Keep the canceled permit as a record of the earlier entry, not as a reusable pass. When a contractor performed the entry, review who the entry employer was and where the pertinent permit is retained. Section 1910.146 contains host and contractor communication duties for permit-space operations. A contract may allocate record exchange, but the employer should not assume a client or contractor has retained the records its own program needs.

One useful closeout check asks the entry supervisor to confirm the reason for cancellation and flag any problem. The record owner then verifies the permit is complete and stored. The program owner reviews flagged events promptly for paragraph d13 and uses retained permits in the paragraph d14 cycle. These roles are a model of employer process; the standard defines entry-supervisor duties and employer duties but does not mandate these three internal job titles or a particular software workflow.

Mistakes that make the archive less useful

Closing a permit only in conversation. The entry may be over, but a retained form that still looks active obscures whether the supervisor canceled it. Make the formal record match the event.

Treating a prohibited condition like normal job completion. The reason for cancellation matters. Preserve the condition, response and any need to review controls before another entry.

Discarding the form after an incident report is filed. An incident report may be valuable, but it does not replace the requirement to retain each canceled entry permit for at least one year.

Leaving problems in a private inbox. If a problem occurred during entry, note it on the pertinent permit. A separate detail record can be cross-referenced rather than left disconnected.

Waiting for a calendar audit despite evidence of a weak control. Paragraph d13 can require review and correction before the next entry. The annual grouping option under d14 does not delay that response.

Calling every site a general-industry site. Construction permit-space work has its own federal framework. Identify the applicable standard before importing this particular canceled-permit rule into a content page, form or customer checklist.

Claiming that retaining permits alone completes review. The rule requires the program to be reviewed using the retained permits and revised when necessary. Storage is a prerequisite for useful review, not the review itself.

The result should be a traceable cycle: authorise and control the entry, cancel for the correct reason, retain the permit and its problem notes, respond promptly to warning events, then use the retained evidence to improve the program. That cycle serves the real objective of section 1910.146, which is protection during the next entry rather than a neat archive for its own sake.

For a broader explanation of written safety programme ownership, see the Complys US written-program guide. Businesses comparing compliance-record systems can visit Complys US and confirm the current features against their own permit and review workflow. This article does not claim that Complys issues, cancels, stores or reviews entry permits automatically.

Related guides

See also: Damaged Extension Cord: OSHA Inspection and Removal Rules, Damaged Ladder at Work: OSHA Shift Inspection and Removal.