Group Lockout at Shift Change: OSHA Handover Guide

The dangerous moment is the gap between crews

A line has been isolated for an overnight repair. The day crew wants to leave, and the evening crew is arriving. The primary isolators are still locked, but several personal locks are coming off a group box. Someone says the next team knows the job. That statement does not establish who is protected during the transfer, whether the incoming workers have attached their own devices, or whether the group coordinator has checked everyone's exposure status. The risk is a brief gap in protection that is hard to see in a written work order.

Under 29 CFR 1910.147, group servicing within this general-industry rule must provide protection equivalent to a personal lockout or tagout device. The rule calls for an authorized employee with primary responsibility for the group, a way to determine the exposure status of individual members, coordination when several crews are involved, and each authorized worker's personal device on the group mechanism while that worker performs the work. It also requires specific procedures for shift or personnel changes so protection continues through an orderly transfer. The rule's scope expressly excludes construction and agriculture employment, several maritime settings and electrical-hazard work covered by the specified electrical rules. Do not transfer this article's legal wording into those settings without checking the governing standard.

This page addresses that transfer decision. The existing lockout/tagout guide covers scope, energy sources, isolation, training and the broader return-to-service sequence. A handover procedure cannot repair a faulty isolation plan. The machine must already be under a correct, verified energy-control procedure. If the work or machine changes at the handover, reassess the isolation rather than merely exchanging names on a permit.

Define the handover outcome before the shift ends

At the end of the transfer, the employer should be able to answer four questions. Which authorized person coordinates the group now? Which workers are exposed and have their personal protection in place? Which isolating devices and stored-energy controls remain effective? Who can authorize any later test or return to service? If any answer is uncertain, do not treat the handover as complete. A sign-off line cannot prove continuous protection on its own.

The regulation sets performance requirements and specific group elements. It does not prescribe a universal lockbox brand, one fixed paperwork form or a single overlap schedule for every facility. The employer's procedure must fit the equipment and work, and competent authorized employees must apply it. The examples here are implementation patterns, not new wording added to OSHA's rule.

Keep group control and personal protection distinct

A group lockbox can hold keys or provide a comparable mechanism that secures isolating devices. The lead or primary authorized employee may manage the overall isolation. That does not mean one lead lock protects everyone automatically. OSHA's group provision requires each authorized employee to attach a personal lockout or tagout device to the group device, lockbox or comparable mechanism when work begins, then remove that device when the worker stops work on the equipment.

This distinction matters during shift change. The outgoing mechanic's device should not be treated as a substitute for the incoming mechanic's protection. Nor should an incoming person's signature on a work order be treated as the same as a personal device. The procedure must establish how the incoming worker becomes protected before starting exposure, and how outgoing workers leave without weakening protection for those who remain. At every point, the primary isolators and group mechanism must remain controlled under the equipment procedure.

The authorized coordinator needs a reliable account of who is still exposed. A group roster can support that, but the roster should reflect the actual personal devices and work location. If a worker is inside a machine but the roster shows that person's lock removed, stop and resolve the discrepancy. If a lock remains but the person has left, do not assume it can be cut for convenience. The rule's device-removal exception has its own strict process.

A site may use several of these controls in a different physical arrangement. The questions still apply. The exact mechanism should be designed and reviewed by people competent in the equipment and standard.

Prepare the incoming team before anyone removes protection

An effective handover begins before the end of the shift. The outgoing coordinator should identify the exact machine, location and procedure revision; the isolation points; any stored energy or reaccumulation concern; the current work state; temporary equipment changes; and each person still exposed. The incoming coordinator should have time to review the procedure and the physical state. A rushed five-minute exchange near production startup creates pressure to accept vague statements such as everything is locked out.

The incoming team needs to know whether testing or positioning occurred during the prior shift. Under OSHA's rule, a temporary test that required device removal and energization follows a controlled sequence and must end with deenergization and reapplication of controls before servicing resumes. The incoming crew should not rely on a status left from before the test. It should confirm the current safe state and any required verification under the procedure.

Record open work and hazards. Is a guard removed? Is a line open? Is a component supported by a temporary block? Is a contractor working on another part of the same equipment? Are there personal devices from workers who are not physically in the handover meeting? The incoming coordinator must reconcile those facts before accepting control. A list of completed tasks is useful, but the exposure and isolation status is the core of the transfer.

A handover briefing that works

A practical briefing can take the form of a walk-through at the machine or group box. The outgoing coordinator identifies the isolators and group mechanism. Both coordinators compare the device register with the physical devices. The incoming team identifies its workers and their tasks. The group reviews stored-energy controls and any continuing verification. Then the incoming authorized workers attach their personal devices before they begin exposed work under the site procedure. The outgoing workers remove theirs only when their own work has stopped and the continuity plan permits it.

This is an example of a controlled pattern, not an OSHA-prescribed order of signatures for every site. A particular system may require an operations lock, designated transfer lock or another engineered arrangement to maintain continuity. A competent reviewer should confirm that the arrangement gives group members equivalent protection and that the interval between crews never makes the machine available for energization while workers remain exposed.

Transfer coordination without losing isolation

Section 1910.147, paragraph f, item 4 requires specific shift-change procedures that ensure continuity of lockout or tagout protection and orderly transfer between outgoing and incoming employees. A procedure should say what happens if the incoming crew is late, if the coordinator is absent, if one outgoing worker remains on the machine, or if a contractor changes personnel. A process that works only when everyone arrives on time is fragile.

The coordinator should not confuse transfer of job responsibility with removal of an individual's device. Each authorized worker remains responsible for their own personal device while working. If the procedure uses a group box, define who controls the box, how keys to primary isolators remain secured, what devices must be in place before a worker enters the hazard area and how exposure status is checked. If more than one department is involved, OSHA calls for one designated authorized employee to coordinate the affected workforces and continuity.

A written shift checklist might include the isolation verification reference, group-device status, outgoing and incoming personnel, unfinished tasks, stored-energy risks, contractor names and acceptance time. It should record exceptions plainly. Do not let every field default to complete because the outgoing coordinator is eager to leave. The most useful entry may be hold: missing incoming electrician's lock or pressure status unclear. A hold preserves the distinction between an incomplete handover and a released machine.

Late-arriving replacement case

The incoming mechanic is delayed. The outgoing mechanic has finished work and wants to remove a personal lock. Other workers remain exposed under the group procedure. The coordinator should assess whether the outgoing worker's removal is consistent with the procedure and whether remaining workers continue to have full protection. The replacement must attach a personal device before starting the repair. Do not pretend the delayed worker is protected by a name on the schedule, and do not strip all outgoing devices just because the clock shows shift end. The equipment's primary isolation remains controlled throughout.

Handle contractors and multiple crews as one exposure picture

A plant mechanic, electrical contractor and cleaning contractor may all work on the same production line. The host and outside employers must inform each other of their energy-control procedures under 1910.147's outside-personnel provision. The host must ensure its employees understand and comply with restrictions and prohibitions in the contractor's program. Group provisions add coordination across crews. Handover cannot be limited to the host maintenance roster if a contractor remains exposed.

Before a contractor's crew changes, identify who has personal devices attached, whether the replacement workers are authorized under their employer's procedure, and whether a contractor supervisor is also transferring responsibility. Agree which person coordinates the whole job and how exposure status is communicated. The contractor's padlock color is less important than a system that identifies the applying worker and prevents loss of protection. Avoid a shortcut where one contractor lead device is used to stand in for all authorized workers without a reviewed group method that satisfies OSHA.

Information must reach affected operations staff too. They may see outgoing maintenance personnel leave and assume the equipment can be restarted. The employer's energy-control procedure and notification provisions should make the machine's unavailable status clear. A production schedule or electronic ticket should not override physical controls. If the site uses a control-room permit, reconcile it with the group devices and machine state before release.

Mixed-crew case

A host mechanical crew ends at 18:00. An outside electrical worker continues until 20:00, and an incoming host team starts at 18:30. The outgoing host coordinator should not close the whole isolation at 18:00. The designated authorized coordinator must know the electrician remains exposed, preserve the group protection and transfer oversight to an incoming authorized person. The incoming host workers attach personal devices before starting. When the electrician finishes, that worker removes their own device under the agreed process. Only after every exposed worker has stopped and the release checks are satisfied should restoration be considered.

What if a personal lock remains after a worker leaves?

The normal rule is that the employee who applied a lockout or tagout device removes it. OSHA permits a documented employer-directed exception when that employee is not available, but only with specific procedures and training. The employer must verify that the person is not at the facility, make all reasonable efforts to contact the person about removal, and ensure the person knows before resuming work at the facility. A missing worker at handover is therefore not an invitation to use bolt cutters.

First determine whether the worker might still be exposed, working elsewhere on the machine or on a break. Check the job and worker status through the established process. If the authorized person is available, the usual personal removal rule applies. If not, use only the documented exception with all required checks, and keep the isolation until the equipment can be released safely. Record the reason and steps taken. Do not use a supervisor's rank as a substitute for the regulatory conditions.

A lock that remains may reveal a roster failure. Did the worker forget to sign out, or did a second department add work without telling the coordinator? Resolve the underlying information problem. A repeated pattern of unexplained devices suggests the group procedure needs revision and retraining. Treat the device as a safety signal until proven otherwise.

Absent-worker case

At 19:00, the group box holds a lock belonging to a day-shift fitter. The incoming coordinator cannot see that person, but the fitters' supervisor says the worker probably went home. Probably is insufficient. Follow the documented removal procedure. Confirm that the worker is not at the facility, make reasonable contact efforts and ensure the worker learns of the removal before returning. Check that no one else is exposed and that release conditions are met. The issue may delay restart; that is better than erasing a person's protection on an assumption.

Recheck stored energy and any changed work

A long outage can change the energy state. Pressure can reaccumulate behind a leaking valve. A suspended load can shift. A temporary support can be moved. Under 1910.147's stored-energy and verification provisions, potentially hazardous stored energy must be rendered safe, and where reaccumulation is possible, verification continues until the work ends or the risk ceases. The handover should state what was checked and what ongoing monitoring is required under the equipment procedure.

If incoming workers plan a task that was not in the original isolation plan, the coordinator must assess whether the existing controls cover it. An isolation adequate for belt replacement may not protect electrical testing or line breaking. Add qualified people and revised controls before that new work starts. Do not let a permit's broad wording such as maintenance covers all possible activity on the machine.

Temporary test cycles are especially important. A machine may have been energized briefly after outgoing workers left the danger area. The incoming crew should verify whether controls were reapplied and the machine is again safe for servicing. A verbal account of tested okay does not establish current isolation. Use the documented sequence and record the handover status of each source.

Decide when the machine may return to service

A completed handover is not a release for production. It transfers responsibility for continuing protected work. Final return to service follows the release provisions of 1910.147: inspect the machine and work area, remove nonessential items, confirm components are intact, position or remove employees safely, remove devices through the proper process and notify affected employees after device removal and before startup. A planned start time should never be treated as proof that these steps are complete.

The coordinator should check every authorized worker and personal device, every contractor and every related work permit. A worker may have moved to the other side of the equipment or may still be inside a guarded zone. If the count and physical state disagree, retain control until resolved. Only competent authorized people should undertake the equipment-specific restoration and testing steps. The guide cannot tell a particular site how to energize a machine safely.

A good closeout record links the isolation, group roster, handover entries, test cycles, outstanding defects and final release. It makes it possible to reconstruct whether continuous protection was maintained. If the record shows a period with no designated coordinator or an unexplained device change, investigate and improve the procedure. Do not silently edit times to make the log look tidy.

Use a handover record as evidence, not as the control itself

The record should serve the physical protection system. It can show the equipment identifier, procedure revision, isolator status, primary coordinator, incoming and outgoing authorized workers, personal-device status, contractors, stored-energy concerns, unfinished work, verification performed and time of acceptance. Give each field an owner. A digital workflow can make missing entries visible, but a completed screen cannot substitute for a locked isolator or worker's personal device.

Build the record for the work, not for a score. A handover field that permits not applicable without a reason can conceal a missing contractor or pressure check. A supervisor should periodically observe handovers and compare the written record with locks, people and machine condition. Discrepancies may call for retraining or procedure revision under OSHA's broader program duties.

Keep Complys claims within verified capabilities

The existing lockout/tagout guide is the broader informational owner. The US OSHA compliance page is the commercial destination for exploring Complys. This guide does not claim that Complys physically isolates equipment, verifies zero energy, counts workers at a group box, approves lock removal or legally certifies a handover. Ask for a demonstration of any procedure, assignment or reminder function before relying on it.

The immediate next step is to watch one real shift transfer under the site procedure. Confirm that every exposed incoming worker has personal protection before work begins, that outgoing workers remove only their own devices under the procedure, and that the designated coordinator knows all remaining people and energy controls. If the process depends on assumptions or memory, revise it with authorized staff and equipment specialists. Continuity at the handover is the outcome, not the number of signatures collected.