Lockout/tagout program template: a US employer framework

A lockout/tagout (LOTO) program is the employer's system for preventing unexpected startup, energization or release of stored energy during servicing and maintenance. Under federal general-industry 29 CFR 1910.147, its central parts are energy-control procedures, employee training and periodic inspections. A one-page statement that “staff will lock out equipment” is not a usable program. The framework below helps an employer define authority, inventory machines, create equipment-specific procedures, train people, inspect the procedures and manage changes.

This is a general-industry starting framework, not a universal US policy. Section 1910.147 expressly excludes construction, agriculture, certain maritime employment and installations under the exclusive control of electric utilities, and it has task-specific scope provisions. Electrical work practices under §1910.333 may apply to exposed electrical parts and require their own checks. Construction electrical circuit tagging is addressed in §1926.417, among other relevant rules. Identify the actual sector, State Plan and work before using this form. The existing Complys US LOTO guide explains the topic; this page has a different task: a fillable employer program and management records. If repository review finds that owner already contains the full operational form, merge it rather than publish a duplicate.

1. Program authority and scope

The program owner should maintain procedures, equipment inventory, training records, devices and annual inspection scheduling. Supervisors must enforce stop-work when a source cannot be isolated or a procedure does not match the actual machine. Authorized employees need the skills to identify energy sources and use the control method; affected and other employees need information appropriate to their roles. Do not declare everyone “authorized” merely because they received a general induction.

2. Scope and exception decision log

Before a job, identify whether employees are servicing or maintaining a machine where unexpected energization, startup or stored-energy release could injure them. OSHA's §1910.147(a) has specific exclusions and limited exceptions, including certain cord-and-plug work controlled by unplugging under the worker's exclusive control and specific minor servicing during normal production if effective alternative protection exists. Do not treat those as broad exemptions for any short job. Evaluate the exact conditions and document the basis with a competent reviewer.

Stop-work condition: If a task involves removing a guard, placing part of the body in a danger zone, clearing a jam, cleaning, setting up or repairing equipment with possible unexpected energy, do not assume normal production safeguarding alone is enough. If someone claims an exception, the reviewer should check each regulatory condition before work begins.

3. Inventory every source of hazardous energy

Hazardous energy is not only electrical. A machine may have mechanical movement, hydraulic or pneumatic pressure, gravity, springs, thermal energy, steam, chemical pressure or stored electrical charge. More than one feed or stored source may exist. Record the actual asset and source, its isolation device, the stored-energy method and how the authorized worker verifies control. OSHA's LOTO overview and §1910.147 require isolating the machine from energy sources and rendering it inoperative before covered servicing.

Never fill the table from memory alone. Walk down the machine against drawings and field labels, check modifications and alternate feeds, and involve operations and maintenance. A control-circuit stop button or interlock is not an energy-isolating device merely because it stops movement. When a source or energy magnitude cannot be confirmed, stop and resolve it with competent technical help.

4. Equipment-specific energy-control procedure form

Section 1910.147(c)(4) generally requires the employer to develop, document and use procedures for controlling hazardous energy. The standard contains a narrow documentation exception where all listed conditions are met; do not assume it applies to a complex machine. Each procedure should identify scope, purpose, authorization, rules and techniques, including shutdown, isolation, device placement/removal, and verification. The blank form below must be completed and field-tested for each covered asset or defensible group of similar equipment.

Do not print a generic step list and label it “machine specific” without identifying actual points. For machines with multiple sources, a single locked breaker may leave a raised platen or pressure line dangerous. Verification must suit the source: an electrical test by a qualified person, a machine start attempt after controls where appropriate, pressure checks or physical restraints as required. The §1910.147(d) application sequence must be followed; the table is a record framework, not a replacement for that text.

5. Devices, locks and tags

Device standard: [Specify durable, standardized and identifiable locks/tags; issue, inspection and replacement]. Custody: [Who holds keys and how group locks are managed]. Tagout justification: [Where a device cannot be locked, or full employee protection is demonstrated under the standard; evidence and additional protection]. Under §1910.147, a lockable energy-isolating device normally calls for lockout unless the employer demonstrates the conditions for a tagout system that provides full employee protection. A tag is a warning, not a physical restraint. Do not convert a lockout job to tagout because locks are inconvenient.

Only the employee who applied a lock or tag ordinarily removes it. §1910.147(e)(3) allows an employer-directed exception when that worker is unavailable, but only with developed, documented, trained procedures providing equivalent safety, including verification the employee is not at the facility, reasonable efforts to contact them and ensuring they know before resuming work. Do not replace this with a supervisor's informal “master key” discretion.

6. Group work, shifts, contractors and testing

A program must cover work that outlasts a shift, has multiple authorized workers, involves contractors, or needs temporary energization for testing. Under §1910.147(f), the employer needs specific continuity, group and outside-personnel controls. Define the actual method; a group lockbox label alone is not a complete procedure.

Example: A night maintenance crew isolates a packaging line, and day staff will continue the repair. The shift-change procedure must maintain protection while outgoing and incoming authorized workers transfer responsibility. A note in a log without the prescribed lock/control transfer is insufficient. If a contractor joins the job, the host and contractor must tell each other how their energy-control procedures work and ensure affected employees understand the restrictions.

7. Training and competence register

§1910.147(c)(7) differentiates authorized, affected and other employees. Authorized employees need energy-source recognition, type and magnitude and methods of isolation/control. Affected employees need to know the purpose and use of the procedure. Other people working in an area where LOTO is used need instruction not to restart or reenergize locked/tagged equipment. Retraining is triggered by job, machine/process or procedure changes, and by inspection findings or evidence of inadequate understanding; a generic fixed refresher date alone does not cover these triggers.

Keep the certification containing employee names and training dates as required. Demonstrate practical use and verify understanding, particularly where workers speak different languages or encounter several machine types. Do not mark a person qualified to control all hazardous energy because they watched a single video.

8. Periodic inspection and corrective action

The employer must inspect each energy-control procedure at least annually under §1910.147(c)(6). The inspector must be an authorized employee other than the one using the procedure being inspected, review the applicable responsibilities with employees, correct deviations and certify the inspection with required particulars. OSHA's interpretation explains that each procedure needs its own annual inspection, even where an employer has many machines.

Use the inspection to test whether the field device, machine labels and current procedure agree. A signed calendar reminder is not the inspection itself. When a source has changed or a worker cannot explain their role, correct the procedure, protect the ongoing job and retrain before relying on it again. Recheck after incidents, near misses or equipment modifications even if the annual date has not arrived.

9. Release, change and management review

Before release from LOTO, inspect the work area, make sure nonessential items are removed and components intact, account for people and warn affected workers after device removal but before restart, as §1910.147(e) requires. Put the detailed sequence into each applicable equipment procedure. Record tests and changes that could affect isolation. If an asset is modified, retire outdated field copies and train affected people on the new procedure.

Program review log: Date [ ]; machines/procedures added or changed [ ]; annual inspections due/completed [ ]; training gaps [ ]; contractor interfaces [ ]; incidents/near misses [ ]; corrective actions [ ]; approver [ ]; next check [ ]. Keep an accessible current copy and a traceable history. Software can organize records, but a record of “procedure complete” cannot prove a machine was isolated safely at the point of work.

Use this with the existing Complys owner

The existing US LOTO explainer owns “what is LOTO?” and the broad requirements query. This form owns the distinct task of drafting and operating an employer energy-control program. Before publication, check the current repository and unpublished templates: if a near-identical program form already exists, integrate this content into that owner rather than creating a new indexable page. The manifest's /us/written-safety-program-software money route was not verified as live in this writer pass. The observed US OSHA software page is a candidate contextual route only after implementation review. Do not claim Complys isolates machinery, verifies zero energy, trains/authorizes workers or certifies compliance.

Source and claim register