ValidutyBook a demo

Blog · 28 October 2026

Permit to Work vs JSA vs Risk Assessment: What's the Difference?

A risk assessment, a job safety analysis and a permit to work are not three names for one thing. What each one does, who writes it, and how the three fit together.

Two workers in hard hats and high-visibility vests reading a tablet together
Photo by Ana Lucia Videira

People new to site safety often hear “risk assessment”, “JSA” and “permit to work” used as if they meant the same thing. They don’t. Each one answers a different question, at a different moment, and a safe job usually needs all three.

In short:

  • A risk assessment looks at an activity or a workplace, finds what could hurt someone, and decides the controls.
  • A job safety analysis (JSA) breaks one job into steps and lists the hazards and controls for each step.
  • A permit to work is the written authority to do one specific high-risk job, in a set place and time, once the controls are confirmed in place.

1. Risk assessment: what could hurt someone here?

A risk assessment covers an activity, an area or a whole workplace. Competent people do it ahead of time, and review it whenever something changes.

It records:

  • the hazards, and who could be harmed;
  • how likely harm is, and how bad it would be;
  • the controls, starting with removing the hazard and ending with personal protective equipment.

A risk assessment is not written for one crew on one morning. It sets the rules that every job in that area has to follow.

2. JSA: how do we do this job safely, step by step?

A job safety analysis looks at one task. In the United States, OSHA calls it a job hazard analysis (JHA), and many companies call it a task risk assessment.

The supervisor writes it with the crew who will do the work. It lists:

  • each step of the job, in order;
  • the hazards at each step;
  • the control for each hazard, and who is responsible for it.

Jobs that repeat, such as changing a filter, often start from a template. The template still has to be checked against the day’s conditions before anyone uses it.

3. Permit to work: may this work start, here, now?

A permit to work controls specific high-risk work, such as hot work, confined space entry, work on equipment that has been isolated, work at height, excavation or diving. The UK Health and Safety Executive’s guidance (HSG250) describes it as a formal written system for controlling work that could be hazardous.

A permit names:

  • the work, the place and the time it is valid for;
  • the people doing it, and the person in charge;
  • the precautions confirmed in place, such as isolations locked, a fresh gas test or a fire watch;
  • who issued it, and who approved it.

A permit runs out. It is handed over at a shift change, and it is closed when the work ends and the area is safe again.


How the three fit together

Three steps in order. 1, risk assessment: what could hurt someone here? It sets the controls for the whole area. 2, job safety analysis: how do we do this job safely? It lists each step, its hazards and controls. 3, permit to work: may this work start, here, now? It confirms the controls, for a set time. Then the work starts, is handed over, and is closed.

Risk assessment JSA Permit to work
The question What could hurt someone here? How do we do this job safely? May this work start now?
Covers An activity, area or workplace One task One high-risk job, place and time
Written by Competent people, ahead of time The supervisor with the crew The issuer, with approvers
Lasts Until something changes Each time the task is done Hours, then closed

Take replacing a valve on a gas line:

  1. The risk assessment for the unit says that work on live process lines needs isolation and gas testing.
  2. The JSA lists the steps: isolate, drain, purge, gas test, remove the old valve, fit the new one, test for leaks.
  3. The permit names this valve, this crew and this shift, and records that the isolation points are locked and the gas test passed.

The permit doesn’t replace the JSA; it relies on it. A permit issued without an approved JSA is a signature on a guess.

Common mistakes

  • Treating the permit as the risk assessment. The permit confirms controls; it doesn’t decide them.
  • Copying last month’s JSA. The steps may be the same, but the weather, the crew and the work nearby are not.
  • Issuing the permit before the JSA is approved. The crew is ready, so the paperwork catches up later.
  • Leaving permits open. A permit nobody closed makes it look as if work is still going on.

Where Validuty fits

  • The JSA comes first. A permit names the task it is for, or links its JSA. Where the task needs a JSA, the permit can’t be issued until the JSA is approved, and if the JSA is sent back, the permit can’t go live or resume. A permit type can require an approved JSA on every permit of its kind.
  • Templates for repeat jobs. JSAs start from templates in your own library, approved before anyone uses them.
  • Permits that end on time. A permit counts down to its expiry, and a shift handover has to be acknowledged by the incoming supervisor.
  • Nobody approves their own. Every approval is recorded in order, with the time it was given.

See how permits work in Validuty in the permits guide, or book a demo with us.

See it on your own permits.

Thirty minutes on your own permits and your own vendors.