5 Steps to Build a Lockout/Tagout Program That Actually Works

Most LOTO binders look complete and still fail in the field. Here are five concrete steps, in the order they need to happen, to build a lockout/tagout program that holds up under an audit and on the shop floor.

Most lockout/tagout programs look complete on paper. There is a policy, a stack of laminated procedure sheets in a binder nobody opens, and a box of padlocks in the maintenance shop. Then an auditor asks a worker to demonstrate lockout on a specific piece of equipment, or a near miss happens because someone used a master key to save time, and the gap between the binder and the shop floor becomes obvious.

A lockout/tagout program that actually works is built in a specific order, and each step depends on the one before it. Skip the hazardous energy inventory and your procedures will be generic and wrong. Skip worker-specific locks and your training records mean nothing the first time someone borrows a spare key. Here are the five steps, in the order they need to happen.

Step 1: Build a hazardous energy inventory before you write anything

Before a single procedure gets written, walk every machine, system, and piece of equipment in the facility that stores or transmits energy and could injure someone during service or maintenance. For each one, identify every energy source, not just the obvious one.

• Electrical: incoming supply, capacitors, backup power, static charge
• Hydraulic: pressurized lines, accumulators, cylinders under load
• Pneumatic: compressed air lines, air-over-hydraulic systems
• Mechanical: flywheels, springs under tension, rotating shafts that coast down
• Thermal: steam lines, hot surfaces, cryogenic lines
• Chemical: residual product in lines, reactive materials
• Gravity: raised platforms, suspended loads, counterweights

For every energy source, note the isolation point (the breaker, disconnect switch, valve, or block) and whether energy can still be present after isolation. A hydraulic cylinder can still be pressurized after the pump shuts off. A capacitor can hold a charge after the breaker trips. Those stored-energy cases are where lockout programs actually fail, because the equipment looks safe and is not. The output of this step is a master equipment list, one line per machine, that feeds directly into step two.

Step 2: Write a procedure for each equipment type, not one generic sheet

A single laminated page that says "lock out, tag out, verify zero energy" does not hold up against a conveyor, a hydraulic press, and a natural gas compressor with three different isolation sequences. Each machine on your inventory needs its own written procedure, and each procedure needs the same set of elements so a worker can follow it without guessing.

• Equipment name and asset ID, matching the inventory
• Every energy source and its magnitude (voltage, pressure, etc.)
• Location of each isolation device, with a photo if the plant has more than a handful of similar disconnects
• The shutdown sequence in order, not just "turn it off"
• How to dissipate stored energy (bleed a line, block a raised component, discharge a capacitor)
• How to verify zero energy state (try-start, gauge reading, voltage test)
• The restart and lock removal sequence, including who confirms the area is clear

For equipment worked on by more than one trade or crew at once, the procedure also needs a group lockout method, typically a lockout box where each worker's personal lock secures the box rather than the isolation point directly, so no one can re-energize the equipment while a single lock is still attached somewhere on the machine.

Step 3: Standardize hardware and assign locks to individual workers

Procedures only work if the hardware enforces them. That means keyed-different padlocks, not keyed-alike sets and never a master key that supervisors keep for convenience. A master key or a shared lock defeats the entire purpose of lockout, because it lets someone remove another person's lock without that person's knowledge.

• Personal padlocks, keyed different, one per authorized worker
• Breaker lockout devices sized to the panel types on site
• Ball valve and gate valve lockouts for hydraulic, pneumatic, and process lines
• Gang lock hasps so multiple workers can each apply a lock to one isolation point
• Cable lockouts for larger equipment with multiple or awkward isolation points
• Durable tags with the worker's name, date, and contact information, not just a blank "Danger" tag

Track hardware in a simple register: worker name, lock serial number, and issue date. When someone leaves the company or changes roles, their lock comes back and gets logged out. This register is a small document but it is one of the first things a COR or SECOR auditor will ask to see alongside your equipment inventory, so keep it current rather than reconstructing it before an audit.

Step 4: Train and authorize workers, and keep the records to prove it

Lockout training splits into two groups. Authorized workers are the ones who actually apply locks and perform isolation. Affected workers are the ones who operate or work near locked-out equipment but do not lock it out themselves. Both groups need training, but the depth is different, and your records should reflect that difference rather than treating everyone the same.

• Authorized workers: the types of hazardous energy present in the facility, the company's written lockout program, hands-on practice on the specific equipment they will isolate, and the group lockout protocol
• Affected workers: how to recognize a lockout in progress, why they must not attempt to start locked-out equipment, and who to contact if a lock is in their way

Keep an authorization list naming which workers are authorized on which equipment, not just a blanket "completed LOTO training" checkbox. Retrain when equipment changes, when a procedure is revised, after any incident or near miss involving isolation, and on whatever refresher interval your internal safety program sets. These records are what turns a training session into evidence, and they are exactly what shows up under the training and equipment questions in a COR or SECOR audit.

Step 5: Audit the program on a schedule, not just when something breaks

A lockout program is not a one-time build. Equipment gets modified, replaced, or reconfigured, and a procedure written two years ago can quietly stop matching the machine it describes. A periodic internal audit catches that drift before it becomes an incident or an audit finding.

• Compare each written procedure against the equipment as it actually exists today
• Check the lock and tag hardware register against who is currently employed and authorized
• Watch an actual lockout being performed rather than only reviewing paperwork, and note any shortcuts workers have adopted
• Confirm group lockout boxes and gang hasps are still adequate for current crew sizes

Many Alberta and BC employers tie this review to their annual internal audit cycle ahead of an external COR or SECOR audit, since Element 7 questions on hazardous energy control and equipment-specific procedures are a common gap even in otherwise strong programs. Building the review into that existing cycle means it happens on schedule instead of being remembered only after a close call.

Building it in order is what makes it work

Inventory first, then equipment-specific procedures, then hardware discipline, then training records tied to named equipment, then a real audit schedule. Each step is small enough for one person to lead, but skipping the order is what produces the binder-versus-shop-floor gap most programs get caught on. If your team needs help building or auditing a lockout/tagout program from scratch, On-Track's safety manual and field safety services are built around exactly this kind of equipment-level documentation.