A lockout tagout procedure has three operational moments where it can fail. Application, where the wrong device or the wrong sequence misses an energy source. Verification, where zero state is assumed rather than tested. And removal, where a worker, a supervisor, or a contractor takes off a lock that does not belong to them, or removes their own before the work is actually complete. This post is about the third moment. Specifically, what the regulator expects from a removal procedure, who is authorised to do what, and the one scenario that breaks every site's documentation: the authorised employee who applied the lock is unavailable.
Table of Contents
- Part 1: Why Removal Is the Part Most Sites Get Wrong
- Part 2: The Standard Removal Sequence
- Part 3: Personal Lock Removal - The Rule That Has No Exceptions
- Part 4: Group Lockout Removal - The Lockbox Sequence
- Part 5: The Emergency Exception - When the Authorised Employee Is Unavailable
- Part 6: Shift Handover - The Procedural Gap That Produces Most Incidents
- Part 7: Documentation - What the Auditor Will Ask For
- Part 8: Country-Specific Overlays
- Part 9: Where The Lock Box Fits
Three questions every removal procedure must answer:
- Who is authorised to remove which devices, under which conditions?
- How is each removal recorded so the audit trail can be reconstructed?
- What is the named procedure when the authorised employee who applied the lock is unavailable?
Work through these three before you write or revise a removal procedure. The most common failure mode we see in EU site audits is a removal procedure that documents only the routine sequence, with no named alternative for the day a worker goes home sick at lunch and forgets the lock is still on the equipment.
Part 1: Why Removal Is the Part Most Sites Get Wrong
Application gets attention because it is where the most visible incidents happen. A worker enters a machine before isolation is complete, the equipment moves, the consequences are immediate. Sites train for this. Procedures are written for this.
Removal does not get the same attention, and it should. DGUV and SUVA inspection reports consistently identify removal as the procedural moment where audits find structural problems[3]. The second wave of LOTO incidents happens during removal: premature re-energisation, a lock removed before all workers are clear, a contractor leaving the site without removing their personal device, a supervisor cutting a lock off because the original worker cannot be reached.
The procedural fix is not complicated. A removal procedure has to name the sequence, name the people, name the verification step, and name the exception path. Most procedures we see on quote requests cover one or two of these and assume the others.
Part 2: The Standard Removal Sequence
The routine removal sequence is the same across every regulatory framework. The wording differs. The physical actions do not.
Best Practice: Five steps for routine removal. (1) Confirm the work is complete and the equipment is in a safe state for re-energisation. (2) Confirm all workers are physically clear of the equipment. (3) Each authorised employee removes their own personal lockout device, in the reverse order to application where applicable. (4) Restore energy and verify normal operation. (5) Document the removal in the procedure log with timestamp and authorised-employee name.
The verification step in (1) is where most procedures are weakest. "Work complete" is not the same as "equipment is safe to re-energise". A maintenance technician may have finished the task they were assigned and still left a tool inside the equipment guard. The procedure has to specify who confirms safe state, and what they physically check, before any lock comes off.
For the full LOTO foundation that this sequence sits inside, see our guide to the six (and more) steps of lockout tagout.
Part 3: Personal Lock Removal - The Rule That Has No Exceptions
An authorised employee removes only their own personal lock. Not their colleague's. Not a contractor's. Not the lock left over from yesterday's shift.
This rule exists because of an industrial-history pattern. Incidents involving energy released by a colleague removing someone else's lock are over-represented in injury data across every published dataset, from EU-OSHA reports to HSE enforcement actions. The pattern is consistent: a well-intentioned colleague removes a lock to clear the line for production, the worker who applied that lock is still inside the equipment, the energy returns.
The rule is absolute in routine operation. There is exactly one situation where another person may authorise removal, and that situation is the documented emergency exception covered in Part 5. Outside of that named procedure, no one removes another worker's lock.
This sits underneath authorised-employee training as the single most important behavioural rule in the entire LOTO programme. If only one rule survives a training session, this is the one.
Part 4: Group Lockout Removal - The Lockbox Sequence
Group lockout introduces removal complexity that single-worker LOTO does not have. Multiple workers, often across multiple trades, apply personal locks to a lockbox holding the keys to the equipment-side isolation devices. The removal sequence has to handle every variant of who finishes first, who is delayed, and who is unreachable.
The table below maps the common scenarios, the removal authority, and the failure mode that recurs in inspection reports.
| Scenario | Who removes what | Verification step | Common failure mode |
|---|---|---|---|
| Single worker, single energy source | The authorised employee removes their personal lock after verifying work complete | Visual confirmation of equipment state, attempt to start equipment fails | Work declared complete without verifying tools are clear of the equipment |
| Single worker, multi-energy | The authorised employee removes their personal lock from the lockbox holding all isolation keys | Verification at each isolation point that the released key restores energy in the correct sequence | Energy restored out of sequence (e.g. pneumatic before electrical) causing equipment to move unexpectedly |
| Group lockout, primary authorised employee present | Each worker removes their personal lock from the lockbox in any order. Primary authorised employee removes their lock last | Headcount confirmation, sign-off log, attempt-to-start verification | Worker leaves the site without removing their lock; lockbox cannot be opened |
| Group lockout, shift changeover | Two acceptable patterns: continuous-lock transfer with documented handover, or removal and re-application by the incoming shift. See Part 6 | Handover signature from outgoing to incoming authorised employee, or fresh verification by incoming shift | Lock left in place between shifts with no transfer documentation |
| Group lockout, contractor involved | Each contractor worker removes their own personal lock. Host authorised employee removes last and re-energises | Contractor sign-out on host site permit, host verification of contractor scope complete | Contractor leaves the site with the lock still applied |
| Emergency exception (authorised employee unavailable) | Senior named authority removes the lock following the documented exception procedure. Never routine | Verification of zero energy state by alternative means, attempt to contact original employee, sign-off by named senior authority | Exception procedure used routinely rather than as an exception, normalising lock removal by non-authorised personnel |
The lockbox is the central piece of hardware in any group lockout removal. Browse our LOTO lockbox range for the configurations that match the scenarios above.
For a deeper treatment of group lockout management, including shift transitions, see our guide to managing group lockout safely.
Part 5: The Emergency Exception - When the Authorised Employee Is Unavailable
This is the scenario every site has and most procedures do not handle.
A worker applies a personal lockout device at the start of a shift. They go home sick at lunch. The lock is still on the equipment, the work is incomplete, the line is needed for production tomorrow, and the worker cannot be reached. What happens?
The EU framework treats this scenario under the general duty of care obligation in Directive 89/391/EEC and the work equipment requirements of Directive 2009/104/EC[2]. EN ISO 14118 covers prevention of unexpected start-up but does not name this specific procedural scenario[4]. The practical guidance comes from member-state transposition, which varies in detail.
The US framework is unusually prescriptive on this exact point. OSHA 29 CFR 1910.147(e)(3) explicitly addresses what it calls "lockout or tagout device removal by other than the authorised employee who applied it", and lists the required elements of a compliant exception procedure[1]. Even for EU sites operating under the local regulatory framework, the OSHA language is the most useful procedural template available, because the EU equivalents reach the same conclusion without writing it out in the same detail.
Real-World Case: A maintenance technician at a chemical plant applies a personal padlock to a reactor isolation valve at 0700. At 1100 they report to first aid with chest pain and are taken to hospital. The plant supervisor at 1500 needs the line back in service. The technician cannot be reached. Without a documented exception procedure, the supervisor faces two unacceptable choices: leave the line down indefinitely, or remove the lock without authority. With a compliant exception procedure in place, the supervisor follows a named sequence that protects both the absent technician and the people who will work on the line next.
A compliant emergency exception procedure has six elements, drawn from the consensus of OSHA 1910.147(e)(3) and the EU member-state guidance documents:
- Verification that the authorised employee is genuinely unavailable. Documented attempts to reach them by phone, on-site search, contact with their supervisor or next-of-kin where applicable. The procedure should specify how many attempts and over what time period before "unavailable" is concluded.
- Independent verification of zero energy state. If the original employee verified zero state on application, that verification cannot be assumed to still hold. A named person other than the one removing the lock performs the verification again.
- Named senior authority who signs off the removal. Typically an EHS lead or maintenance manager, with the role named in the procedure and the named individual rotated by shift to ensure coverage.
- Physical inspection of the equipment for work-in-progress. The reason the original employee applied the lock has not changed. Any incomplete work, parts removed, or hazards left behind must be addressed before energy is restored.
- Notification of the original employee at the next reasonable opportunity. The worker who applied the lock has the right to know their lock has been removed and the equipment re-energised. This is not optional, and it is the requirement most exception procedures fail to document.
- Documentation in the procedure log. Timestamp, names, verification steps taken, reason. The audit trail has to reconstruct the event later.
The most important word in the entire exception procedure is "exception". A site that uses this procedure more than two or three times a year has a programme-level problem, not an unavailable-worker problem. Pattern: the original procedure is too rigid, the authorised-employee pool is too small, or shift handover is failing somewhere else and pushing the load onto exception removals.
Part 6: Shift Handover - The Procedural Gap That Produces Most Incidents
The other scenario where locks need to come off (or transfer) when the original worker is not present is the shift changeover. This produces more removal-related incidents than any other procedural moment.
Two acceptable approaches exist. Pick one per site and apply it consistently.
Continuous-lock transfer. The outgoing shift's authorised employee meets the incoming shift's authorised employee physically at the equipment. They walk through the isolation status together. The outgoing employee removes their personal lock and the incoming employee applies theirs in immediate succession. The handover is documented with both signatures and the timestamp.
This approach maintains continuous isolation across the shift boundary. It requires shift overlap, which is the cost.
Removal and re-application. The outgoing shift removes their locks and restores the equipment to a documented intermediate state, typically energised but in a known safe configuration with the work paused. The incoming shift applies fresh locks following the standard application sequence at the start of their shift, and verifies zero state independently.
This approach requires no shift overlap. It costs time at the start of each shift and adds two more verification steps per day.
The unacceptable approach is leaving locks in place between shifts with no formal handover. The lock is then "owned" by no one, the incoming shift assumes it is from the outgoing shift, the outgoing shift assumes the incoming shift will deal with it, and nobody is positioned to confirm zero state if work resumes. For the audit-checklist detail on these and other periodic-inspection findings, see our guide to conducting a LOTO periodic inspection.
Best Practice: Rewriting your removal procedures across multiple European sites? Send us your authorised-employee count per site and your shift structure. We will propose a personal-padlock and lockbox standard sized for your group lockout patterns. Request a quote.
Part 7: Documentation - What the Auditor Will Ask For
A DGUV, SUVA, or AUVA auditor reviewing your LOTO programme will ask for three artefacts related to removal.
The removal log. Every routine removal recorded with timestamp, authorised-employee name, and verification confirmation. Paper logs are acceptable. Inconsistent or incomplete logs are not.
The exception procedure records. Every use of the emergency exception procedure documented separately, with all six required elements present. If the auditor finds the exception procedure has been used four times in a single quarter, they will start asking programme-level questions about why.
The training records traceable to the named procedure. Each authorised employee must be trained on both the routine removal sequence and the exception procedure, with a dated record on file.
Paper documentation is acceptable for all three. Paper documentation is also where most sites struggle. Digital LOTO platforms record every lock application and removal with timestamp and named user as a side effect of the workflow, which makes audit preparation a matter of running an export rather than reconstructing events from handwritten logs. Our sister brand Zentri covers this on its digital LOTO platform.
Part 8: Country-Specific Overlays
The procedural requirements are similar across EU member states. The audit references are not.
Germany. DGUV Vorschrift 3 governs electrical installations and DGUV Regel 100-500 covers the operation of work equipment, including isolation removal[3]. The Berufsgenossenschaften will reference these documents in audits, not the underlying federal law.
Switzerland. SUVA publications and ESTI guidance cover the same ground. SUVA inspectors will ask for the procedure by reference and the training record by named worker.
Austria. AUVA publications and the ArbeitnehmerInnenschutzgesetz apply. Content is closely aligned with DGUV.
France. Code du Travail Articles R4544-1 onwards cover the general isolation obligation. INRS publishes practical guidance on procedure writing.
Italy. D.Lgs. 81/2008 covers the workplace obligation. INAIL guidance provides procedural detail. Italian-language procedures are expected on Italian sites.
Netherlands. Arbobesluit Article 7.5 covers the workplace obligation. Nederlandse Arbeidsinspectie is the enforcement body.
Denmark. Arbejdsmiljøloven and Arbejdstilsynet guidance apply. Most published material is in Danish, which is what a local auditor will reference.
Part 9: Where The Lock Box Fits
Two product categories from our range are directly involved in every removal scenario covered above.
Personal LOTO padlocks. The device being removed in any routine sequence is a personal padlock. The padlock has to be uniquely identifiable to the worker who applied it, durable enough to survive repeated application and removal cycles, and matched to the keying scheme of the site. Browse our LOTO padlock range for the configurations that suit a multi-worker programme.
Lockboxes. Group lockout removal centres on the lockbox, because the lockbox holds the keys to the equipment-side isolation devices and accepts each worker's personal padlock around its perimeter. The right lockbox for a site depends on the maximum group size, the number of isolation points typically managed together, and whether the lockbox is wall-mounted or portable. Browse our LOTO lockbox range.
What we deliberately do not supply is digital audit-trail software. Paper-based removal logs and exception records are within the scope of every TLB customer's existing documentation system. Digital LOTO is Zentri's territory, and the cross-promote we make for digital procedure management is genuine, not a bolt-on. If your removal procedures are being rewritten because the existing paper system cannot keep up with audit demands, digital is the right conversation. If they are being rewritten because the procedures themselves are incomplete, hardware standardisation and procedure writing come first.
Ready to Standardise Your Removal Procedures?
Contact The Lock Box with your authorised-employee count per site, your shift structure, and any specific scenarios from Part 4 you run regularly. We will return a personal-padlock and lockbox standard pairing each scenario.
For the digital audit-trail layer that records every application and removal automatically, explore Zentri.
The point of a removal procedure is not the document. The point is that the worker who applied the lock, the workers who came onto the next shift, and the supervisor signing off the line all end the day with the same understanding of what happened to that lock and when. A removal procedure that handles routine, group, exception, and shift-handover scenarios with named people and documented sign-offs is the only version of this work that actually protects everyone in the sequence.
References
- OSHA. 29 CFR 1910.147 - The Control of Hazardous Energy (Lockout/Tagout), with specific reference to (e)(3) on lockout/tagout device removal. Occupational Safety and Health Administration. https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.147
- European Union. (2009). Directive 2009/104/EC on minimum safety and health requirements for the use of work equipment. EUR-Lex. https://eur-lex.europa.eu
- Deutsche Gesetzliche Unfallversicherung. DGUV Regel 100-500: Betreiben von Arbeitsmitteln. DGUV. https://www.dguv.de
- International Organization for Standardization. EN ISO 14118: Safety of machinery - Prevention of unexpected start-up. ISO. https://www.iso.org
- Suva. Lockout-tagout and isolation guidance for Swiss workplaces. Suva. https://www.suva.ch
- Nugent, M. (2026). Why Your Lockout Procedures Stop Matching Reality Within 12 Months. ISHN. https://www.ishn.com/articles/115325-why-your-lockout-procedures-stop-matching-reality-within-12-months
