How to Audit Lockout Tagout Compliance

A lockout/tagout audit usually fails for one of two reasons. Either the site treats it like a paperwork exercise, or the auditor never gets close enough to the work to see where hazardous energy control actually breaks down. If you want to know how to audit lockout tagout compliance, you need to test both the written program and the way authorized employees apply it in the field.

For industrial and commercial facilities, that distinction matters. A binder may say the right things about energy isolation, verification, and group lockout, while maintenance staff are still relying on memory, skipping secondary energy sources, or using procedures that no longer match the equipment. OSHA expects more than a written policy. It expects an energy control program that is current, equipment-specific where required, understood by employees, and followed consistently.

What a lockout/tagout audit should actually measure

A useful audit measures whether the facility can prevent unexpected energization, startup, or release of stored energy during servicing and maintenance. That includes electrical energy, but it also includes mechanical, hydraulic, pneumatic, chemical, thermal, and gravity-related hazards. In practice, the audit should answer three questions: does the program meet regulatory requirements, do the procedures match the real equipment, and do employees execute the process without improvising around risk.

This is where many organizations lose control of the process. They review the written program once a year, confirm training records exist, and stop there. That approach misses the compliance gap that matters most - the difference between what the procedure says and what the technician can isolate under production pressure.

Start with the regulatory baseline

Before you go into the field, define the criteria you are auditing against. For most US facilities, the baseline is OSHA 29 CFR 1910.147. If electrical tasks are part of the scope, you should also evaluate how the facility's electrical safety practices align with NFPA 70E, especially where establishing an electrically safe work condition intersects with lockout/tagout. These are related obligations, but they are not interchangeable.

Your audit criteria should cover the core program elements: documented energy control procedures, employee training, periodic inspections, hardware availability and standardization, shift and personnel transfer practices, contractor control, and corrective action management. If your facility uses complex equipment or has multiple energy sources, the criteria should also address equipment-specific isolation instructions, stored energy release, and verification steps.

How to audit lockout tagout compliance in the field

The most effective audit method is a combined document review and field verification. A desk review alone will not tell you whether employees can identify all energy sources. A field walk alone will not show whether the program has the required administrative controls. You need both.

Start with a representative sample of equipment. Include simple assets and complex ones. Include equipment that maintenance teams work on frequently and equipment that is touched only during shutdowns or troubleshooting. If the facility has switchgear, MCCs, process equipment, conveyors, pumps, compressed air systems, or hydraulically actuated machinery, your sample should reflect that variety.

Then observe actual lockout activity if possible. If live work observation is not practical during the audit window, conduct a controlled walk-through using the written procedure and ask the authorized employee to explain each isolation point, each stored energy hazard, and each verification step. This is often where outdated procedures surface quickly.

Review the written energy control program

The written program should clearly define roles for authorized, affected, and other employees. It should explain when lockout is required, when tagout-only is permitted, how group lockout is managed, how shift changes are handled, and what happens when outside contractors are involved. It should also define periodic inspection requirements and who is responsible for completing them.

Look for vague language. Terms like "de-energize equipment" are not enough if the program does not explain isolation, stored energy release, verification, and re-energization controls. If the document reads like a policy statement instead of an operating standard, the program may not support consistent execution.

Check equipment-specific procedures

Procedure quality is often the difference between nominal compliance and actual risk control. For equipment requiring a documented procedure, confirm that each one identifies all hazardous energy sources, the shutdown sequence, isolation device locations, lockout steps, stored energy dissipation methods, verification requirements, and restart steps.

Now compare the procedure to the machine or system in front of you. Are disconnects labeled correctly? Do valve identifiers match the field? Has equipment been modified since the procedure was written? Are there multiple feeds, backfeeds, interlocks, capacitors, springs, elevated components, or pneumatic reservoirs that the procedure does not address? If the answer is yes, the procedure is no longer reliable.

Facilities with older electrical infrastructure often find related issues here. One-line diagrams, panel schedules, and equipment labels may be out of date, which makes lockout procedure accuracy harder to sustain. If the supporting electrical documentation is weak, your audit should identify that as a compliance and safety issue, not just an engineering housekeeping item.

Evaluate employee training and understanding

Training records matter, but demonstrated understanding matters more. Verify that authorized employees have been trained on hazardous energy control procedures relevant to their tasks. Verify that affected employees understand the purpose and use of lockout/tagout. If contractors perform servicing on site, confirm that coordination expectations are defined and communicated.

Interview employees in the work area. Ask them how they verify zero energy. Ask what they do when a procedure does not match the equipment. Ask how they handle group lockout, shift turnover, and removed or missing tags. If answers vary widely among employees doing the same work, the program is not controlled.

Training frequency can be another weak point. A site may have completed initial training years ago but never retrained after equipment changes, incident findings, or procedure revisions. Compliance is not just whether training occurred. It is whether training remains adequate for current conditions.

Audit the hardware, not just the paperwork

A compliant lockout/tagout program depends on employees having the right devices available where work happens. During the audit, inspect locks, hasps, tags, breaker lockouts, valve lockouts, plug lockouts, group lock boxes, and any specialized isolation hardware. Devices should be standardized enough to serve their safety purpose and durable enough for the environment.

This is also where execution problems show up fast. If technicians are borrowing locks, using improvised methods, or walking long distances to find the right device, the process will drift. Hardware placement, condition, and fit-for-purpose design are part of compliance because they directly affect whether the written procedure can be followed as intended.

Verify periodic inspections were done correctly

OSHA requires periodic inspection of the energy control procedure at least annually. Many facilities can produce a form showing the inspection happened. Fewer can show that the inspection actually evaluated procedure use, involved an authorized employee, and corrected deficiencies.

Review inspection records for quality, not just completion. Check whether the inspection references the specific procedure reviewed, identifies the employee involved, notes deviations, and documents follow-up actions. If the same generic form is repeated across many assets with no meaningful findings, the inspection process may be administrative rather than effective.

Document findings by risk, not just by count

Not every audit finding carries the same exposure. A missing training signature and an isolation procedure that omits a secondary electrical source are not equivalent. Prioritize findings based on the potential for injury, unexpected startup, or release of hazardous energy.

High-risk findings usually include undocumented or inaccurate procedures for complex equipment, failure to verify isolation, inadequate control of stored energy, inconsistent group lockout practices, and poor coordination between electrical and mechanical scopes of work. Medium-risk findings may include outdated training content, unclear responsibilities, or weak periodic inspection records. Lower-risk items might involve formatting, labeling consistency, or document control issues that do not directly compromise isolation.

That risk-based approach helps leadership allocate resources intelligently. It also makes corrective action easier to defend when budgets or outage windows force phased implementation.

Corrective action should change the work, not just the file

An audit has value only if it improves control of hazardous energy. Corrective actions should be specific, assigned, and time-bound. Rewrite inaccurate procedures. Update one-lines and equipment labeling where field identification problems affect isolation. Retrain employees on actual deficiencies found in the audit. Replace unsuitable hardware. Re-audit high-risk areas after changes are made.

For facilities with significant electrical exposure, lockout/tagout improvements often overlap with broader electrical safety work. Better labeling, current system documentation, clearer disconnect identification, and stronger electrically safe work condition practices all support more reliable hazardous energy control. That is where an implementation-focused approach matters more than another compliance memo.

A strong audit is not the one with the fewest findings. It is the one that reveals where your people are being asked to trust weak procedures, incomplete documentation, or inconsistent equipment conditions. Fix that gap, and the audit becomes part of injury prevention instead of recordkeeping.