One Lockout/Tagout Program, Forty Sites: Where Standardization Actually Breaks
A corporate lockout/tagout program satisfies 29 CFR 1910.147 only if the machine-specific procedures underneath it exist at each site. Here is where multi-site rollouts fail inspection.
Most multi-site operators have a corporate lockout/tagout program. Considerably fewer have forty compliant sites.
The gap is not laziness and it is rarely ignorance. It comes from a misreading of what 29 CFR 1910.147 actually requires, and that misreading is encouraged by how corporate programs are usually written and rolled out.
The standard asks for two different things
A written energy control program is one requirement. Machine-specific energy control procedures are another, and they are the ones that get cited.
1910.147(c)(4)(i) requires procedures for the control of hazardous energy — developed, documented and utilised. The standard then specifies what those procedures must contain, including the scope and purpose, the specific steps for shutting down and isolating equipment, the steps for placement and removal of devices, and the requirements for testing to verify effectiveness.
A corporate document that says "isolate all energy sources and verify zero energy state" is a policy. It is not a procedure for the horizontal boring mill on line three, which has hydraulic accumulators that hold pressure after the main disconnect is opened. The standard is asking about that machine.
This is why a company can distribute an excellent program to every site and still fail an inspection at most of them. The program was never the deliverable. It was the framework the deliverable hangs from.
The exception is narrower than people use it
1910.147(c)(4)(i) contains a limited exception where documented procedures are not required, and it is widely over-applied. It applies only when a specific set of conditions are all satisfied — including that the machine has no potential for stored or residual energy after shutdown, that it has a single energy source which can be readily identified and isolated, and that the isolation of that source completely deenergises the machine, among others.
If your sites are relying on this exception for anything with a hydraulic system, a pneumatic line, a capacitor, a flywheel, gravity-loaded components, or more than one disconnect, that reliance will not survive scrutiny. In practice the exception covers a narrow band of simple equipment, and treating it as a general escape from documentation is one of the more expensive mistakes available in this standard.
Where multi-site rollouts actually break
Machine inventories are stale. The corporate procedure library was built from an equipment list assembled during the rollout. Three years on, sites have replaced, moved, modified and added equipment. Procedures exist for machines that were scrapped, and no procedure exists for the press that replaced them. The library looks complete because nobody reconciles it against what is on the floor.
Identical model numbers are not identical installations. Two sites running the same machine may have different energy sources at the point of installation — different disconnect locations, a compressed air feed at one site and not the other, a downstream conveyor interlocked at one and standalone at the other. A single procedure copied to both is wrong at one of them.
Authorised employee training is treated as a headcount exercise. The standard distinguishes between authorised, affected and other employees, with different training obligations for each. Rolled out at scale, this frequently collapses into one annual course delivered to everyone, which satisfies the affected-employee requirement and under-serves the authorised employees who actually apply locks.
Periodic inspection becomes a checkbox. 1910.147(c)(6) requires a periodic inspection at least annually, conducted by an authorised employee other than the one using the procedure being inspected, and it must include a review between the inspector and each authorised employee of that employee's responsibilities. Done properly this is a conversation about a specific procedure with the person who performs it. Done at scale under time pressure it becomes a signature against a list, which produces a record that documents non-compliance rather than compliance.
Contractors are assumed to be covered. 1910.147(f)(2) addresses outside personnel, requiring that the on-site employer and the outside employer inform each other of their respective procedures. At a single site this is a conversation. Across forty sites with a rotating contractor base it needs to be a process, and it usually is not one.
What actually standardises well, and what does not
Standardise the framework: the definitions, the roles, the lock and tag hardware, the colour conventions, the training curriculum, the periodic inspection format, the recordkeeping. These benefit enormously from being identical everywhere. A maintenance technician moving between sites should find the same locks, the same tags and the same expectations.
Do not attempt to standardise the machine-specific procedures themselves. They describe physical reality at a particular installation, and that reality differs. What you standardise is the template they are written to and the review process they pass through — not their content.
The practical model that works is a central template plus local authorship plus central review. The site writes the procedure because the site can see the machine. Corporate reviews it against the template because corporate can see the pattern across forty sites and will notice when one of them omits stored energy verification.
The question that reveals the truth
Ask any site: pick a machine at random, show me its energy control procedure, and walk me through it at the machine.
Sites with a genuine program produce the procedure in under a minute and the walkthrough matches the document. Sites with a corporate program and no local implementation produce the corporate policy, or produce a procedure that describes a different disconnect location than the one on the wall.
That single exercise, run at each site by someone from outside it, will tell you more about your exposure than any amount of program documentation review. It is also almost exactly what an inspector will do.
General guidance only, not legal advice. Verify requirements against 29 CFR 1910.147 and your applicable state plan, and involve a qualified safety professional in developing energy control procedures.
OSHA standards cited
- 29 CFR 1910.147
General Industry Standards
Always verify current OSHA standards at osha.gov. This article reflects standards in effect at the date of publication.
Not sure where you stand?
Take the 5-minute compliance assessment. Answer a few questions about your business and get a prioritized list of what OSHA expects, free.
Related Articles
Continue learning about OSHA compliance and workplace safety
Construction Safety
Excavation's Competent Person Is Designated at the Site. Corporate's Org Chart Assigns the Role by Title.
OSHA's excavation standard, 29 CFR 1926.651, requires a competent person who evaluates that specific site's soil daily. A title alone cannot substitute for it.
Fire Protection
Combustible Dust Isn't One Hazard. Across a Portfolio of Sites, It's a Different One at Each Address.
Combustible dust falls under OSHA's General Duty Clause and NFPA standards, not one rule — a portfolio policy must fit a different material at each site.
Health Hazards
Silica Table 1 Is Written Per Task, Per Tool. Your Compliance Program Is Written Per Company.
OSHA's respirable silica standard, 29 CFR 1926.1153, specifies controls by task and tool. Across many job sites, that specificity is exactly what a corporate policy tends to flatten.