Group Lockout/Tagout Procedures: OSHA 1910.147 Compliance for Multi-Worker Jobs

Published May 14, 2026 by LOTO Compliance

Most LOTO programs are written for one worker and one machine. The problem on a real plant floor is that the big jobs almost never look like that. A line rebuild pulls in millwrights, electricians, and controls techs at the same time. A press die change runs two crews. A weekend outage stacks contractors on top of maintenance. The moment more than one authorized employee works under the same energy isolation, the single-lock model breaks, and 1910.147(f)(3) is the part of the standard that tells you what to do instead.

This guide is the group lockout cut of OSHA 1910.147 from a senior EHS lens. It pairs with our periodic inspection checklist for the audit-day view and the FY2025 citation breakdown for where enforcement actually lands. For an equipment-specific example of how a group job plays out, the conveyor LOTO procedures piece walks the same logic on a single asset.

What 1910.147(f)(3) Actually Requires

The rule is short and the obligations are specific. When servicing or maintenance is performed by a crew, craft, department, or other group, the employer has to use a procedure that gives each employee a level of protection equivalent to a personal lockout or tagout device. That phrase, "equivalent to a personal lockout," is the whole standard in five words. Every worker has to be as protected as if their own lock were on the energy-isolating device itself.

The standard then names four operational requirements that a group procedure has to satisfy. Pull these straight from the OSHA 1910.147 text and build the procedure around them:

• 1910.147(f)(3)(ii)(A): primary responsibility is vested in one authorized employee for a set number of workers under the group device.
• 1910.147(f)(3)(ii)(B): that primary authorized employee has a way to ascertain the exposure status of each group member.
• 1910.147(f)(3)(ii)(C): when more than one crew or craft is involved, one authorized employee is assigned overall job-associated control to coordinate the work forces and ensure continuity of protection.
• 1910.147(f)(3)(ii)(D): each authorized employee affixes a personal lock to the group device or lockbox when they begin work and removes it when they stop.

Read those together and the design is obvious. One person owns the isolation. The isolation keys go somewhere no single worker controls. Everyone exposed to the machine has a personal lock in the chain. And someone above the crew level keeps the whole thing continuous when crews rotate.

The Group Lockbox, Step by Step

The group lockbox is the hardware that makes (f)(3) work in practice. It is a simple steel or polymer box with multiple lock holes. Here is the sequence a compliant procedure spells out:

1. The primary authorized employee walks the machine-specific procedure required by 1910.147(c)(4) and locks every energy-isolating device: electrical disconnect, pneumatic supply, hydraulic shutoff, steam stop, gravity blocks, stored-energy releases.
2. The primary authorized employee performs the 1910.147(d)(6) verification, confirming a zero-energy state on every energy type, not just the electrical side.
3. The isolation keys go inside the group lockbox. The primary authorized employee locks the box with their own lock.
4. Each authorized employee on the job affixes a personal lock to the lockbox before they enter the machine. No personal lock on the box, no entry.
5. When a worker finishes, they remove only their own personal lock.
6. When the last personal lock comes off, the primary authorized employee can open the box, retrieve the isolation keys, and follow the 1910.147(e) release sequence.

The reason this satisfies the "equivalent to a personal lock" test is the chain of custody. The isolation keys are physically trapped behind every worker's personal lock. No supervisor, no rushing operator, no next shift can re-energize the machine while a single worker still has a lock on the box. That is the protection. Lose any link in that chain and the program is group lockout in name only.

Primary vs Coordinating Authorized Employee

These two roles get blurred constantly, and the blur is a citation risk. They are different jobs.

On a small job, one person can hold both roles, and the procedure should say so explicitly. On a line rebuild with millwrights, electricians, and a controls contractor, you need both: a primary for each crew managing that crew's lockbox, and one coordinating authorized employee who owns the job. The coordination role is the one OSHA added because multi-craft outages were where workers fell through the cracks. Name the coordinating employee on the work order, not in the parking lot.

Shift Changes: Where Group Lockout Fails

1910.147(f)(4) requires specific procedures for shift or personnel changes to ensure continuity of LOTO protection. On a group job, the handoff is the single most dangerous moment. A crew goes home, a fresh crew comes in, and for thirty seconds the question of who owns the isolation has no clean answer. That gap is where re-energization incidents happen.

The procedure that closes it is an overlap, not a swap. The outgoing crew keeps their personal locks on the lockbox until the incoming crew has placed theirs. The incoming primary authorized employee re-verifies the isolation against the machine-specific procedure before anyone clears. Only then does the outgoing crew remove their locks. The box never sits with zero personal locks on it while the machine is still open. Build the overlap into the written procedure and the shift-change verification into the periodic inspection, because an inspector who sees a group job will ask exactly how you handle 2 a.m.

The Citation Patterns We See Most

Group lockout gaps cluster in a handful of predictable places. On pre-audit walkthroughs, these are the ones that come up again and again:

• No written group procedure at all. The plant has a solid single-worker program and runs group jobs by habit. 1910.147(c)(4)(i) still requires the procedure to exist in writing, and (f)(3) requires it to cover the group case.
• One operations lock, no lockbox. A supervisor locks the disconnect, the crew trusts it, and nobody has a personal lock in the chain. That is not equivalent protection. It is a single point of failure.
• The primary authorized employee is not named. The role exists in the procedure but gets assigned informally, so no one can say who carried primary responsibility when the inspector asks.
• Personal locks cut off the box routinely. A worker leaves, their lock stays, and the crew cuts it to keep moving. Lock removal is governed by 1910.147(e)(3) and is a narrow, documented exception, not a daily workaround.
• Contractors outside the program. Contract crews on a group job carry their own off-color locks with no host coordination. 1910.147(f)(2) puts joint responsibility on both employers and the coordinating authorized employee has to fold contractors into the lockbox chain.

Every one of these is fixable before an inspector ever walks the floor. The fix is a written group procedure, the right hardware, and a periodic inspection that actually tests a group job rather than a single-worker job. That is the structure ECPL runs on every gap analysis and annual audit, and it is also the methodology behind the broader ANSI/ASSP Z244.1 consensus standard that OSHA inspectors increasingly reference as the recognized practice.

What to Do This Month

If your program was built for one worker and one machine, three moves close most of the group-lockout exposure:

1. Pull your written energy control program and confirm it has a group lockout section that names the primary and coordinating roles, the lockbox sequence, and the shift-change overlap. If it does not, that is the first gap to close.
2. Inventory your group lockboxes and hardware. Confirm you have enough boxes and personal locks for your largest realistic crew, and that the hardware is durable enough for the environment per 1910.147(c)(5).
3. Run a periodic inspection on an actual group job. Watch a real lockbox cycle from isolation to release, including a simulated shift change, and document it per 1910.147(c)(6)(ii).

If any of the three exposes a gap you cannot close internally, that is the call point. ECPL writes group lockout procedures, specs the lockbox hardware, trains primary and coordinating authorized employees, and delivers the documentation package that closes the (f)(3) and (c)(6) sub-paragraphs in one visit. We work from Chicago, Detroit, and Indianapolis with national travel, and the assessment is free.

Frequently Asked Questions

When is group lockout required instead of personal locks?

Group lockout applies when servicing or maintenance is performed by a crew, craft, department, or other group, per 1910.147(f)(3)(i). It is not a convenience option. Any time more than one authorized employee works under the same energy isolation, the program has to give each of them protection equivalent to a personal lock, which in practice means a group lockbox with a personal lock per worker.

Who is the primary authorized employee in a group lockout?

The primary authorized employee is the one person who carries primary responsibility for the set of employees working under the group device, per 1910.147(f)(3)(ii)(A). That person applies the isolation locks, verifies the zero-energy state, places the isolation keys in the group lockbox, and ascertains the exposure status of each group member. The role is named on the procedure, not assigned informally at the job.

How does a group lockbox actually work?

The primary authorized employee locks each energy-isolating device, then places those isolation keys inside the group lockbox and locks the box. Every authorized employee then affixes their own personal lock to the box before starting work and removes it when they stop, per 1910.147(f)(3)(ii)(D). The isolation keys cannot come out until the last personal lock is gone, so no one can re-energize while a worker is still exposed.

What happens to group lockout at a shift change?

1910.147(f)(4) requires specific procedures for shift and personnel changes to keep protection continuous. The standard practice is an orderly transfer: the outgoing crew's locks stay on until the incoming crew has placed theirs, and the incoming primary authorized employee re-verifies isolation before the outgoing crew clears. A gap during the handoff is the moment most group-lockout incidents happen.

Can a supervisor remove a worker's lock if that worker has gone home?

Only under the narrow lock-removal provision at 1910.147(e)(3). The employer must verify the worker is not at the facility, make all reasonable efforts to contact them, and ensure they know the lock was removed before they resume work. It has to be a documented, supervised exception. Routine cutting of personal locks off a group box is a serious citation and defeats the purpose of the program.

Does group lockout change the verification requirement?

No. 1910.147(d)(6) verification of a zero-energy state still applies, and on a group job the primary authorized employee performs and documents it before keys go in the lockbox. The difference is scale. With several workers about to enter the same machine, the try step has to confirm every energy type is at zero, not just the electrical disconnect, before anyone relies on the group device.