Shift-Change Lockout/Tagout Under OSHA 1910.147(f)(4): Continuity of Protection Across Personnel Changes
A lock on a disconnect protects one person, and it protects everyone downstream of that machine. That protection cannot blink. Yet the single most predictable place it blinks is at shift change, when a maintenance job runs past the end of a shift and the isolation has to pass from one worker to the next. Handle that handoff wrong and there is a window, sometimes only a minute, when the equipment is fully de-isolated and anyone can bring it to life. OSHA wrote a specific provision to make sure that window never opens.
This guide walks through what 29 CFR 1910.147 requires at shift and personnel changes, the apply-before-remove transfer that satisfies it, how the handoff works on a group job with a lockbox, the failure modes that create a gap, and how to write the transfer into a procedure so it holds up in an audit.
What the Standard Requires
The requirement sits in the procedures section of the standard. 1910.147(f)(4) states that specific procedures shall be utilized during shift or personnel changes to ensure the continuity of lockout or tagout protection, including provision for the orderly transfer of lockout or tagout device protection between off-going and oncoming employees, to minimize exposure to hazards from the unexpected energization or start-up of the machine or equipment, or the release of stored energy.
Two words carry the weight: continuity and orderly. Continuity means the protection cannot lapse, not for a minute, not for a second. Orderly means the transfer is a defined sequence, not an ad hoc handoff improvised on the floor at 6:59. The standard does not prescribe one exact method, but it does demand that whatever method a facility uses, protection is unbroken from the off-going worker to the oncoming one. Everything else in this article is just how you deliver that.
The Gap the Rule Exists to Close
Picture the shortcut, because it is the reason the provision exists. A maintenance tech has a machine locked out for a repair that will not finish before end of shift. The obvious, wrong move is to remove their personal lock, hand the disconnect over to the incoming tech, and let that person apply their lock a moment later. In the seconds or minutes between, the energy isolating device is unlocked. The machine is exposed. If a startup happens then, whether from an automatic control, a well-meaning operator, or someone two aisles away, the person still working on the equipment has no protection at all.
That gap is not theoretical. It is exactly the scenario OSHA had in mind, and it is why the continuity language is written the way it is. The protection has to overlap through the handoff. There can be no instant when the machine is de-isolated and a person is still exposed. Close the gap and the shift change is routine. Leave it open and you have built a fatality window into your daily schedule.
The Correct Transfer: Apply Before Remove
The method that satisfies 1910.147(f)(4) is simple to state and easy to train: the oncoming employee applies their lock and tag before the off-going employee removes theirs. For a brief overlap both workers' devices are on the equipment at once. The off-going worker then removes their own device, and the machine remains locked out continuously, now under the oncoming worker's control. At no point is the isolation unlocked.
Where a single energy isolating device does not have room for two locks, a lockout hasp solves it. The hasp accepts multiple locks, so the oncoming worker's lock goes on the hasp before the off-going worker's comes off. The sequence, not the hardware, is the point. Whatever devices are used, the rule is the same:
| Step | Off-going employee | Oncoming employee |
|---|---|---|
| 1. Brief the incoming worker | Explains the job status, isolation points, and any stored energy | Verifies isolation and understands the scope |
| 2. Apply | Lock still in place | Applies own lock and tag to the device or hasp |
| 3. Remove | Removes own lock and tag | Lock remains, equipment still isolated |
| 4. Continue | Off shift | Sole authorized employee, protection unbroken |
The brief in step one matters as much as the locks. The oncoming worker is taking responsibility for an isolation they did not perform, so they have to independently confirm the energy is controlled: the right sources isolated, stored energy relieved or restrained, and, where appropriate, a verification that the equipment will not start. This is the same verification discipline that anchors every machine-specific energy control procedure. Taking a handoff is not taking someone's word for it.
Shift Change on a Group Lockout
Most real maintenance is not one person and one lock. It is a crew, and crews use group lockout. The shift-change principle is identical, applied to the group device. On a group job the energy is isolated and the isolation keys are secured in a group lockout box, and every authorized employee places a personal lock on that box, so the box cannot open, and the isolation cannot be released, while any lock remains.
At shift change, oncoming crew members place their personal locks on the group lockout box before off-going members remove theirs. The box stays continuously locked throughout, so the isolation it secures never releases. The primary authorized employee, the person accountable for the group procedure, hands that role to a qualified oncoming counterpart the same way, with a clear briefing on the state of the work. The full mechanics of group devices and the primary authorized employee role are covered in our guide to group lockout/tagout procedures. Shift change is simply that system carried across the clock without a break.
Where Shift Changes Go Wrong
Most shift-change deficiencies fall into a few repeatable patterns, and every one of them reintroduces the gap the rule is meant to close.
- Remove before apply. The off-going lock comes off first and the oncoming lock goes on a beat later. This is the core violation, and it is usually a habit, not a decision.
- No relief, lock left on and abandoned. A worker finishes their shift with the job incomplete and simply leaves, expecting someone to sort it out. Nobody formally takes over, and accountability for the isolation goes blank.
- Handoff without a briefing. The oncoming worker inherits a lock but not the knowledge of what is isolated, what stored energy remains, or how far the job got. They are now the authorized employee for a hazard they never assessed.
- Removing an absent worker's lock to keep production moving. When the off-going worker has already left with their lock still on, the temptation is to cut it off. That is its own regulated procedure, not a shift-change step, and we cover it in removing a lockout device when the authorized employee is absent.
The through-line is accountability. At every instant, one identifiable authorized employee owns the isolation, and the transfer of that ownership overlaps so it is never unheld. When a facility cannot say who owned the lock at 7:00 sharp, that is the finding.
Writing It Into the Procedure
Because 1910.147(f)(4) calls for specific procedures, a vague statement that shifts will transfer locks safely does not meet it. For equipment that is routinely serviced across shifts, the energy control procedure should spell out the handoff as a defined sequence. A defensible procedure does four things:
- States the apply-before-remove rule explicitly. The oncoming device is applied before the off-going device is removed, every time, with no exception for a quick job.
- Requires a documented briefing. The off-going worker communicates isolation points, stored energy status, and job progress, and the oncoming worker independently verifies isolation before accepting the handoff.
- Addresses the group case. For crew work, the procedure ties the transfer to the group lockout box and names how the primary authorized employee role is handed off.
- Trains authorized employees on it. The handoff is practiced, not assumed. Authorized employees can demonstrate the overlap on the actual hardware they use.
This is a standing item whenever we run a LOTO gap analysis, because multi-shift facilities almost always have the locks and the training but not a written transfer step, and an undocumented handoff is one an inspector can question. The fix is small and the payoff is large: a shift change that is a defined, trainable sequence instead of a daily improvisation over live equipment. OSHA's own lockout/tagout eTool on shift and personnel changes reinforces the same continuity principle.
Free LOTO Assessment
ECPL audits your energy control program against 1910.147, including the shift-change transfer, group lockbox handoffs, and machine-specific procedures for multi-shift equipment. Chicago, Detroit, Indianapolis, national travel.
Request Your AssessmentFrequently Asked Questions
What does OSHA 1910.147(f)(4) require during a shift change?
It requires specific procedures to ensure the continuity of lockout or tagout protection during shift or personnel changes, including an orderly transfer of devices between off-going and oncoming employees. The goal is to prevent any moment where the equipment is unprotected and could be started or re-energized while someone is still exposed to the hazard.
How do you transfer a lockout device at shift change?
The oncoming employee applies their own lock and tag before the off-going employee removes theirs. For a moment both sets of devices are on the equipment, so protection never lapses. The off-going worker then removes their device, and the machine stays locked out under the oncoming worker's control. Apply before remove is the whole principle.
Why is the shift-change handoff a common LOTO failure?
Because the easy shortcut leaves a gap. If the off-going worker removes their lock first, walks the isolation over, and the oncoming worker applies theirs a minute later, the equipment sits unlocked in between. In that window anyone can energize it. The standard requires the overlap precisely to close that gap, and a procedure that does not spell out apply-before-remove invites the shortcut.
How does shift change work with a group lockout box?
On a group job the energy isolation is secured and the keys are held in a group lockout box that each authorized employee locks. At shift change, oncoming crew members place their personal locks on the group box before off-going members remove theirs, so the box, and the isolation it secures, stays continuously locked. The primary authorized employee role is handed off the same way.
Does OSHA require a written procedure for shift changes?
The energy control procedure has to include the specific means to ensure continuity of protection at shift or personnel changes. Machines that are commonly serviced across shifts should have the transfer method documented and trained, so the handoff is a defined step rather than an improvised one. An undocumented handoff is a finding waiting to happen during an inspection.
What happens if no one relieves the off-going worker at shift change?
If the servicing is not complete and no oncoming employee takes over, the equipment must remain locked out. The off-going worker does not simply remove their lock and leave energized equipment unattended. If the job is finished, normal restoration and startup steps apply. If it is not, the lockout continues under a properly transferred authorized employee, never a gap.