Authorisation management means tracking, for each employee, the authorisations their role requires, their validity and their renewal. Alerts, reminders, bookings and evidence can be automated, whereas issuing the authorisation, setting how often refresher training takes place and making calls on the rota remain human decisions.
What is authorisation management?
Authorisation management covers everything that ensures an employee is permitted to carry out a high-risk task at the moment they do it: identifying the authorisations each role requires, obtaining them, tracking their validity, renewing them and keeping the evidence up to date.
Example: an electrical fault on a Monday morning
Take a typical situation. Monday, 6.30 am, on a packaging line: a variable speed drive trips and the line stops. The team leader looks for a maintenance electrician. The HSEQ team's spreadsheet shows that the team's electrician holds an electrical authorisation valid until October, with refresher training planned for September, but nobody knows whether the session actually took place. The HSEQ manager does not arrive until 8 am, and the line waits. An expired authorisation gives no warning: it is often at the moment of intervening that people discover the information is missing.
Who issues an authorisation, and for how long?
In the UK, the employer judges whether a person is competent and authorises them, not the training provider. The law sets no fixed period for electrical authorisations or lift truck training: the employer decides when refresher training is due, based on risk. Construction plant cards carry their own expiry dates.
| Authorisation | Who issues it? | Validity |
|---|---|---|
| Electrical work | The employer, who judges competence (Regulation 16) | Set by the employer; live working only in the strict cases allowed by Regulation 14 |
| Lift truck operation | Accredited training, then written authorisation by the employer | No legal period; HSE's L117 gives three to five years as an example |
| Construction plant (CPCS card) | The CPCS scheme, after tests | Blue card: 5 years; red card: 2 years, not renewable |
For electrical work, these rules come from the Electricity at Work Regulations 1989, which require anyone working on electrical systems to be competent to prevent danger, or supervised by someone who is [Adapted for the UK context].
Which stages in the life cycle of an authorisation can be automated?
The life cycle of an authorisation has six stages: obtaining, validity, alert, reminder, booking and evidence. At each one, automation takes care of calculating, sending and filing, whilst a named person keeps the decision. This division of roles prevents both oversights and loss of control over the process.
| Stage | What can be automated | What a person decides |
|---|---|---|
| Obtaining | Recording the training assessment | Issuing the authorisation (employer) |
| Validity | Calculating the expiry date | Setting the refresher frequency |
| Alert | Sending it at the right time, to the right person | Choosing the notice period |
| Reminder | Prompting if nothing has been scheduled | Balancing it against the workshop's workload |
| Booking | Suggesting sessions | Choosing the date |
| Evidence | Filing, updating the matrix | Checking any discrepancy |
The right-hand column stays short and valuable: it is where the expertise of the HSEQ manager and managers is concentrated.
Why does tracking authorisations in a spreadsheet put a site at risk?
Tracking authorisations in a spreadsheet puts a site at risk because the information is scattered: expiry dates with HSEQ, bookings with the training team, personal lists with managers. Every renewal is then handled by hand, and the reliability of tracking depends on the vigilance of a handful of people.
The most demanding situations
On an industrial site, the situations that put this tracking to the test are well known. An agency worker arrives to provide extra support and must be authorised before their first job. A night call-out is covered by a technician from another site. A contractor working under a permit to work needs someone on the site side who is authorised to oversee the job [Adapted for the UK context]. In each of these cases, someone has to find the right row in the right file, and it has to be up to date. On audit day, the authorisations, certificates and permit records still have to be gathered from scattered folders, even though this evidence already exists.
Are all expiry dates equal? The authorisation criticality grid
Not all authorisation expiry dates call for the same urgency. A criticality grid combines three criteria: the severity of the risk covered, the number of authorised people on the workstation and how long it takes to get a refresher session. It helps you deal first with authorisations whose expiry would stop operations.
| Criterion | Moderate priority | High priority |
|---|---|---|
| Severity of the risk | Simple tasks, on dead systems | Live working, working at height |
| Authorised people on the workstation | Several people available to cover | Only one authorised person |
| Access to refresher training | Frequent sessions | Rare sessions, or sessions that fill up quickly |
How to use the grid
As a guide, an authorisation that meets two high-priority criteria is best planned at least three months before it expires. This grid is built with the HSEQ manager and managers, workstation by workstation, and is then used to set the alert notice periods for each authorisation.
How does a renewal workflow work in practice?
A renewal workflow automatically links the steps that come before an expiry date: an alert to the manager, suggested sessions, the booking, a reminder to the employee, then an update to the authorisation and the matrix as soon as the certificate arrives. Timings are set according to how critical each authorisation is.
The electrician's refresher training, from July to September
Back to the electrician, this time with a workflow in place. In July, his manager receives an alert: the electrician's authorisation expires in October, and two refresher sessions are suggested in September. The manager chooses a date that fits the maintenance schedule, and the electrician receives the joining instructions. In early September, with no confirmation of attendance, a reminder goes to the manager and the HSEQ manager. After the session, the provider's assessment is recorded and the employer signs the new authorisation. The matrix then shows the new expiry date. With Klara, these renewal workflows run without any re-keying, using the data that is already available.
How do you make the right to act visible to every manager?
The right to act becomes visible when every manager can consult an up-to-date authorisation matrix, filtered on their team and workstations: they can see who is authorised for which task, until when, and who can cover for an absent colleague on a high-risk job, without having to call the HSEQ team.
The same fault, with an up-to-date matrix
Back to Monday, 6.30 am. The team leader opens the authorisation matrix on the workshop tablet and filters on electrical authorisations. They can see that the electrician's authorisation was renewed in September, and that a second technician in the team is also authorised. The job can start without waiting until 8 am. For the HSEQ manager, the same data can be read across the site or several sites, with the expiry dates for the next three months. The matrix becomes the visible face of a process that runs continuously, rather than a file brought up to date the day before an audit.
What can AI bring to authorisation management?
AI helps to prioritise authorisation management: among hundreds of expiry dates, it brings out the ones that matter most, such as critical authorisations that will soon expire or workstations at risk of being left without an authorised replacement. It directs attention, without issuing or withdrawing any authorisation.
What AI brings out in Klara
On a site that tracks several hundred authorisations, the list of expiry dates for the quarter does not say where to start. In Klara, AI cross-checks expiry dates with the number of authorised people per workstation and brings out the priority risks, site by site. The HSEQ manager therefore knows where to focus efforts during the week, and the site director has a clear summary before their monthly review. This reading builds on the criticality grid drawn up with the teams: AI sheds light on the priority, and the people responsible choose the action.
Where should you start when automating authorisation management?
To automate authorisation management, the simplest approach is to start from what already exists: list the authorisations required for each role and their expiry dates, set the renewal rules with HSEQ, then run a pilot on a limited scope before extending the approach to other sites.
Take stock of authorisations by role and by site, using the existing files.
Build the criticality grid with the HSEQ manager, workstation by workstation.
Set the rules: refresher frequency, alert notice periods, people to notify.
Run a pilot on one site or one family of critical authorisations.
Measure expired authorisations and the time spent preparing audits, before and after.
To see each stage at a glance, explore our infographic on the life cycle of an authorisation, or download the white paper on the authorisation matrix.
