A lockout padlock is the cheapest piece of safety equipment on site and the most consequential: the red lock hanging on a breaker is the only thing standing between a fitter inside a machine and someone restoring power to it. That makes the routine reality of LOTO stock - the shadow board with two empty hooks, the hasp that left with a contractor, the padlock nobody can match to an owner - more serious than the hardware’s price suggests. This guide covers tracking lockout tagout devices the way the procedure assumes: every lock owned, every station complete, every device on an isolation point traceable to a person.
What you will learn
- Why LOTO devices wander
- Personal locks and station stock are different problems
- The device register
- Shadow boards and QR station audits
- Issuing, returning and lost keys
- Tools that make this easier
- FAQ
Why LOTO devices wander
LOTO hardware is small, cheap per piece, and scattered across exactly the places people work under pressure. The losses follow a pattern:
- Devices stay on the equipment. A job finishes, the isolation is cleared, and the hasp or valve cover stays hanging where it was applied - now part of the machine’s scenery until someone needs it elsewhere.
- Stations get cannibalised. The nearest board is short a breaker lockout, so one is borrowed from the next board over. Both boards are now wrong, and neither shortfall is recorded.
- Contractors come and go. Visiting trades are issued locks for the job; the locks leave in toolboxes. Without an issue record, there is nothing to recover.
- Orphan locks accumulate. A padlock with no known owner turns up on a fence, in a drawer, or worst of all on an energy isolation point - and an unowned lock on an isolation point is a procedural emergency, not a tidiness problem.
The cost of a missing hasp is not the hasp. It is the fitter who improvises an isolation because the right device was not on the board.
Personal locks and station stock are different problems
A LOTO register tracks two populations with different rules.
Personal locks belong to one worker: individually keyed, one key, marked with the owner’s identity. One worker, one lock, one key is segregation of duties applied to energy isolation - the person exposed to the hazard is the only person who can remove the protection. These are issued like any personal equipment, recovered at offboarding, and never pooled. A drawer of shared red padlocks is not a LOTO programme; it is a colour scheme.
Station stock belongs to a place: hasps for multi-worker locks, valve and plug covers, breaker lockouts, group lock boxes, tags. These live on shadow boards or in LOTO stations near the equipment they serve, and the unit of tracking is the station - what should be on this board, and is it all here.
Mixing the two models is the root failure: personal locks drifting into station drawers lose their owners, and station hasps issued personally never come home.
The device register
| Field | Why it matters |
|---|---|
| Device ID | Engraved or tagged on the device - what the audit reads and the incident report quotes |
| Type | Padlock, hasp, valve cover, breaker lockout, group box - each has its own count per station |
| Key number | Confirms one key exists per lock, and matches found keys to retired locks |
| Colour / coding | Sites colour-code by trade, department or contractor status; the record makes the code enforceable |
| Assigned worker or station | The ownership line - every device resolves to exactly one name or one board |
| Condition | Weathered shackles and cracked valve covers fail at the worst moment; condition notes feed replacement |
| Status | In service, issued, lost, retired - “lost” is a real status, not a blank row |
Padlocks usually arrive engravable or come laser-marked; specialist devices take small laminated QR labels on flat faces, kept clear of shackles and hinge points. Where a device offers no label surface at all, the ID lives on a collar tag or on the station list instead.
Tip: photograph every fully stocked shadow board and attach the photo to that station’s record. An audit becomes a visual diff - two empty hooks against the photo is a finding in five seconds, no counting required.
Shadow boards and QR station audits
Shadow boards already do half the tracking - an empty silhouette is a missing device announcing itself. The register supplies the other half: a QR label on the board itself opens the station’s record, with its contents list and check history, so the recurring audit is scan, compare, log. Found a gap, chase it today; found a stranger’s padlock, the key number says whose it is.
Fold the station walk into a rhythm that already exists - the same weekly or monthly round that checks fire extinguishers and first aid kits can sweep the LOTO stations, since all three are stationed equipment whose job is to be complete and in place. Keep the cadence honest: an audit trail with gaps reads, to a regulator, much like a board with gaps.
Issuing, returning and lost keys
Treat personal LOTO issue as part of onboarding: lock, tags and any trade-specific devices issued against the worker’s name, recorded as a checkout with a date. Contractors get the same treatment with a return date attached - the issue record is what makes recovery a request instead of a shrug. At offboarding, the open-issues list does the remembering, exactly as it does for respirators and other personal safety equipment.
Lost keys have one correct ending: the lock retires. A spare or master key would put a second person in control of a personal lock, which defeats the entire mechanism, so the register records the old lock as retired and the replacement as issued. A lock abandoned on an isolation point is removed only through the site’s formal lock-removal procedure, with the event noted on the device’s history.
Tools that make this easier
Spreadsheets handle LOTO badly for one structural reason: the system’s truth lives on boards and breakers across the site, and the sheet lives in an office. Every audit becomes transcription, every transcription lags, and the register ends up describing last quarter’s boards.
AMPthilly closes that gap by making each device and each station an asset with its own record - type, key number, assigned worker or station as the owner, condition notes, photos and a permanent history of issues, returns, transfers and status changes. QR labels on stations and devices open the right record in a phone browser from the workshop floor, no app install, and audit findings become tickets with photos attached. The free plan covers 3 users and 25 assets - enough to run every station on a small site - and the full feature list is at /features/.
FAQ
Should every worker have their own lockout lock? Yes - one worker, one lock, one key, identified to the owner and never shared. The register makes that ownership explicit and auditable.
How do you keep track of lockout tagout devices? ID every device, assign personal locks to workers and station stock to boards, audit stations on a recurring schedule, and retire lost devices in the register.
What belongs in a lockout tagout device register? ID, type, key number, colour coding, assigned worker or station, condition and status - plus a contents list per station for audits.
What should happen when a LOTO lock key is lost? Retire the lock and issue a replacement; spare keys defeat personal control. Locks on isolation points come off only via the formal removal procedure.
How often should LOTO stations be audited? On an existing rhythm - weekly walks or monthly safety rounds - comparing each board to its contents list and chasing gaps immediately.
The takeaway
Lockout tagout only works when the hardware layer is as disciplined as the procedure: personal locks with named owners and single keys, stations with contents lists that match their boards, contractors issued and recovered like employees, and lost devices retired on the record. Track the devices that way and the lock hanging on a breaker always answers the only question that matters - whose is it, and is the person it protects still inside the machine.