PDO Contractor Maintenance Standards: Work Control and Evidence Requirements

This is for the maintenance manager, planner or HSE lead of a contractor holding or bidding an O&M scope on Petroleum Development Oman assets. After reading it you should be able to name, per requirement, the artefact an auditor will ask for, who holds it, and where your current system breaks the chain.

How to read the claims below

PDO's sites (pdo.co.om and hsedocs.pdo.com.om) were not reachable from our research environment. The PDO specification content here comes from mirrored copies on third-party document sites, and we name the revision we read. Confirm against the live document before writing a procedure around it. Every requirement carries one of three labels:

• (PDO-published): traceable to a named PDO specification, revision cited.
• (Industry standard): from IOGP or ISO, normal in Omani upstream, not traceable to a PDO clause.
• (Unverified): commonly described as a PDO requirement, not confirmed against a PDO document.

JSRS before anything else

Since 1 July 2021 the Ministry of Energy and Minerals has required every supplier bidding into an Omani oil and gas operator tender, PDO included, to hold an active certificate on the Joint Supplier Registration System (JSRS), run by Business Gateways on the Ministry's behalf. National suppliers hold three years, international suppliers one or three, with a ten-day grace period after expiry. (PDO-published via the Ministry mandate.)

The failure is administrative: JSRS expiry sits with a commercial administrator, tender dates sit with a bid team, and nobody reconciles the two until a submission bounces. PDO also runs its own pre-qualification above JSRS. [NEEDS SOURCE: current PDO pre-qualification steps and endorsement validity periods.]

Work control: the permit lifecycle, and where the work order sits

SP-2329, Permit to Work Specification for PDO Operations, revision 2.0 dated June 2020, owned by the UOP Functional Operations Manager, defines four authorisation routes. (PDO-published, rev 2.0; confirm the current revision.)

Route	Maximum duration	Distinctive requirements
Class A PTW	14 days, extendable by 7	72-hour notice, Production Coordinator approval, mandatory Job HSE Plan, daily revalidation by the Area Authority
Class B PTW	Set by hazard assessment	Responsible Supervisor authorisation, site examination before work starts
Task SOP PTW	7 days	Risk assessment attached, daily revalidation by the Permit Holder, daytime hours 06:00 to 19:00
No Permit Job	Task-dependent	Written procedure, TRIC card, competent staff, licensed supervisor

The lifecycle runs: application against the 14-day plan, permit meeting and briefing of the Permit Holder by the Permit Applicant, pre-issue site examination and authorisation by the Responsible Supervisor, daily revalidation by the Area Authority, ongoing control and gas testing by the Permit Holder, documented changeover when key personnel rotate, then cancellation and archiving by the discipline supervisor.

Read the first step again. The permit application is made against the 14-day plan. That clause is why a PDO scope cannot be run from a reactive queue. A job absent from the plan fourteen days out has no permit route on the day you want it, and Class A work needs 72 hours of notice. Three consequences:

1. The permit number belongs on the work order, as a field populated before the job goes to the field. Without it, nothing traces to its authorisation.
2. Duration limits are work order constraints. A turnaround job planned at 25 days exceeds a Class A permit plus its extension, so it needs a second application, briefing and authorisation cycle.
3. Daily revalidation produces daily evidence. If your system records only "started" and "completed", you cannot show that days three and four were authorised.

The interaction that reliably goes wrong is a work order marked complete whose permit was never cancelled, or a permit cancelled while the work order stays open with plant still isolated.

Isolation and energy control evidence

SP-2329 places mechanical and electrical isolation with a named Isolating Authority and runs it through a defined sequence: isolation request, design, approval, application of the isolation template, physical securing of isolation points, and proving the isolation before work starts. Isolations are recorded, Extended Period Isolations (EPIs) carry additional audit requirements, and de-isolation, including test de-isolation, is a controlled step in its own right. (PDO-published, SP-2329 rev 2.0.)

The evidence an auditor wants is not the certificate. It is the chain: which work order drove the request, who designed and approved it, what proof of isolation was recorded and by whom, whether the EPI register holds anything past its review date, and whether de-isolation was signed before the work order closed. Most maintenance systems hold none of it, because the certificate lives in the operator's permit system or on paper. If your record is a scanned PDF filed by date, one work order's chain takes an afternoon to rebuild and a quarter's sample takes a week.

(Industry standard.) Energy isolation is one of the nine IOGP Life-Saving Rules in Report 459 (2018), alongside work authorisation, line of fire and working at height. PDO publishes its own Life Saving Rules set. [NEEDS SOURCE: the exact PDO rule list and current version, and how a breach is classified and escalated.]

Competency records and their expiry

SP-1157, HSE Specification: HSE Training, sets training and competency requirements for contractor personnel. The copy we read is revision 2.3 dated August 2015, owned by Learning and Development; a file named SP-1157 v 4.1 HSE Training Specification appears in PDO's 2024 contractor portal listing, so treat the older revision's detail as indicative. (PDO-published, rev 2.3 read, rev 4.1 current.) The structural points that survive revision:

• Courses are delivered by PDO-approved training providers (ATPs). A certificate from an unapproved provider is not evidence.
• Requirements are role-based: forklift operator, mobile crane operator, rigger and banksman, authorised gas tester, first aid and confined space rescue each carry their own course and revalidation interval.
• Revalidation intervals differ by course, in the range of two to four years in the revision we read. [NEEDS SOURCE: current per-course validity periods in SP-1157 rev 4.1.]
• Where no prior industry certification exists, competency must be assessed after training within a stated window, so a training certificate alone does not close the requirement.
• The revision we read states all courses require a current and valid HSE Passport. [NEEDS SOURCE: the HSE Passport scheme's present name, issuing body and validity.]

Separately, SP-2329 lists formally licensed permit roles: Permit Applicant, Permit Holder, Production Coordinator, Responsible Supervisor, Area Authority, Other Affected Custodian, Authorised Gas Tester, Isolating Authority and Area Planner, with licensing referred to GU-624. (PDO-published, SP-2329 rev 2.0.) This is the requirement that stops work on a Thursday afternoon: the crew's only licensed Permit Holder has a licence that expired on Tuesday and nobody was watching.

Competency data therefore needs two properties a training spreadsheet lacks: queryable by expiry across the whole workforce, and checked at dispatch rather than at mobilisation. A crew list validated at contract start is worthless by month nine.

Contractor HSE plan and bridging documents

(Industry standard.) IOGP Report 423, HSE Management Guidelines for Working Together in a Contract Environment (April 2017), is the reference model for client and contractor HSE interface management, supported by 423-01 on contractor capability assessment and 423-02 and 423-02A on preparing HSE plans. If your HSE plan template does not map to 423-02, an assurance reviewer will notice.

The bridging document names, clause by clause, whose procedure governs where the two systems differ: whose permit system applies (PDO's), whose incident classification, whose emergency response plan where, whose competency standard is the higher. [NEEDS SOURCE: whether PDO mandates a bridging document by name for maintenance contracts.] Written at award and never revisited, it is the most common contractor assurance finding. Put a review trigger on it: any scope variation, any new subcontractor, any change of PDO area authority.

(Industry standard.) ISO 45001:2018 is the OH&S management system standard most operators expect a maintenance contractor to hold. [NEEDS SOURCE: whether PDO requires certified ISO 45001 or accepts a demonstrated equivalent.]

Equipment certification and third-party inspection

Lifting equipment, pressure equipment, portable electrical equipment and measurement instruments each carry certification with an expiry, and each expiry belongs against the physical item, not in a folder. (Industry standard. PDO publishes discipline specifications including SP-2050 for construction and SP-2275 covering lifting, neither retrievable from our environment.)

The practical test: pick any sling, shackle, crane, torque wrench or gas detector on site and ask how long it takes to produce its current certificate and next due date. If the answer involves a phone call, an auditor will find an expired item within the hour, because they sample twenty and need one. [NEEDS SOURCE: PDO's requirements for third-party inspection bodies, accepted certifying bodies in Oman, and tagging conventions for in-date lifting gear.]

Incident reporting and assurance reporting

(Unverified.) We could not retrieve PDO's incident reporting and investigation specification, so we will not state a notification deadline. The requirement shape across upstream operators is immediate verbal notification for high-potential events, written notification within a short fixed window, a preliminary report, then a full investigation with actions due by a defined date. Contractors typically report into the operator's system as well as their own, and that duplicate entry suppresses near-miss reporting. [NEEDS SOURCE: PDO's incident notification timelines by severity class, the classification scheme, reporting route and investigation due dates.] Take these from your contract's HSE schedule, not from any general article including this one.

(Unverified.) Monthly HSE performance reporting is standard on Omani upstream maintenance contracts, typically covering exposure hours, lagging indicators (recordable injuries, LTIs, vehicle incidents), leading indicators (site HSE visits, toolbox talks, near-miss reports, permit audits) and action close-out. [NEEDS SOURCE: PDO's mandated contractor KPI set, frequency and metric definitions.] The definition that causes most argument is exposure hours: derived from payroll rather than timesheets booked against work orders, it includes hours nobody worked on site and excludes subcontractor hours.

Requirement, evidence, holder, gap

Requirement	Evidence artefact	Who holds it	Common gap
Bid eligibility	Active JSRS certificate	Commercial administrator	Expiry not reconciled against the bid calendar
Work authorisation	Signed PTW, permit number on the work order	Operator permit office, contractor copy	Work order closed with no permit reference
Planning window	Job in the 14-day plan, Class A raised 72 hours ahead	Contractor planner, operator area planner	Same-day job raising, then "waiting on permit" booked as labour inefficiency
Energy isolation	Isolation certificate, design and approval, proving record, EPI entry, de-isolation sign-off	Isolating Authority	No isolation reference on the work order, de-isolation not evidenced
Competency	Certificates from approved providers, competency assessment, HSE Passport, GU-624 licence	Training coordinator	Validity checked at mobilisation only, never at dispatch
HSE management system	HSE plan mapped to IOGP 423-02, bridging document, interface matrix	Contractor HSE manager	Bridging document frozen at award, not revised after scope change
Equipment certification	Third-party inspection and calibration certificates linked to the item	Plant and equipment controller	Certificates filed by date, not against the asset or tool record
Incident reporting	Notification, preliminary report, investigation, action close-out	Contractor HSE, mirrored to operator	Duplicate entry into two systems suppresses near-miss reporting
Assurance reporting	Monthly HSE report with exposure hours	Contractor HSE	Exposure hours from payroll rather than timesheets against work orders
Audit readiness	Indexed evidence pack retrievable per work order	Contractor	Evidence split across permit files, spreadsheets and email

Mobilisation sequence for a new PDO scope

The order matters, because several steps gate others and the dependencies are not obvious until you are three weeks late.

1. Confirm JSRS status and remaining validity before the bid. Renew if under six months remain.
2. Extract the contract HSE schedule into one register of named specifications, reporting obligations and deadlines. This is the authoritative list, not general guidance.
3. Retrieve current revisions of the PDO specifications it names, starting with permit to work and HSE training. Record the revision you are working to.
4. Write the HSE plan against IOGP 423-02 structure, allowing time for one rejection cycle.
5. Draft the bridging document clause by clause, approved with the operator's HSE representative named on it.
6. Baseline the competency matrix: every role, every required course, every certificate with its expiry, every gap.
7. Book training and licensing for the licensed permit roles first. Longest lead times, and they gate everything else. Nominate more Permit Holders than the minimum so one expiry does not stop work.
8. Certify the equipment: third-party inspection for lifting and pressure equipment, calibration for test instruments, each certificate loaded against the item record with its expiry.
9. Register subcontractors and hold their competency, equipment and insurance evidence under the same rules as your own.
10. Build the work order to permit link before go-live: permit number, permit class, isolation certificate reference, revalidation records.
11. Run the 14-day planning horizon in parallel for two cycles. Discover the permit refusals in a dry run, not in week one.
12. Agree KPI definitions in writing, especially exposure hours, before the first monthly report.
13. Audit yourself two weeks after go-live. Sample ten completed work orders and try to produce the full evidence chain for each. Whatever you cannot find in ten minutes is a real gap.

Where teams get this wrong

Treating the permit as the operator's paperwork. The permit constrains scheduling, duration and shift pattern. Teams that plan the job first and apply second discover that continuous night working cannot run under a Task SOP permit, which is limited to 06:00 to 19:00.

Competency checked at the wrong moment. Mobilisation-day checking is the norm and it is insufficient. A nine-month contract will see dozens of certificates lapse. The check has to run when the crew is assigned to the job.

One-way evidence flow. Contractors record what they did. Auditors ask what authorised it. A work order history with tasks, hours and parts but no permit number, no isolation reference and no competency snapshot cannot answer the second question at all.

Reconstructing evidence at audit time. Capturing a permit number at job release costs seconds. Rebuilding which permit covered which work order eight months later costs days, and the rebuild is itself a finding, because it shows the link was never controlled.

What to automate, and what not to

Automate the linkage and the expiry. A maintenance system should carry permit number, permit class, isolation certificate reference and revalidation records as fields on the work order, refuse to close a work order whose isolation has not been signed off, hold every competency and certification with its expiry, and block assignment of a licensed permit role to someone whose licence has lapsed. It should generate exposure hours from the same timesheets that feed the work orders. These are deterministic rules and software does them better than people.

Do not automate the judgement. The permit is issued by a named PDO authority after a site examination, and no system should imply it can pre-approve one. Risk assessment, isolation design and gas testing are competent human acts with signatures attached. Incident classification is a judgement call, and a workflow that auto-classifies will be wrong in the cases that matter most. The system holds the evidence. People make and sign the decisions.

FAQ

Does PDO accept a contractor's own permit to work system? SP-2329 rev 2.0 refers to contractor PTW systems being subject to a minimum five-year review cycle, which implies they exist in some contexts. On PDO operational assets, work is authorised under PDO's system. [NEEDS SOURCE: the circumstances in which a contractor PTW system is accepted and the approval route.]

How far ahead does maintenance work need to be planned? The permit application under SP-2329 is made against the 14-day plan, and Class A work needs 72 hours of notice. Treat 14 days as the planning horizon and 72 hours as the hard floor for high-risk work.

What happens when a permit expires mid-job? A Class A permit runs 14 days with one 7-day extension. Beyond that the work needs a new permit, with a fresh application, briefing and authorisation. Plan long jobs around permit boundaries.

Do subcontractor records have to meet the same standard? In practice, yes. Sub-tier competency, equipment and insurance gaps are recorded against the prime contractor at audit. Hold sub-tier evidence in the same system and under the same expiry rules as your own.

Where a system helps

These requirements are not primarily an HSE problem. They are a records problem with an HSE consequence. Almost every gap in the table is the same failure: an artefact exists, somebody holds it, and nothing connects it to the work order it belongs to.

A maintenance system of record earns its place by carrying permit number, permit class, isolation certificate reference and revalidation dates as fields on the work order, by holding competency and equipment certification with expiry dates that gate assignment, and by making the evidence chain for any completed job retrievable in one query. That is what KreupAI eAMS is configured to do on Omani upstream O&M scopes. It does not issue permits, and it is not approved or endorsed by PDO. It holds the record proving the permit existed, that the person doing the work was licensed to, and that the isolation was proved first.

Related reading: What Is ICV in Oman? How In-Country Value Scoring Treats Maintenance Spend (KB-019).

Sources

• PDO SP-2329 rev 2.0 (June 2020), Permit to Work Specification for PDO Operations, mirrored copy, PDO host unreachable from our environment
• PDO SP-1157, HSE Specification: HSE Training, mirrored copy of rev 2.3 (2015); rev 4.1 (2024) is listed on PDO's contractor portal
• PDO HSE for Contractors document portal, publisher location, not retrievable from our environment
• JSRS FAQs, Joint Supplier Registration System
• IOGP Report 423, HSE Management Guidelines for Working Together in a Contract Environment (April 2017)
• IOGP Report 459, Life-Saving Rules (2018)
• ISO 45001:2018, Occupational health and safety management systems