Management of change and pre-startup safety review

Flixborough in 1974 began with a change: a temporary bypass pipe installed to keep a plant running while a cracked reactor was removed. The pipe was designed in a chalk sketch on a workshop floor and failed two months later, killing 28 people. Since then, management of change (MOC) has been one of the central elements of every process safety framework. Plants are never static. Equipment is replaced, chemicals are substituted, set points are adjusted, software is updated and people come and go. Every change can introduce a new hazard or weaken an existing safeguard. This lesson explains what counts as a change, how an MOC process works, how temporary and organizational changes are handled, and how a pre-startup safety review (PSSR) checks that changed or new equipment is ready to run.

What counts as a change

The key idea is the replacement in kind. Replacing a pump with an identical pump, or a gasket with one of the same specification, is maintenance, not a change. Anything that is not a replacement in kind is a change and goes through MOC. The difficulty is that many changes look small. A different gasket material, a new supplier of the same chemical, a revised operating procedure, a raised alarm limit, a software patch to the control system or a reduced crew on night shift can all alter risk.

The MOC workflow

Most MOC procedures follow the same broad steps, although the paperwork and software differ. The level of review is scaled to the risk: a minor change may need a short checklist and one technical review, while a major change may need a full HAZOP.

In Canada, CSA Z767 and the CSChE PSM guide both include management of change as a core element, and federal and provincial regulators for pipelines, upstream oil and gas and pressure equipment expect it. The Canada Energy Regulator Onshore Pipeline Regulations, for example, require companies to have a process for managing change as part of their management system. Many provincial occupational health and safety regulators do not use the term MOC directly but expect hazards from changes to be assessed under the general duty to identify and control hazards.

Temporary and emergency changes

Temporary changes are a major source of incidents because they are often done quickly and then forgotten. A temporary hose becomes part of the plant for years; a clamp on a leaking pipe stays on after the planned shutdown has come and gone. Good practice treats temporary changes as full changes, with a hazard review, an explicit expiry date and a check at expiry that the change has been removed or converted into a permanent MOC. Emergency changes made outside normal hours still need a review, even if it is shortened, and should be fully documented and reviewed afterwards.

# Find temporary changes that are past expiry or due within 14 days (seeded example data).
import random
from datetime import date, timedelta

random.seed(311)
today = date(2026, 10, 1)
mocs = []
for i in range(1, 13):
    opened = today - timedelta(days=random.randint(10, 400))
    life = random.choice([30, 60, 90, 180])
    mocs.append({"id": f"TMOC-{i:03d}", "opened": opened,
                 "expires": opened + timedelta(days=life),
                 "removed": random.random() < 0.4})

overdue = [m for m in mocs if not m["removed"] and m["expires"] < today]
due_soon = [m for m in mocs if not m["removed"] and today <= m["expires"] <= today + timedelta(days=14)]
print(f"Temporary changes open: {sum(not m['removed'] for m in mocs)} of {len(mocs)}")
for m in sorted(overdue, key=lambda m: m["expires"]):
    print(f"  OVERDUE {m['id']}  expired {m['expires']}  ({(today - m['expires']).days} days)")
for m in due_soon:
    print(f"  due soon {m['id']}  expires {m['expires']}")

Temporary changes open: 8 of 12
  OVERDUE TMOC-007  expired 2025-12-28  (277 days)
  OVERDUE TMOC-012  expired 2025-12-31  (274 days)
  OVERDUE TMOC-001  expired 2026-08-07  (55 days)
  OVERDUE TMOC-002  expired 2026-08-09  (53 days)
  OVERDUE TMOC-011  expired 2026-08-20  (42 days)
  due soon TMOC-003  expires 2026-10-02
  due soon TMOC-006  expires 2026-10-03

A simple register like this, reviewed weekly, prevents temporary changes becoming permanent by default. Long-overdue temporary changes are also a useful leading indicator of how well the MOC system is working.

Organizational change

Changes to people and organization can weaken process safety as much as changes to hardware. Reducing a shift crew from four to three may leave too few people to respond to an upset. Losing an experienced engineer may remove the only person who understands why a safeguard exists. Outsourcing maintenance may break the link between the people who inspect equipment and the people who operate it. Investigations of Texas City and other accidents found that budget cuts and reorganizations had reduced staffing and expertise without any formal review. Good practice is to run organizational changes that affect process safety roles through a management of organizational change (MOOC) process, assessing workload, competence and the coverage of critical tasks before and after the change.

Pre-startup safety review

A pre-startup safety review (PSSR) is a check carried out before introducing hazardous materials into new or modified equipment. It confirms that construction matches the design, that safety, operating, maintenance and emergency procedures are in place and adequate, that the hazard review has been done and its recommendations resolved or tracked, and that people have been trained. A PSSR is typically carried out by a small team including operations, engineering and maintenance, who walk the equipment and check documents against what they see.

CSA Z767 and the CSChE guide include pre-startup review within the management of change and asset integrity elements.

Making MOC work in practice

An MOC procedure can be complete on paper and still fail. Audits and investigations point to a few recurring problems. The first is that people do not recognize a change, so it never enters the system: a maintenance planner orders a valve in a different material because the original is out of stock, or an engineer tweaks a controller tuning without thinking of it as a change. Training on what counts as a change, and a simple rule of asking when in doubt, address this. The second is that the review is done by people without the right expertise; a change to a relief system needs someone who understands relief design, and a change to reaction chemistry needs a chemist. The third is that the MOC becomes a bottleneck, so people find ways around it. A tiered process, with a fast route for low-risk changes and a full review for high-risk ones, keeps it usable.