Management of change

Change is one of the most common precursors of serious incidents. A new piece of equipment, a modified procedure, a different chemical, a reorganized shift pattern, a temporary repair, a new contractor or the departure of an experienced worker can all introduce hazards that existing assessments and controls do not address. Many major industrial disasters, including the 1974 Flixborough explosion in the United Kingdom, where a temporary pipe bypass failed and killed 28 people, have been traced to changes made without proper assessment. Management of change (MOC) is the process that makes sure changes are reviewed for hazards before they are made. This lesson explains what counts as a change, why changes are risky, the steps of an MOC process, temporary and emergency changes, organizational changes, and how to make MOC practical.

What counts as a change

Changes that need hazard review include:

• Equipment and facilities: new or modified machinery, piping, electrical systems, controls, software, buildings and layouts; replacement with non-identical parts.
• Processes and procedures: new tasks, changed operating limits, new methods, revised procedures and changes in production rates.
• Materials: new chemicals or suppliers, different concentrations or forms, new raw materials.
• People and organization: reorganizations, staffing reductions, new shift patterns, loss of key expertise, new supervisors, outsourcing and new contractors.
• Conditions: seasonal changes, new neighbors or nearby activities, changes in regulations or standards.
• Temporary situations: temporary repairs, bypasses of safety systems, temporary equipment and workarounds.

A replacement in kind, such as an identical part from the same manufacturer meeting the same specification, is usually not a change requiring full MOC, but organizations should define clearly what is and is not a replacement in kind.

Why changes are risky

Changes are risky because existing assessments, procedures, training and controls were designed for the old situation. People may not realize that a small change has large effects: a larger pump may overpressure downstream equipment; a new cleaning chemical may react with residues; a shift from two-person to one-person crews may leave no one to call for help; a software update may change alarm behavior. Changes are often made under time or cost pressure, by people who do not see the whole system, and their effects may be delayed. Communication gaps mean that operators, maintenance staff and contractors may not know a change has occurred.

The steps of an MOC process

A typical MOC process includes:

• 1. Request: the person proposing the change describes what will change, why, the scope and the timing.
• 2. Screening: decide whether the change requires MOC and what level of review is needed, based on its potential hazards.
• 3. Hazard review: a team with the right expertise identifies hazards introduced or affected by the change and decides on controls, using methods appropriate to the risk, from a checklist to a HAZOP.
• 4. Approval: an authorized person approves, modifies or rejects the change, based on the review.
• 5. Implementation: the change is made with the required controls, and procedures, drawings, training, labels and safety data sheets are updated.
• 6. Communication and training: everyone affected, including operators, maintenance staff, contractors and emergency responders, is informed and trained before the change takes effect.
• 7. Pre-start-up review: for significant changes to equipment or processes, a check confirms that construction matches the design, procedures and training are in place, and recommendations from the hazard review have been addressed before start-up.
• 8. Close-out: records are completed and filed, and the change is reviewed after a period of operation to confirm it works as expected.

Legal and standard requirements

In the United States, OSHA's Process Safety Management standard, 29 CFR 1910.119(l), requires employers to establish written procedures to manage changes, other than replacements in kind, to process chemicals, technology, equipment, procedures and facilities, addressing the technical basis, the impact on safety and health, modifications to operating procedures, time periods and authorization. Affected employees and contractors must be informed and trained before start-up, and paragraph (i) requires a pre-start-up safety review for new and significantly modified facilities. Outside PSM, OSHA's Recommended Practices and ISO 45001 call for hazard identification whenever changes occur, and California's IIPP rule requires hazard evaluation when new substances, processes, procedures or equipment are introduced.

Temporary and emergency changes

Temporary changes, such as a temporary bypass of an alarm or interlock, temporary equipment during repairs, or a temporary procedure during a shortage, are particularly dangerous because they are often made quickly and then forgotten, becoming permanent without review. Good practice requires temporary changes to go through MOC, with a defined expiry date, additional controls during the temporary period, and a review at expiry to remove the change or convert it to a permanent change through full MOC. Bypasses of safety systems should require specific authorization and be tracked on a register. Emergency changes made to prevent immediate harm may need to proceed before full review, but they should be reviewed as soon as possible afterward.

Organizational change

Changes to people and organization, such as downsizing, mergers, new shift patterns, changes to supervision ratios, outsourcing maintenance, or the retirement of experienced staff, can have major effects on safety, yet they are often not reviewed for hazards. Investigations of several major accidents have found that reduced staffing, loss of expertise, unclear responsibilities after reorganization, or fatigue from new schedules contributed to the event. Organizational MOC asks questions such as: Which safety-critical tasks and roles are affected? Will people have the knowledge, time and authority to perform them? Will workloads, fatigue or lone work increase? How will knowledge be transferred? Many process safety programs now include organizational change explicitly in MOC.

Making MOC practical

MOC systems fail if they are so bureaucratic that people avoid them, or so lax that they become a rubber stamp. Practical systems scale the review to the risk, with a simple screening form for minor changes and full reviews for significant ones; make it easy to start a request; set clear authority for approvals; track open changes and temporary changes; involve the people affected; and audit the system to find changes made without MOC. Training should help everyone recognize changes, including subtle ones such as a new supplier of a "similar" part. Supervisors and workers play a key role by asking, before any change, "What else does this affect, and has anyone looked at the hazards?"

Change in everyday work

Management of change is often associated with chemical plants and refineries, but changes create hazards in every workplace. An office that moves to open-plan seating changes noise, ergonomics and emergency evacuation routes. A retail store that extends opening hours may introduce lone work at night. A construction company that switches to a new formwork system needs new procedures and training. A hospital that installs new patient lifts changes handling methods for nurses. A warehouse that introduces automated guided vehicles changes traffic patterns and creates new maintenance hazards. In smaller workplaces, a formal MOC procedure may be as simple as a one-page form, but the principle is the same: before changing something, think about what hazards the change may create or affect, and update assessments, controls and training.

Warning signs that MOC is not working

Several signs suggest that changes are slipping past review. Drawings and procedures do not match what is actually in the field. Operators discover modifications only when they encounter them. Temporary repairs, hoses, jumpers and bypasses remain in place for months. Incidents are traced to changes nobody reviewed. The number of MOC requests is suspiciously low for the amount of activity. Approvals are signed by people who did not read the review. Training records show that workers were not told about changes before they took effect. Audits that look for these signs, for example by walking the plant with the latest drawings in hand or reviewing work orders for unrecorded modifications, can reveal whether the system is working.

A worked screening checklist

A short screening checklist helps decide what level of review a proposed change needs. Typical questions include: Does the change affect a safety-critical system, such as relief devices, interlocks, alarms, fire protection or ventilation? Does it introduce a new chemical or change quantities or conditions? Does it change operating limits, such as pressures, temperatures, speeds or loads? Does it affect emergency response or escape routes? Does it change who does a safety-critical task, or how many people are available? Does it require new skills or training? Will it be temporary? A "yes" to any question leads to a more detailed review, while a change with "no" answers throughout may proceed with a simple record.

Contractor and supplier changes

Changes made by others can affect your workplace as much as your own. A supplier may reformulate a product without changing its name, a contractor may send a new crew unfamiliar with the site, or a landlord may alter building systems. Contracts and purchasing procedures should require notification of such changes, and receiving staff should check safety data sheets and specifications for revisions.

MOC records

Good MOC records allow anyone to see later what was changed, why, who reviewed and approved it, which hazards were identified, which actions were required and whether they were completed. These records support investigations, audits and future changes, and they help preserve knowledge when experienced people leave. Records should be linked to updated drawings, procedures and training records so that the documentation set stays consistent. Electronic MOC systems can route requests, send reminders for open actions and flag temporary changes approaching expiry, but they still depend on people recognizing that a change is occurring in the first place.

Finally, management of change applies to the safety program itself. Changing the risk matrix, the inspection schedule, the contractor prequalification process or the structure of the safety department can weaken controls without anyone noticing. Such changes deserve the same questions as any other: what could this affect, who needs to know, and how will we check that it works?

In short, management of change is a discipline of curiosity: before anything changes, someone asks what else it will touch. Building that habit into purchasing, engineering, maintenance, staffing and scheduling decisions prevents many of the surprises that lead to serious incidents, and it costs very little compared with the incidents it prevents.