Why Management of Change Fails and How to Spot the Warning Signs

Management of change (MOC) fails when a team changes how a process runs without checking whether its original safeguards still work. A missed substitution, an expired temporary arrangement or a shift using an old procedure can each create that gap. To spot a failure, follow one change from the decision that authorized it to the equipment and instructions people actually use.

In a process plant, a signed change record can answer who approved the work. A better test is whether the people starting the plant can explain what changed, which safeguard matters and what would make them stop. Six recurring warning signs tell a reviewer where to look.

1. A replacement is called like-for-like without checking the specification

A part can fit the same space and still behave differently. Read the original design specification alongside the proposed item. Material compatibility, pressure rating, capacity or the position a valve takes on loss of power can affect the assumptions behind an existing safeguard. A matching connection or catalogue description settles only part of the question.

For processes covered by the US OSHA process safety management standard, a replacement in kind is one that meets the design specification. Ask the responsible engineer to record the comparison and resolve any difference before the item is released for use. A purchasing note can explain why someone bought a substitute. The technical comparison establishes whether it qualifies. OSHA defines replacement in kind in 29 CFR 1910.119(b) and covers change control in paragraph (l).

2. An operating deviation never reaches the change review

Plants usually recognize a new piece of equipment as a change. They can miss a decision to keep running differently after an upset. Ask the shift supervisor which conditions the approved procedure covers and where that authority ends. Once the team proposes a different way of operating, the reason, hazards and limits of that departure need an explicit decision.

The US Chemical Safety Board examined two process incidents, including a fatal refinery fire after a loss of utilities left equipment in an abnormal condition. Investigators found that both teams had time to examine their decisions. They identified the handling of operational deviations as a weakness alongside other contributing factors. During a review, look for the point at which the crew left familiar conditions and who had authority to reassess the risk. Read the Chemical Safety Board’s management of change bulletin and case histories.

3. A temporary change has an end date but no return plan

Find the oldest temporary change still in service. Identify its owner, when the authorization ends, what compensating controls are in place and how the plant will return to its approved condition. A calendar reminder has little value if nobody on shift knows what to do when it arrives. The change record should also make an overdue item visible to the person who can authorize the next decision.

Before an extension, verify the condition of the temporary arrangement and whether the assumptions behind the original approval still apply. Record who accepted the extension and for how long. If the arrangement is to become permanent, give it the review required for that decision. Simply editing the expiry date conceals how long the plant has relied on a temporary control.

4. The review ends at the equipment being modified

Trace the change one step upstream and downstream. Check what feeds the equipment, where its output goes, which alarms or trips depend on it and how maintenance will isolate it. Include the people who operate adjoining equipment. They may rely on a condition that looks incidental on the drawing but matters during a shutdown or a fault.

Record the assumption most likely to change and the evidence used to check it. Where the effect is uncertain, assign the open technical question to someone able to answer it before release. The UK Health and Safety Executive discusses these wider effects in its guidance on plant modification and change procedures.

5. Approval is mistaken for readiness to start

Approval to install a change and permission to introduce process material answer different questions. At the handover, compare the installed arrangement with the approved design. Check that each safeguard needed for startup is available, outstanding actions have owners and the operating instructions reflect what is in the field.

Ask an operator on the incoming shift to locate the revised instruction and explain the change. Include affected maintenance and contract personnel. For US OSHA-covered processes, paragraph (l) requires affected workers to be informed and trained before startup. Paragraph (i) calls for a pre-startup safety review at modified facilities when a modification is significant enough to require a change in process safety information. That distinction matters when deciding which formal review is required.

6. The record closes before anyone checks the result

A change file can be complete while a superseded drawing remains available at the work point. Choose one closed change and compare the controlled drawing, the operator’s copy of the procedure and the equipment identification in the field. Check that the next shift received the same information. For a temporary change marked as reversed, confirm the actual plant condition and the removal of temporary instructions.

A practical closeout note names what was checked, who checked it and what remains open. Repeated mismatches across several closed records point to a weakness in the management of change procedure itself. Bring those findings back to the person who owns the procedure so the next reviewer has a clear decision to make.

Frequently Asked Questions

These questions often arise when a change is already in progress or a reviewer finds an old approval.