Management of Change in Process Safety

1. Why Management of Change Matters

Management of Change (MOC) is one of the most heavily tested and most consequential elements of process safety management. The reason is simple: history shows that uncontrolled change is one of the leading root causes of catastrophic process incidents.

Flixborough, England (1974) is the classic case study. A 20-inch temporary bypass pipe was installed between two reactors after one was removed for repair. The modification was designed by engineers with no piping expertise, sketched in chalk on a workshop floor, never subjected to a hazard review, and never properly supported. The bypass failed, releasing roughly 40 tonnes of cyclohexane that ignited in a vapor cloud explosion, killing 28 workers and injuring hundreds. Flixborough is the single most cited example of why MOC exists and is very likely to appear on the CSP exam as a scenario or distractor.

Other incidents with MOC failures as contributing factors include Bhopal (1984), where safety systems were taken out of service or modified without full hazard evaluation; Piper Alpha (1988), where a pressure safety valve removed for maintenance was not communicated across shift change; and the BP Texas City refinery explosion (2005), where organizational and equipment changes (including siting of trailers and use of a blowdown drum instead of a flare) were not adequately reviewed.

The regulatory and consensus frameworks you must know:
• OSHA Process Safety Management (PSM), 29 CFR 1910.119(l) – MOC is a required element.
• EPA Risk Management Program (RMP), 40 CFR 68.75 – mirrors the OSHA MOC requirement for Program 3 processes.
• CCPS Risk Based Process Safety (RBPS) – MOC is one of the 20 elements, under the pillar Manage Risk.
• API RP 750 and ANSI/ASSP Z10 – also require management of change as part of a safety management system.

Why the CSP exam cares: MOC is where engineering, administration, documentation, training, and hazard analysis intersect. A question about MOC tests whether you understand how all the PSM elements fit together as a system.

2. What Management of Change Is

MOC is a formal, documented process used to review, evaluate, authorize, communicate, and track any change to a covered process before the change is implemented, so that new hazards are identified and controlled and the process safety information remains accurate.

Under 29 CFR 1910.119(l), MOC applies to changes in:
• Process chemicals (new raw materials, different grades, catalysts, additives, suppliers)
• Technology (operating conditions such as pressure, temperature, flow, concentration; control logic; alarm setpoints)
• Equipment (new, modified, relocated, or removed vessels, piping, instrumentation, relief devices, materials of construction)
• Procedures (operating, maintenance, emergency, and safe work procedures)
• Facilities (buildings, siting, utilities, occupied structures, access)

Modern practice, reflected in CCPS guidance and the UK HSE, also extends MOC to organizational changes: staffing reductions, shift schedule changes, loss of experienced personnel, contractor substitution, reorganization of responsibilities, and mergers. These are sometimes called Management of Organizational Change (MOOC).

The critical exception: Replacement in Kind (RIK)
MOC is not required for a replacement in kind, defined as a replacement that satisfies the design specification. Replacing a failed pump with the identical make and model, or a gasket with one of the same material and rating, is RIK. Replacing a carbon steel pipe section with stainless steel, or substituting a pump with a different impeller size or motor horsepower, is a change and triggers MOC. The exam frequently tests your ability to tell RIK from change. The test is whether the replacement meets the original design specification, not whether it is a similar part or performs a similar function.

Categories of change
• Permanent change – intended to remain indefinitely.
• Temporary change – has a defined duration and an expiration date; must be tracked and either removed or converted to permanent via full MOC. Temporary changes that become permanent by default are a major failure mode.
• Emergency change – made urgently to prevent an imminent hazard or unplanned shutdown; still requires review (often expedited by a smaller group) and full documentation shortly after, with a follow-up MOC review.
• Subtle or creeping change – incremental changes such as a gradual increase in production rate, drift in feedstock quality, or aging equipment. These are hard to recognize and are a frequent exam theme because they bypass MOC when no one identifies them as a change.

3. How Management of Change Works

A compliant MOC program must have written procedures that address, at minimum, the five considerations listed in 1910.119(l)(2):
1. The technical basis for the proposed change
2. The impact of the change on safety and health
3. Modifications to operating procedures
4. The necessary time period for the change (especially temporary changes)
5. Authorization requirements for the proposed change

The regulation further requires that affected employees (operations, maintenance) and contract employees be informed of and trained in the change prior to startup of the process or affected part of the process, and that process safety information and operating procedures be updated as necessary.

Typical MOC workflow

Step 1 – Initiation. Anyone (operator, engineer, maintenance technician, contractor) can originate an MOC request describing the proposed change, its purpose, and its scope. A good program makes initiation easy so changes are captured rather than hidden.

Step 2 – Screening and classification. A qualified person determines whether the request is RIK (close with documentation) or a true change, and whether it is permanent, temporary, or emergency. The level of review is scaled to the risk; a simple change may use a checklist, while a complex change may require a full HAZOP.

Step 3 – Technical review and hazard evaluation. A multidisciplinary team reviews the technical basis and performs a hazard analysis appropriate to the change: checklist, What-If, HAZOP, FMEA, LOPA, or a revalidation of the existing PHA. The review must consider effects on relief system adequacy, materials compatibility, interlocks, electrical classification, ergonomic and human factors, facility siting, environmental releases, and emergency response. Consequences for upstream and downstream units must also be assessed.

Step 4 – Identification of required actions. The team lists everything that must be updated or completed: P&IDs, process safety information, relief calculations, operating procedures, maintenance procedures, mechanical integrity inspection schedules, alarm management database, emergency response plans, training materials, and drawings.

Step 5 – Authorization. Designated individuals at defined levels (often operations, engineering, process safety, and sometimes plant management, depending on risk) approve the change. Authorization is documented with signatures or electronic approval.

Step 6 – Implementation. The physical, procedural, or organizational change is made. Construction follows design codes, and quality assurance under the Mechanical Integrity element confirms it was built as designed.

Step 7 – Communication and training. All affected employees and contractors are informed and trained before startup. Training is documented. Shift handover notes, toolbox talks, and posting of the MOC near affected equipment are common supporting methods.

Step 8 – Pre-Startup Safety Review (PSSR). Under 1910.119(i), a PSSR is required for new facilities and for modified facilities when the modification is significant enough to require a change in process safety information. The PSSR confirms construction matches design, procedures are in place, a PHA was performed and recommendations resolved, and training is complete. The exam frequently tests the sequence: MOC approved, change implemented, PSSR completed, then startup.

Step 9 – Startup and monitoring. The change is placed in service, often with enhanced monitoring during the initial period.

Step 10 – Closeout. All action items are verified complete, documents are finalized, and the MOC is formally closed. For temporary changes, the system tracks the expiration date and verifies the process is returned to the original condition or a permanent MOC is processed.

Step 11 – Audit and metrics. Compliance audits (every three years under PSM) sample MOC records. Leading indicators include number of overdue temporary MOCs, percentage of MOCs with completed PSSRs before startup, and percentage of changes discovered in the field without an MOC. Lagging indicators include incidents where MOC failure was a causal factor.

Roles and responsibilities
• Originator – describes and justifies the change.
• MOC coordinator – administers the system and tracks status.
• Technical reviewers – process, mechanical, electrical, instrument and controls, and process safety engineers.
• Operations and maintenance representatives – provide operability and practical input.
• Authorizer – accountable manager who approves the change.
• Safety professional – ensures the hazard review is adequate and the MOC system itself is audited and improved.

4. Common Failure Modes of MOC Programs

The exam often presents a scenario and asks you to identify the weakness. Watch for:
• Failure to recognize that a change occurred (the most common root cause)
• Misclassifying a change as replacement in kind
• Temporary changes with no expiration date or no follow-up
• Emergency changes that are never reviewed afterwards
• Hazard review performed by a single person without multidisciplinary input
• Change approved but process safety information and P&IDs never updated
• Employees not trained before startup
• Skipping the PSSR
• Organizational changes (staff cuts, loss of expertise) not treated as changes
• Bypassing MOC because the system is too slow or bureaucratic, which indicates a safety culture problem
• Changes made by contractors without the owner being aware

5. Relationship to Other PSM Elements

Understanding the linkages is essential for exam success. MOC is the gateway element that keeps the others current:
• Process Safety Information (d) – MOC triggers updates so PSI reflects the actual plant.
• Process Hazard Analysis (e) – MOC may require a PHA revalidation or a focused hazard review.
• Operating Procedures (f) – must be revised for changes affecting operation.
• Training (g) – affected employees trained before startup.
• Contractors (h) – contract employees must also be informed.
• Pre-Startup Safety Review (i) – required for modified facilities with PSI changes.
• Mechanical Integrity (j) – inspection and test plans updated for new or modified equipment.
• Incident Investigation (m) – investigations often reveal MOC failures and generate MOC requests.
• Compliance Audits (o) – verify the MOC system functions.

6. Exam Tips: Answering Questions on Management of Change in Process Safety

Tip 1 – Know the regulatory citation and its five elements cold. If a question asks what an MOC procedure must address, the answer is technical basis, impact on safety and health, modifications to operating procedures, necessary time period, and authorization requirements. Distractors often include items like cost justification or production impact, which are not required by the regulation.

Tip 2 – Master the replacement in kind distinction. Ask yourself: does the replacement meet the original design specification? If anything about material, rating, size, capacity, manufacturer specification, or function differs, it is a change. Expect at least one question where the correct answer is that MOC is not required because the item is RIK, and another where a seemingly minor substitution (different alloy, larger relief valve orifice, different gasket material) does require MOC.

Tip 3 – Remember the word before. Training and communication must occur before startup, not after, not within 30 days, not at the next scheduled training. Any option that delays training to after the change is operating is wrong.

Tip 4 – Know the sequence. Initiate, review hazards, authorize, implement, train, PSSR, then startup. If a question asks what must happen immediately before placing a modified process in service, the answer is the Pre-Startup Safety Review (assuming PSI changed).

Tip 5 – Recognize Flixborough. A scenario involving a temporary bypass, a modification designed without engineering review, or a change made by people without the relevant expertise points to MOC failure and almost always references Flixborough. Be ready to identify the lesson learned: all modifications, including temporary ones, require formal review by qualified people.

Tip 6 – Procedures count as changes. Candidates often assume MOC only applies to hardware. A revised operating procedure, a changed alarm setpoint, a different operating pressure, or a new chemical supplier all fall under MOC. Organizational changes are increasingly tested as well.

Tip 7 – Temporary means time-limited. If a question describes a temporary change, the required element is a defined time period or expiration date and a process to restore or convert the change. The correct answer will often emphasize tracking and closeout.

Tip 8 – Choose the systematic, multidisciplinary answer. When options differ in rigor, the CSP exam favors formal, documented, team-based hazard review over informal supervisor approval or single-person judgment. The best answer is rarely the quickest shortcut.

Tip 9 – Connect MOC to PSI updates. If a scenario shows that drawings do not match the field, or operators are working from outdated procedures, the root cause is a failed MOC system that did not drive documentation updates.

Tip 10 – Watch for root cause questions. When an incident scenario describes a modification that was made without review, the root cause is a management system failure (inadequate MOC), not operator error. The exam rewards identifying systemic causes.

Tip 11 – Know where MOC sits in CCPS RBPS. It is one of the 20 elements under the Manage Risk pillar, alongside Operating Procedures, Safe Work Practices, Asset Integrity, Contractor Management, Training, Operational Readiness, Conduct of Operations, and Emergency Management. A question may ask which pillar contains MOC.

Tip 12 – Emergency changes still require MOC. The correct approach is an expedited review with appropriate authorization followed by complete documentation and a full review as soon as practical. An answer stating that emergency changes are exempt from MOC is wrong.

Tip 13 – Eliminate absolutes carefully. Options saying MOC applies to all changes without exception ignore RIK; options saying only major changes need MOC ignore that the scale of review, not the requirement for review, is what changes with risk.

Tip 14 – Read scenario questions for the hidden change. The exam may describe a plant that increased throughput by 15 percent, switched to a cheaper feedstock, or reduced the operating crew. None of these involve new equipment, yet all are changes requiring MOC. Train yourself to spot creeping and organizational changes.

7. Quick Review Summary

• MOC is a formal system to evaluate and authorize changes to chemicals, technology, equipment, procedures, facilities, and organizations before implementation.
• Required by OSHA PSM 1910.119(l) and EPA RMP 40 CFR 68.75; CCPS RBPS element under Manage Risk.
• Replacement in kind (meets design specification) is exempt.
• Five required considerations: technical basis, safety and health impact, operating procedure modifications, time period, authorization.
• Employees and contractors informed and trained before startup; PSI and procedures updated.
• Temporary changes need an expiration date and closeout; emergency changes need expedited review and follow-up.
• PSSR follows MOC and precedes startup when PSI changes.
• Flixborough (1974) is the defining MOC case study.
• Most MOC failures stem from not recognizing a change has occurred.

Mastering MOC means understanding it not as a form to fill out but as the mechanism that keeps every other process safety element truthful about the plant as it actually exists. Carry that systems view into the exam and MOC questions become among the most predictable points you can earn.