Management of Change (MOC): A Practical Guide for Industrial Plants

Change is constant in an industrial plant. Equipment is modified, procedures are updated, setpoints are adjusted, and new materials are introduced. Some changes are planned; others happen in the field without formal review. Most changes seem minor at the time. But even small changes can invalidate the assumptions behind safety analyses, equipment designs, and operating procedures.

Management of Change (MOC) is the process that ensures changes are reviewed, approved, and documented before they are implemented. It is one of the most important elements of process safety management, and one of the most commonly neglected.

For small to medium-scale industrial plants, MOC is especially critical because there is less redundancy and fewer resources to absorb the consequences of an unmanaged change. A modification that seems harmless can create a new hazard, defeat a protection layer, or invalidate a safety analysis.

This article explains what MOC is, why it matters, and how to implement it practically in an industrial plant.

What Is Management of Change?

Management of Change is a formal process for reviewing and approving changes to equipment, procedures, materials, organization, or operating conditions before they are implemented.

The purpose of MOC is to ensure that:

• The safety, health, and environmental impacts of a change are assessed before implementation.
• Required approvals are obtained.
• Documentation is updated.
• Affected personnel are informed and trained.
• The change is implemented safely.
• Temporary changes are closed out and do not become permanent by default.

MOC is not intended to prevent change. It is intended to ensure that change happens safely.

Why MOC Matters

Changes that are not reviewed can introduce new hazards or defeat existing protections. Typical examples of unmanaged changes that have led to incidents include:

• A pressure relief valve replaced with a valve of a different set pressure, defeating overpressure protection.
• A control setpoint adjusted without reviewing the effect on downstream equipment.
• A temporary bypass installed and never removed, leaving a protection layer disabled.
• A material substituted without checking compatibility with existing equipment.
• A procedure changed informally without informing operators.
• A staffing reduction that left a night shift unable to respond to an upset.

These changes seemed minor at the time. Each one defeated a protection layer or created a new hazard that was not identified in the original safety analysis.

For small plants, MOC is especially important because there are fewer people to catch mistakes and less redundancy to absorb the consequences.

What Counts as a Change? Replacement in Kind

A common source of confusion is deciding what triggers MOC. A practical rule:

• A change is anything that alters the design basis, operating conditions, materials, procedures, software, or organization of the plant, other than a replacement in kind.
• A replacement in kind is a replacement that satisfies the original design specification, for example, replacing a failed pump with an identical model, or a gasket with the same material and rating. Replacement in kind normally does not require MOC, but it still follows normal maintenance and work-permit controls.

Be careful with “equivalent” parts. A valve with the same size and pressure class but a different trim material, a different set pressure, or a different failure position is not a replacement in kind. When in doubt, treat it as a change. Plants should define replacement in kind in writing so that maintenance and operations apply it consistently.

Types of Changes

MOC applies to a wide range of changes. Common categories include:

Not every change requires the same level of review. MOC processes typically define thresholds: minor changes may require a simple review, while major changes require full analysis.

Organizational Changes

Organizational changes, such as staffing reductions, role changes, shift pattern changes, or outsourcing of operations and maintenance, can affect safety by reducing the people available to operate and maintain the plant, or by removing experience and knowledge. These changes should be reviewed for their impact on safety-critical tasks. Useful questions include:

• Are enough qualified people available on every shift to run the plant and respond to emergencies?
• Are safety-critical tasks, such as emergency response, bypass approval, and relief device inspection, still clearly assigned?
• Are contractors briefed on site hazards and procedures, and are responsibilities between owner and contractor clear?
• Is critical knowledge retained when experienced people leave or roles change?

Organizational changes are often decided for business reasons and are the most likely to bypass MOC. Plants should make sure that management, human resources, and operations leaders know that these changes are in scope.

Software and Control System Changes

Software changes, including control logic modifications, alarm setting changes, and safety system updates, require the same rigor as hardware changes. A small logic change can have unintended consequences. Software changes are subtle because they are invisible on the plant floor, are easy to make remotely, and can alter the behavior of many pieces of equipment at once.

Good practice includes:

• Controlling access to control and safety system programming with passwords, permissions, and logging.
• Requiring review, testing (for example, simulation or factory acceptance testing where practical), and approval before changes are loaded.
• Keeping backups and version records of logic, alarm, and trip settings, and confirming that the running version matches the approved version.
• Applying extra scrutiny to safety instrumented system (SIS) changes, which should be handled within the safety lifecycle and verified by functional testing before return to service.
• Considering cybersecurity, including remote access, patches, and firmware updates, as part of the review.

The MOC Process

While MOC processes vary by organization, most follow a similar structure.

For temporary changes, an additional step is required: confirming that the temporary change is removed and the original condition is restored.

What Goes on an MOC Form

A simple MOC form, paper or electronic, usually records:

• A description of the change and the reason for it
• The requester, date, and area or equipment affected
• The classification (minor, moderate, major) and whether the change is temporary
• The impact assessment and any recommendations or conditions
• Documents to be updated and personnel to be trained
• Whether a pre-startup safety review is required
• Approvals with names and dates
• Implementation, verification, and close-out sign-offs

Roles and Responsibilities

Clear roles prevent MOC from stalling or being ignored:

• Requester: Identifies and describes the change.
• MOC coordinator: Manages the process, tracks open items, and maintains records. In a small plant, one person is usually enough.
• Reviewers: Engineering, operations, maintenance, safety, and other relevant disciplines assess the impact.
• Approver: Authorized person who accepts the risk and approves the change at the level defined for its classification.
• Implementer: Carries out the change in accordance with the approved scope.

Classifying Changes

Not all changes require the same level of review. Classification helps allocate resources appropriately.

Classification criteria should be defined in advance so that changes are consistently categorized. Example screening questions:

• Does the change affect a safety instrumented function?
• Does the change affect a relief system?
• Does the change affect hazardous area classification?
• Does the change affect operating conditions outside the current design envelope?
• Does the change affect a procedure used during emergencies?
• Does the change introduce a new material or a new hazard?

If the answer to any of these is yes, the change should be classified as moderate or major. Changes affecting safety instrumented functions, relief systems, or other protection layers should normally be classified as major.

Impact Assessment

The impact assessment is the heart of the MOC process. It evaluates how the change affects:

• Safety: Does the change introduce new hazards or affect existing protections?
• Health: Does the change affect exposure to hazardous substances?
• Environment: Does the change affect emissions, discharges, or waste?
• Operations: Does the change affect production, quality, or reliability?
• Compliance: Does the change affect regulatory compliance, permits, or insurance requirements?

Assessment methods include:

• Checklist: A structured list of questions for common changes.
• What-if analysis: Brainstorming potential impacts.
• HAZOP: For changes with significant process implications. Often only the affected nodes need to be reviewed.
• LOPA: For changes affecting protection layers.

For minor changes, a checklist may be sufficient. For major changes, a full hazard analysis may be required. The assessment should also consider the transition period (the activities needed to make the change, such as isolation, purging, and startup) as well as the final state. The assessment should also decide whether existing hazard analyses, such as the HAZOP, must be revised or revalidated.

Approval and Authorization

Changes must be approved by authorized personnel before implementation. The level of approval should match the classification of the change.

Approval should be documented, with the approver’s name, date, and any conditions. Approvers should be independent enough to challenge the proposal, so requesters should not be the sole approvers of their own changes where this can be avoided.

Emergency Changes

Sometimes a change must be made immediately to protect people, equipment, or the environment. Emergency changes should be handled through a defined fast-track process, not ignored. Typical elements are:

• Verbal or abbreviated approval from a designated authority
• A quick safety check to avoid creating a new hazard
• Full MOC documentation completed within a defined short period (for example, within a day or two)
• A follow-up review to confirm the change is still appropriate, and to convert it to a permanent change or remove it

Emergency changes should be rare. If they are frequent, they are a sign that planning or the MOC process is not working.

Documentation Updates

Changes often require updates to documentation. Documents that may need updating include:

• Piping and instrumentation diagrams (P&IDs)
• Process flow diagrams (PFDs)
• Cause-and-effect charts
• Safety analyses (HAZOP, LOPA)
• Operating procedures
• Maintenance procedures
• Equipment datasheets
• Relief system calculations
• Electrical drawings
• Instrument index
• Alarm and trip schedules
• Hazardous area classification drawings
• Emergency response plans

Documentation that affects safe operation, such as procedures and safety information, should be updated before the changed equipment or process is started up. Other records, such as as-built drawings, should be updated within a defined time after implementation and tracked until complete. Outdated documentation is a common source of incidents.

Training and Communication

Affected personnel must be informed and, where necessary, trained before the change is implemented or before the affected equipment is started up.

Who needs to be informed:

• Operators who run the affected equipment
• Maintenance personnel who service it
• Engineers who support it
• Safety personnel who oversee it
• Contractors who work in the area

Training should cover:

• What is changing and why
• How the change affects their work
• Any new hazards or precautions
• New or revised procedures

For minor changes, a briefing may be sufficient. For major changes, formal training may be required. Communication should also cover shifts that are off duty when the change is made, since shift handover is where many changes are missed.

Temporary Changes

Temporary changes are among the most common sources of incidents. A temporary bypass, modification, or procedure change can easily become permanent by default if it is not tracked.

Key requirements for temporary changes:

• Authorization: Temporary changes must be approved like any other change.
• Time limit: Temporary changes must have a defined end date, and extensions require re-approval.
• Compensating measures: If the temporary change reduces protection, compensating measures must be in place.
• Tracking: Temporary changes must be tracked to ensure they are removed.
• Closeout: When the temporary change is no longer needed, it must be removed and the original condition restored.

Temporary changes that are not closed out become permanent hazards. Temporary equipment, such as hoses, clamps, or jumpers, should be physically tagged so operators can recognize it in the field.

Bypasses and Overrides

Bypasses and overrides are a specific type of temporary change. They disable a protection layer, such as a safety instrumented function or an alarm.

Key requirements:

• Authorization: Bypasses must be approved by authorized personnel.
• Time limit: Bypasses must have a defined duration.
• Alarming: Bypasses should trigger an alarm or notification.
• Logging: All bypasses should be logged and tracked.
• Compensating measures: While a bypass is active, compensating measures (such as additional monitoring or manual procedures) should be in place.
• Restoration: Bypasses must be removed when no longer needed, and the protection restored and verified, for example by a function test.

Uncontrolled bypasses are a recurring contributor to serious incidents.

MOC and Process Safety Management

MOC is one of the core elements of process safety management (PSM). It is closely linked to other PSM elements:

• Process hazard analysis: Changes may invalidate the PHA and require revalidation.
• Operating procedures: Changes may require procedure updates.
• Training: Changes may require training.
• Mechanical integrity: Changes may affect equipment integrity requirements, such as inspection intervals and test plans.
• Pre-startup safety review: Significant changes require a pre-startup safety review before restart.
• Incident investigation and audits: Incidents should be checked for MOC failures, and audits should test whether MOC is actually followed.

For plants subject to PSM regulations (such as OSHA PSM in the United States or Seveso in Europe), MOC is a regulatory requirement, not just a good practice. Plants should confirm the requirements that apply in their jurisdiction.

Pre-Startup Safety Review (PSSR)

A pre-startup safety review (PSSR) is required before restarting a process after a significant change, such as one that alters process safety information. It confirms that the change was implemented as designed, that procedures are updated, and that personnel are trained. A PSSR typically verifies that:

• Construction and equipment conform to the design specification
• Safety, operating, maintenance, and emergency procedures are in place and adequate
• A hazard analysis has been completed, and its recommendations resolved or scheduled
• Training of affected personnel is complete
• Open items are either closed or formally accepted with a due date

The PSSR is the last check before hazardous materials or energy are reintroduced. It should be signed off before startup, not after.

MOC in Small Plants

Small plants face particular challenges with MOC:

• Fewer people to review and approve changes.
• Less formal processes and documentation.
• More informal communication.
• Fewer resources for formal hazard analysis.

Practical approaches for small plants:

• Define clear thresholds: What changes require formal MOC? Which can be handled with a simple checklist?
• Use checklists: Standard checklists make review faster and more consistent.
• Assign responsibility: One person should be responsible for MOC.
• Use the CMMS: The maintenance management system can track MOC and bypasses.
• Review at meetings: Include MOC review in regular operations meetings.
• Borrow expertise when needed: Use external engineers or the equipment vendor for major changes where in-house expertise is thin.
• Learn from incidents: When an incident occurs, check whether MOC was involved.

MOC does not need to be complex. It needs to be consistent.

MOC Metrics

Measuring MOC performance helps identify weaknesses. Useful MOC metrics include the number of changes processed, the time to complete MOC review, the number of temporary changes open past their due date, and the number of MOC bypasses. Tracking these metrics helps identify where the process is weak. Additional indicators worth considering:

• Number of changes found during audits or walkdowns that had no MOC
• Percentage of MOCs with documentation updated and training completed before startup
• Number of overdue MOC action items
• Number of emergency changes
• Number of incidents or near misses traced to an unmanaged change

Metrics should be reviewed regularly by plant management and used to improve the process, not to blame individuals. Rising numbers of reported unmanaged changes can actually be a good sign, since they show people are reporting.

Common Mistakes in MOC

Even experienced organizations make mistakes. Common ones include:

• No MOC process: Changes happen without formal review.
• Inconsistent classification: Similar changes classified differently.
• Skipping impact assessment: Changes approved without evaluating safety impact.
• Not updating documentation: Outdated drawings and procedures.
• Not training personnel: Operators unaware of changes.
• Temporary changes never closed: Bypasses and modifications become permanent.
• Uncontrolled bypasses: Protection layers disabled without authorization.
• MOC bypassed under schedule pressure: Changes made quickly without review.
• Overusing “replacement in kind”: Non-equivalent parts installed without review.
• Ignoring organizational and software changes: Only physical changes are reviewed.
• No verification: Assuming the change was implemented correctly without confirming.

These mistakes are costly to correct after an incident. They are much cheaper to avoid through consistent MOC practice.

How Japanese EPC Firms Approach MOC

Japanese engineering firms are often associated with a disciplined approach to change management. Common characteristics include:

• Clear procedures: MOC processes are defined, documented, and followed.
• Thorough impact assessment: Changes are reviewed carefully, with input from all relevant disciplines.
• Detailed documentation: Drawings, procedures, and analyses are updated promptly.
• Disciplined approval: Changes are approved by authorized personnel at the appropriate level.
• Comprehensive training: Affected personnel are informed and trained.
• Closeout discipline: Temporary changes are tracked and closed out.
• Long-term focus: MOC is treated as an ongoing discipline, not a bureaucratic hurdle.

For plant owners, this approach tends to support fewer incidents, better compliance, and a safer workplace. It also helps during project execution: changes made during engineering and construction are controlled, so the plant handed over matches its documentation.

How to Evaluate MOC Readiness

When considering MOC for your plant, ask:

A plant that addresses these questions is likely to have effective MOC.

Conclusion

Management of Change is the process that ensures changes are reviewed, approved, and documented before they are implemented. It prevents changes from introducing new hazards or defeating existing protections.

For small to medium-scale industrial plants, MOC is especially important because there is less redundancy and fewer resources to absorb the consequences of an unmanaged change. Applied consistently, MOC improves safety, compliance, and reliability.

Key Takeaways

• MOC ensures changes are reviewed, approved, and documented before implementation
• Types of changes include equipment, process, material, procedural, organizational, software, and temporary
• Replacement in kind normally does not require MOC, but it must be clearly defined
• Changes are classified as minor, moderate, or major, with different review levels
• Impact assessment evaluates safety, health, environmental, operational, and compliance impacts
• Organizational and software changes can affect safety as much as hardware changes and must be in scope
• Temporary changes and bypasses are common sources of incidents and must be tracked and closed out
• A PSSR confirms readiness before restarting after a significant change
• MOC metrics, such as overdue temporary changes and bypasses, show where the process is weak
• MOC is a core element of process safety management
• Small plants can implement MOC with clear thresholds, checklists, and assigned responsibility
• Japanese EPC firms emphasize clear procedures and closeout discipline