How to Run a Scope-Change Risk Review in 20 Minutes

A scope change can turn a controlled job into an uncontrolled one when the permit, the brief, the isolation list, and the supervision plan were written for the old task. The review below is for maintenance supervisors, project managers, and EHS leads who need a fast reset before the crew restarts work.

ISO 45001:2018 expects organizations to plan actions for risk and opportunity, and ISO 31000:2018 asks for risk management that is integrated and structured. In higher hazard operations, OSHA 29 CFR 1910.119(l) treats change control as a formal discipline for process changes, which is exactly why a scope change review cannot be treated as clerical cleanup.

Across 25+ years leading EHS at multinationals, Andreza Araujo has seen the same failure pattern repeat. The scope changes first, then the old document stays in circulation, and then the crew works with two versions of reality. As Andreza Araujo argues in Safety Culture: From Theory to Practice, repeated decisions define the real operating model, while A Ilusao da Conformidade warns that paperwork can look right even when the field has already moved on.

The thesis is simple. A scope-change risk review is not admin. It is a revalidation of the control set before the crew spends time, energy, and capital on the wrong version of the job.

What you need before starting

Bring the last approved job brief, the current scope change request, the permit-to-work if one exists, the isolation list, the contractor scope, and one person who can explain the work in plain language. If the change affects lifting, line break, confined space, traffic, or simultaneous operations, pull the relevant control documents too. The review works only when it starts from the live job, not from the folder.

Use the review in the same way you would use a temporary deviation risk review, because the point is to reset decision rights before the task resumes. If your operation already uses a weekly governance rhythm, connect this to risk review cadence so the change does not disappear after one meeting.

Step 1: Define what actually changed

Start by naming the change in one sentence. Did the scope change because the sequence changed, the access changed, the equipment changed, the contractor changed, the weather changed, the duration changed, or the work interface changed? If nobody can say what changed, the team is already guessing, and guessing is how scope drift starts.

Do not accept vague phrases like "small adjustment" or "minor update." A scope change is real whenever the control picture changes, even if the job title stays the same. James Reason would call that a latent condition waiting for the active task to expose it.

The verification question is direct. If this change had happened before the permit was written, would the same controls still be approved? If the answer is no, the review must continue.

Step 2: Freeze the old plan and the new plan side by side

Place the old approved brief next to the new job reality and mark every line that no longer fits. This is where the team sees that the problem is not only the extra task. The problem is that the original permit, isolation, and sequencing assumptions may already be obsolete.

If work stopped and restarted, or if the task was handed to another crew, treat the restart as a fresh decision point. That is the same logic behind the contractor mobilization gate, because the handoff is where drift often enters through the back door.

In more than 250 cultural transformation projects, Andreza Araujo has seen leaders lose control when they kept the old document alive for convenience. Sorte ou Capacidade is relevant here because luck is a poor control strategy when the work has already changed.

Step 3: Recheck the critical controls first

Do not start with housekeeping details. Start with the controls that would fail fastest if the new scope is executed badly. That usually means isolation, line break, energy control, access control, traffic separation, fall protection, rescue readiness, and any permit condition that depends on the exact task sequence.

If the new scope adds a second crew, a new elevation, a new energy source, or a new interface with live operations, the original control set is probably incomplete. The review should ask whether the barrier still matches the hazard and whether the person who owns the barrier is still the right owner.

This is also where a simple checklist beats memory, because memory tends to preserve the old version of the job. The article on the safety decision rights matrix is useful here, since control ownership needs to be explicit before the field restarts.

Step 4: Reassign decision rights before work resumes

A scope change often breaks decision rights before it breaks the task. Someone can approve the change, but no one knows who can stop the job, who can rewrite the brief, who can reissue the permit, and who can clear the restart. When those roles are fuzzy, the crew keeps moving while the system keeps hesitating.

Write the names down before anyone walks back to the workface. The supervisor may own the field decision, the planner may own the sequence update, the contractor lead may own the crew handoff, and the EHS lead may own the control check. What matters is that each person knows the decision they own and the decision they do not own.

Step 5: Rebrief the crew in plain language

The rebrief should explain the delta, not repeat the whole job history. Say what changed, why the change matters, what control now carries the highest load, and what the crew must do first if the plan stops matching the field. If the crew hears only the original brief again, they will carry the wrong model back into the task.

Ask three questions and wait for real answers. What changed, what is now the highest risk, and what will you do if the condition you were promised is not actually there? If two workers answer differently, stop and reconcile the difference before work restarts.

That step is one of the places where Safety Culture: From Theory to Practice matters most, because culture is visible in whether the supervisor slows down for clarity or speeds up for convenience. A scope-change review that skips the crew conversation is just an office edit.

Step 6: Check contractor and interface work

If contractors, temporary staff, or another crew are involved, the scope change must be pushed across every interface. The most common error is to update the core team and forget the people who are actually touching the hazard. The second common error is to assume that the contractor will infer the change from the field conditions.

Use the same discipline you would use in contractor mobilization. The change needs a named owner, a named handoff, and a named confirmation point. If the task sits inside a broader multi-job window, link the change to the SIMOPS risk map so the interface risk is visible before it becomes a surprise.

Across 30+ countries and 250+ companies, Andreza Araujo has seen that interface failures are rarely dramatic at first. They begin as one missing update, one misunderstood sequence, and one crew that believes the other crew already knows.

Step 7: Decide whether this is small, moderate, or major

Not every scope change needs the same level of response. A small change may only require a supervisor reset and a fresh brief. A moderate change may require a permit rewrite, a control check, and a new confirmation from the job owner. A major change may need a stop-work decision, a formal reapproval, or a wider management of change review.

Use the decision threshold already in the operation, because consistency matters more than improvisation. ISO 31000:2018 is useful here since it treats risk evaluation as a structured decision process, not a feeling. If the change affects energy isolation, confined space, or process conditions, the threshold should be tighter, not looser.

The common trap is to call everything small because small sounds efficient. Small is only true when the control picture did not move. If the barrier moved, the label on the change does not matter.

Step 8: Close with field proof and record the learning

Before the crew restarts, verify the revised control in the field. That can mean a walkdown, a recheck of the isolation point, a test of the route, a confirmatory signoff, or a second look at the interface area. The point is to prove that the new plan exists outside the meeting room.

Then record what changed, what was reset, what decision was made, and what the field proof was. That note should be short enough to reuse next time, because the goal is not to create more paperwork. The goal is to make the next change easier to recognize and slower to misread.

If your operation already tracks change performance in governance meetings, connect this step to risk review cadence. If the change repeats, the site should not be surprised. Repetition is a signal, not a coincidence.

Final checklist

• The team named exactly what changed before the old brief was reused.
• The old plan and the new reality were reviewed side by side.
• The critical controls were rechecked before the crew restarted work.
• Decision rights were reassigned and the contractor or interface team was briefed.
• The restart was verified in the field and the learning was recorded for the next change.

FAQ

What is a scope-change risk review?

It is a fast review that resets the hazard picture, the control set, and the decision rights when the job changes after approval. It is not a paperwork correction. It exists to make sure the crew resumes the right task with the right controls.

When should the review happen?

It should happen before the restarted task begins, and ideally before the crew leaves the planning conversation. If the change affects the sequence, the energy source, the contractor interface, or simultaneous operations, the review should happen immediately.

Is this the same as management of change?

Not exactly. Management of change is the broader governance method, while the scope-change risk review is the field-level reset that makes the new decision real. In smaller operations, the review may be the practical expression of MOC; in larger operations, it should feed MOC.

Who should own the review?

The supervisor or job owner should own the field decision, while the planner, contractor lead, and EHS lead support the reset. If nobody owns the restart, the safest-looking plan can still fail because the handoff was never closed.

What if the change happens after work already started?

Stop, reset, and re-run the review. The crew does not need to be punished for a late change, but it does need a new control picture. That is one of the clearest lessons in A Ilusao da Conformidade, because the job can look normal even after the task has turned into a different risk.

A scope-change review is one of the fastest ways to keep a job honest when the work has already moved. If you want the larger operating system behind this method, start with Andreza Araujo's books, especially Safety Culture: From Theory to Practice and A Ilusao da Conformidade, and keep the field proof ahead of the paperwork. If you need support, request a diagnostic at Andreza Araujo's store or at andrezaaraujo.com.