Management of Change: 5 Myths That Let Temporary Decisions Outlive Risk Review

Management of change is the controlled review of a planned or unplanned modification that can alter hazards, controls, people, equipment, materials, procedures, or operating conditions. It keeps a temporary decision from becoming invisible risk by defining what changed, who owns the exposure, what evidence is required, and when the original state must be restored.

A maintenance manager approves a temporary bypass at 6:15 a.m. because a production line is waiting. The change is described as minor, the permit is signed, and the shift continues. Three weeks later, the bypass remains in place, a new contractor is working around it, and nobody can say which control was supposed to replace the one that was removed.

That sequence is not unusual. The weakness is rarely a missing form. It is the belief that a change is safe because someone approved it once. Management of change becomes useful only when it changes the quality of the decision, the ownership of the exposure, and the evidence required before work continues.

Why does management of change fail before the review starts?

Management of change fails before the review starts when leaders define the event by its administrative label instead of by the conditions it can alter. A “temporary workaround” can change energy isolation, line of fire, staffing, competence, alarm response, chemical exposure, or emergency access even when the equipment itself has not been redesigned.

ISO 45001:2018 treats operational planning and control as a living part of the occupational health and safety management system, not as a document that exists apart from work. A change review should therefore ask what the operation will make possible that it could not make possible yesterday, and which barrier will be weaker, relocated, or dependent on a new action.

In more than 250 cultural transformation projects, Andreza Araujo has observed that the earliest warning often appears in language. People say “just for today,” “only until the part arrives,” or “the team knows how to handle it.” Those phrases describe urgency, but they do not describe exposure. The review must convert them into a decision boundary.

Myth 1: Temporary changes are automatically low risk

Temporary changes are not automatically low risk because duration does not determine consequence. A ten-minute bypass can expose a worker to stored energy, while a three-month equipment substitution may be safer if its controls are engineered, verified, and owned.

The dangerous part of a temporary decision is that its exception status can reduce scrutiny. A permanent modification usually attracts engineering, procurement, training, and maintenance attention. A temporary one can pass through a supervisor conversation, especially when production pressure makes speed feel responsible.

The practical test is not “How long will this last?” It is “Which assumptions about the work have changed?” Review altered energy sources, access, sequencing, staffing, materials, alarms, guarding, rescue, contractor interfaces, and inspection frequency. A change that affects one of those assumptions deserves a proportionate review even if the planned duration is one shift.

Use the risk criteria boundaries leaders set to define escalation thresholds before the next exception arrives. The decision should not depend on whether the person authorizing the work feels confident.

Myth 2: Approval means the risk has been accepted

Approval does not mean that risk has been accepted responsibly. It means a person has authorized a proposed state, and the quality of that authorization depends on evidence, authority, time limits, and control ownership.

Many reviews record a name and a signature without recording the decision that the name represents. Did the approver accept the exposure, accept a stronger control, accept a constrained scope, or simply accept that the operation could not wait? Those are different decisions, and they require different follow-up.

James Reason’s work on latent failures helps explain why a signed form can coexist with unsafe work. The visible act of approval may be correct while the surrounding conditions make failure more likely, including unclear authority, weak handover, incomplete information, or a control that exists only in the procedure.

A credible approval states the exposure, the temporary control, the residual uncertainty, the owner who can correct the condition, and the stop or escalation trigger. It also names the evidence that will prove the control is working. Without those elements, approval can become a record of optimism.

Myth 3: The risk assessment is the control

A risk assessment is not the control because it describes exposure without necessarily changing the conditions that create it. The assessment can identify a hazard accurately while the work remains dependent on memory, informal coordination, or a compensating action that nobody verifies.

The distinction matters when the original barrier has been removed. If a machine guard is unavailable, writing “use increased awareness” in the review does not replace the guard. If a competent technician must remain near an energized system, naming the technician does not make the system safe. The review must show how exposure is eliminated, isolated, reduced, or controlled in the actual sequence of work.

Andreza Araujo makes this distinction central to *Safety Culture: From Theory to Practice*. A formal requirement has value only when the operating routine produces the decision and behavior the requirement assumes. In management of change, that means the review should identify the physical, technical, procedural, and supervisory controls that will exist at the point of work.

Leaders can test this by asking a simple question during field verification. If the person who wrote the assessment disappeared, would the control still be present? If the answer is no, the change depends on personal reliability and needs a stronger design.

What evidence should a change owner demand?

A change owner should demand evidence that the new condition is understood, controlled, communicated, and capable of being reversed. The evidence should match the exposure rather than the convenience of the paperwork.

50% in 6 months was the accident-ratio reduction reported during Andreza Araujo’s PepsiCo South America tenure, where leadership cadence connected decisions with field execution. The lesson for change management is not to copy a number. It is to connect authorization with repeated verification.

The risk register as a decision system offers a useful companion practice because it keeps open exposures visible after the original meeting has ended.

Myth 4: Production pressure justifies a shorter review

Production pressure can justify a faster review, but it does not justify a weaker decision. Speed should reduce administrative delay while preserving the questions that protect people from an altered hazard profile.

Under pressure, teams often compress the review into three statements. The part is unavailable, the workaround is familiar, and the job must continue. That compression removes the information leaders need most, including what has become uncertain, who is affected beyond the immediate crew, and what condition will require a stop.

A short review can still be disciplined. Ask what changed, what can hurt someone, which critical control is different, who can authorize the next step, and what evidence must be checked before restart. Record the answer in plain language, then assign an owner who has time and authority to resolve the temporary condition.

Risk appetite should also be visible. A leader who cannot explain which exposure is being accepted, for how long, and under what control is not making a fast decision. That leader is transferring uncertainty to the next shift.

Myth 5: Closing the change ends the risk

Closing a change record does not end the risk unless the operation has returned to a verified state or formally adopted a new one. A closed record can hide residual exposure when the workaround has become normal work.

Restoration is more than removing a temporary label. It may require reinstalling a guard, updating a procedure, retraining affected roles, removing an alternate material, restoring an alarm, checking spare parts, and confirming that contractors received the same information as employees.

When restoration is impossible, the organization should treat the condition as a new operating state. That means a fresh ownership decision, updated controls, revised competence requirements, and a defined review cycle. Leaving the original change open forever is not control, but closing it without those actions is worse because the visibility disappears.

The control-of-work decision gates help leaders test whether restart is actually ready. A restart is credible when the barrier is present, the responsible person is known, the affected people understand the new condition, and the field confirms what the document claims.

How can leaders stop temporary workarounds becoming normal?

Leaders stop temporary workarounds becoming normal by giving every exception an owner, an expiry condition, and a visible review point. The system should make drift harder than escalation.

Start with a weekly exception review for open changes that affect critical controls, staffing, materials, isolation, emergency response, or contractor interfaces. The meeting should not ask only whether the item is still open. It should ask what has changed since approval, whether the temporary control has weakened, and what decision the owner needs from leadership.

Use field evidence rather than status color. A green dashboard can coexist with a control that no longer works, while a red item may represent a well-contained issue with a funded correction. As described in *A Ilusão da Conformidade* (Araujo), compliance becomes misleading when the record looks complete but the work has moved beyond what the record describes.

25+ years of multinational EHS leadership give Andreza Araujo a practical basis for treating exception management as a leadership responsibility, not a paperwork task. That perspective changes the question from “Did the form close?” to “Did the operation become safer or merely more accustomed to the workaround?”

What should a practical management-of-change standard require?

A practical management-of-change standard should require proportional review, named authority, control evidence, communication, expiry or adoption criteria, and post-change verification. These elements keep the process connected to decisions instead of turning it into a filing system.

The standard should define which changes require specialist input and which a supervisor can manage locally. It should distinguish permanent modifications, temporary workarounds, organizational changes, material substitutions, software or alarm changes, and changes in workload or staffing. It should also state what happens when the planned duration expires without restoration.

For a 320-employee plant, the first implementation step is not a new form. It is a sample of the last ten changes, including those that were never called changes. Review the language used, the authority exercised, the controls verified, the handovers completed, and the conditions that remained open. This exposes the gap between the written process and the operating process.

Each week without an expiry and verification routine allows temporary decisions to accumulate, making the next shift more dependent on memory and less able to see which controls have changed.

Management of change is credible when a temporary decision has the same seriousness as the exposure it creates. The strongest process does not slow every operation. It makes the altered condition explicit, assigns the right authority, verifies the control in the field, and prevents an exception from becoming the new normal.

Andreza Araujo’s books and work across more than 250 cultural transformation projects point to the same leadership test. If the organization wants people to escalate changed conditions before harm occurs, its management system must reward visibility, fund correction, and keep ownership alive until the work is genuinely restored or redesigned.