Management of Change: 7 Gaps Before Startup

OSHA 29 CFR 1910.119 treats Management of Change as a required control for changes in process chemicals, technology, equipment, procedures, and facilities, except replacement in kind. This article gives EHS managers seven gaps to close before a modified system returns to service.

The thesis is blunt. Management of Change fails when it becomes an approval route for engineering changes rather than a risk-control conversation that reaches maintenance, operations, contractors, and supervisors before startup. A pre-mortem safety review can expose weak assumptions before that release decision becomes field exposure.

Why Management of Change fails before the first shift starts

Management of Change is the formal process that evaluates and controls safety impact before a change is installed, commissioned, or released to routine operation. OSHA's PSM standard names five review elements in 1910.119(l)(2), including the technical basis for the change, safety and health impact, procedure changes, time period, and authorization requirements.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture is visible in repeated decisions, especially when the formal system competes with production pressure. MOC exposes that culture because the organization must decide whether a schedule date is more important than updated procedures, trained people, and verified controls.

EHS managers should treat every MOC as a bridge between design intent and field execution. The bridge is weak when engineering signs off, operations receives a late notification, maintenance improvises a workaround, and supervisors inherit a risk they did not help evaluate.

This makes MOC a natural partner to prevention through design decisions, but with a sharper operational deadline. The change is about to enter the plant, and weak assumptions become field exposure quickly.

1. The change is classified too narrowly

A change is classified too narrowly when the team treats it as a mechanical, electrical, procedural, or supplier adjustment without asking how it changes exposure at the point of work. OSHA 1910.119(l)(1) covers changes to chemicals, technology, equipment, procedures, and facilities that affect a covered process, which is broader than many local forms suggest.

Across 25+ years leading EHS at multinationals, Andreza Araujo has seen serious risk hide in small words such as temporary, like-for-like, quick fix, and vendor recommendation. The label makes the change feel routine, although the operating condition, isolation method, alarm response, or maintenance task may have changed enough to create a new failure path.

The practical test is simple. Before accepting the classification, ask who will touch the change, who will operate near it, what energy or substance could be released, which critical control depends on the old condition, and whether a contractor will see the system differently from an employee.

If those answers are not written into the MOC record, the organization has not classified the change. It has only named the work package.

2. The technical basis does not reach the supervisor

The technical basis of a change explains why the change is needed and what assumptions make it safe. OSHA requires that basis to be addressed, but the field weakness appears when the explanation stays inside engineering language and never becomes a supervisor decision rule.

In more than 250 cultural-transformation projects supported by Andreza Araujo's team, one repeated pattern is the gap between approved documentation and operated reality. A drawing revision can be technically correct, although the shift supervisor still needs to know which valve position, alarm response, access restriction, or isolation point has changed.

The MOC package should translate technical basis into field implications. For example, if a pump seal, chemical concentration, interlock, bypass logic, or ventilation rate changes, the supervisor needs the operating limit, abnormal condition, stop-work trigger, and escalation path in plain language.

This is where pre-task risk assessment checks become useful. The supervisor cannot challenge a job plan when the MOC never tells them what assumption changed.

3. Safety impact is reviewed without SIF exposure

Safety impact review is weak when it lists general hazards but does not identify serious injury and fatality exposure. A change that affects pressure, stored energy, line breaking, confined space entry, chemical compatibility, lifting, traffic flow, or machine guarding deserves a different level of scrutiny from a low-consequence administrative change.

What many MOC systems miss is the difference between hazard presence and consequence credibility. A modified sampling point may look minor on the project tracker, but if it places an operator in the line of fire during pressurized work, it belongs in the SIF conversation.

EHS managers should require every MOC to include a SIF exposure field with a short defense. The reviewer should state which unwanted event is credible, which critical control prevents it, how that control will be verified before startup, and who has authority to delay the release if evidence is weak.

This ties MOC directly to control effectiveness metrics, because the real question is not whether the review happened. The real question is whether the barrier still works after the change.

4. Procedures are updated after people already work

Procedures are part of MOC because people execute the changed system before the organization has time to relearn it informally. OSHA 1910.119(l)(5) requires process safety information and operating procedures to be updated when a change results in new information.

The Illusion of Compliance (Araujo), published in Portuguese as A Ilusao da Conformidade, is useful here because it separates documents that exist from controls that operate. A procedure uploaded after startup may satisfy a record requirement, although it did not guide the first maintenance intervention, first cleaning cycle, or first abnormal operation.

The procedure update should happen before release, and it should be tested against the changed task. Ask an operator or mechanic to walk through the procedure with the new condition visible. Any hesitation, missing step, incorrect sequence, or unclear limit should return the MOC to revision.

The common trap is to treat the procedure as a clerical closeout item. In reality, the procedure is one of the first controls that workers use when the changed system behaves differently from memory.

5. Training confirms attendance, not changed behavior

MOC training is effective only when affected employees understand the change before startup and can demonstrate the new control behavior. OSHA 1910.119(l)(3) requires employees involved in operating a process, and maintenance and contract employees whose tasks will be affected, to be informed of and trained in the change before startup.

The weak version of this requirement is a toolbox talk with signatures. The stronger version asks whether the mechanic can isolate the new energy source, whether the operator can respond to the new alarm, whether the contractor understands the access restriction, and whether the supervisor can explain the stop-work trigger.

During the PepsiCo South America tenure, where the accident ratio fell 50% in six months, Andreza Araujo learned that durable improvement depends on routines that change decisions, not campaigns that collect attendance. MOC training should therefore include field demonstration for any high-risk change.

This also prevents a familiar failure. A team receives the information, signs the sheet, and then returns to the old routine because no one tested whether the new routine could survive real production pressure.

6. Temporary changes become permanent by silence

Temporary changes create risk when the MOC record names a time period but no one owns the return-to-normal decision. OSHA includes the time period for the change among the required MOC considerations, which means duration is not an administrative detail.

Across 30+ countries and 250+ companies, Andreza has seen temporary controls become part of the landscape when leaders stop asking why the exception still exists. The danger is not only technical. It is cultural because people learn that bypasses, substitute materials, provisional barriers, and staffing exceptions can persist as long as nothing bad happens immediately.

EHS should maintain a temporary-change register reviewed weekly by operations, maintenance, and safety. Each item needs an expiry date, owner, compensating controls, field verification, and explicit decision to remove, extend, or convert through a full permanent-change review.

This is especially important for risk methods such as LOPA in safety decisions, where assumptions about independent protection layers can become false when a temporary change quietly alters how the layer works.

7. Startup authorization ignores field evidence

Startup authorization should be the final evidence review, not the last signature before production resumes. A changed system should not start until the organization verifies procedures, training, control readiness, emergency response impact, drawings, isolation points, alarms, and affected teams.

CCPS guidance on Management of Change for process safety emphasizes effective and efficient MOC procedures, and the practical lesson is that efficiency cannot mean skipping field proof. The best MOC systems make the release decision depend on evidence from the workplace, not only on approvals from people who are far from the exposure.

A useful startup checklist asks whether the changed condition was walked down, whether operators and mechanics can explain what changed, whether critical controls were tested, whether open actions are acceptable for startup, and whether the supervisor has authority to stop the release if the field does not match the record.

For complex changes, connect MOC to bow-tie critical control gaps. The release decision should prove that prevention and mitigation barriers still exist after the change, especially where high-energy or chemical-release scenarios are credible.

Management of Change as paperwork versus field risk control

Each startup released with an incomplete MOC teaches the organization that approval is enough, while the first shift after the change carries the highest uncertainty and the least informal experience.

Conclusion

Management of Change protects people only when it connects technical change to field behavior, SIF exposure, updated procedures, demonstrated training, temporary-change discipline, and startup evidence. A signed MOC package is not proof of control unless the people who operate, maintain, supervise, and contract around the changed system can work safely with it.

If your organization needs to turn MOC from a routing workflow into a safety-culture control, request a diagnostic with Andreza Araujo or deepen the leadership approach through Andreza Araujo's safety books and guides.