Management of Change Explained: 4 Change States That Need a Different Safety Review

A change can be approved, documented, and still introduce a hazard that nobody has tested. Management of Change, usually shortened to MOC, exists because the risk of a modification is not limited to the equipment being replaced. The change can alter procedures, competence, workload, safeguards, or the assumptions behind an existing risk assessment.

This explainer separates four change states that safety leaders should not process with the same review. The practical test is to identify what is changing, decide which controls may be invalidated, and verify that the people who operate the changed system can act on the new conditions.

Management of Change is a controlled process for identifying, assessing, approving, communicating, and verifying safety impacts before a non-routine change becomes part of normal work. It applies to technical modifications, temporary conditions, organizational changes, and urgent interventions when the original risk controls may no longer fit.

What is Management of Change?

Management of Change is the decision discipline used when the work system will no longer be the same as the one described in the approved design, procedure, risk assessment, or training material. It does not exist to create another approval queue. It exists to expose the assumptions that a modification may disturb.

OSHA's Process Safety Management standard, 29 CFR 1910.119, requires an organized review for covered changes to process chemicals, technology, equipment, procedures, and facilities, except replacement in kind. ISO 45001 also treats planned changes as something that must be controlled within the occupational health and safety management system. The exact form can vary, but the safety question remains consistent: which barriers no longer have the same meaning after the change?

As Andreza Araújo argues in Safety Culture: From Theory to Practice, compliance matters only when it is translated into decisions that remain usable in the operation. An MOC that collects signatures without testing the changed work is paperwork with a longer name.

What are the four change states?

1. Permanent technical change

A permanent technical change modifies equipment, layout, materials, process parameters, software, control logic, or a physical safeguard in a way that is expected to remain. Examples include replacing a pump with a different model, changing an interlock, moving a chemical transfer point, or altering storage capacity.

The review should connect the engineering decision to the operating envelope. Ask whether the change affects energy isolation, alarm response, maintenance access, detection capability, emergency arrangements, or the competence needed to operate the system. A drawing update is not enough when the operator's sequence has changed as well.

2. Temporary technical change

A temporary technical change introduces an altered condition for a defined period. A bypass, rented pump, temporary platform, substitute material, software patch, or temporary routing can fall into this category, even when the team believes the work will last only a few shifts.

The defining control is not the word temporary. It is the existence of a clear owner, expiry date, restoration plan, and verification method. A temporary-change review should also state what happens if the deadline arrives before the permanent solution is ready, because schedule pressure is part of the risk picture.

3. Organizational or work-practice change

An organizational change affects who performs the work, how decisions are made, or how the task is coordinated. It may follow a restructuring, shift-pattern change, contractor transition, outsourcing decision, reduced staffing model, or revised maintenance strategy.

These changes are easy to miss because no valve, sensor, or building appears different. The risk can still increase when supervision becomes remote, handover time shrinks, a critical skill leaves the team, or a decision that once had one owner is split across several functions. Safety Culture Diagnosis emphasizes comparing stated arrangements with operating evidence, which makes this change state impossible to assess from an organization chart alone.

4. Emergency or urgent change

An emergency change is made under time pressure because waiting for the normal sequence could increase the immediate danger. The urgency may involve damaged equipment, loss of a protective system, an unexpected supply interruption, or a condition that requires a short-term intervention before the full design is available.

Urgency changes the pace of review, not the need for control. The decision record should name the hazard being accepted, the temporary safeguards, the person with authority to approve the response, and the trigger for escalation. Once the immediate condition is stabilized, complete a retrospective review that converts emergency assumptions into durable controls or formally removes the temporary arrangement.

How do you differentiate the four states in practice?

Start with the change itself, not with the form that someone wants to open. If the modification changes the physical or technical system, ask whether it is expected to remain or has a defined restoration date. If it changes people, roles, workload, or coordination, treat it as an organizational change even when no hardware is involved. If the decision is being made under immediate threat, use the emergency pathway and record why the ordinary sequence could not be completed first.

A useful MOC record should show the original condition, the new condition, the hazards affected, the barriers that need redesign or revalidation, and the evidence required before normal operation resumes. A risk score can support that discussion, although it should not replace the control review. The site's risk matrix explainer covers the limits of false precision when a number hides a weak decision.

When should an MOC be opened?

Open an MOC when a change can affect the hazard profile, the effectiveness of a safeguard, the sequence of work, the competence required, the emergency response, or the ability to detect deterioration. A replacement in kind may not require the same process, but the organization still needs a clear rule for deciding what counts as equivalent.

Across 25+ years leading EHS at multinational operations, Andreza Araújo has built her authority around connecting engineering, creativity, and care. That combination matters here because MOC is neither an engineering-only review nor an EHS filing exercise. The person closest to the work must be able to explain what will be different on the next shift.

How does MOC become a dependable control?

An MOC becomes dependable when approval is tied to evidence. The owner verifies that procedures match the changed system, affected workers understand the new hazards, supervisors can identify the stop conditions, and the field reflects the approved design. If one check fails, the change is not ready for normal operation.

Use a short closeout conversation at the point of work. Ask what changed, which barrier carries the most protection, what could make the change unsafe, and who can stop the task. Those questions produce better information than a signature that only confirms the form reached the next inbox.

For practitioners building a complete diagnostic, Andreza Araújo's books and Safety Culture Diagnosis resources offer a practical bridge between written systems and operating behavior. Safety is about coming home, and a change-control process earns its place when it protects that outcome before the new condition becomes routine.

FAQ

Is Management of Change only for process safety?

No. OSHA's Process Safety Management standard gives a detailed regulatory example for covered processes, but the underlying discipline also applies to occupational safety systems when a change can invalidate a hazard control, procedure, competence requirement, or emergency arrangement.

Does every small change need a full MOC?

No. The organization should define replacement-in-kind and low-risk boundaries, then use screening to determine the review depth. A small physical modification can still deserve escalation when it affects a critical safeguard or changes how people respond to an alarm.

Who owns an MOC?

The person accountable for the changed process should own the decision and closeout. EHS can provide technical challenge and assurance, but transferring ownership to EHS weakens operational accountability.

How long should a temporary change remain open?

Only as long as the approved temporary condition is necessary and controlled. The record should include an expiry date or review trigger, an owner, interim safeguards, and a decision path when restoration is delayed.

What is the strongest closeout evidence?

Field verification is the strongest final check because it tests whether the approved change, the procedure, the competence, and the physical conditions agree at the point of work.