MOC vs PSSR vs Permit-to-Work: Which Review Fits a Temporary Process Change?

A temporary process change is a controlled departure from the approved way of operating, such as a bypassed interlock, substitute chemical, temporary line, altered set point, or revised sequence. The right review depends on the decision being made. Management of change tests whether the change is understood, pre-startup review confirms readiness, and a permit-to-work controls the specific job at the point of execution.

A temporary workaround can be technically sound and still become unsafe when the organization assigns it to the wrong control. A permit cannot replace a design review, while a management-of-change form cannot authorize a crew to start work beside an energized line. The decision matters because 3 control mechanisms may appear in the same file, yet each answers a different question.

This comparison gives plant managers, process engineers, and EHS leaders a practical way to choose among MOC, PSSR, and permit-to-work without turning the review into paperwork. It also connects the decision to four change states that need different safety reviews and to the boundaries between authorization and safe execution.

What decision are you actually trying to make?

The first decision is whether the organization is evaluating a changed system, confirming a ready system, or controlling a defined task. Management of change evaluates the changed condition and its consequences. A pre-startup safety review evaluates whether the modified or newly installed system is ready to enter service. A permit-to-work evaluates whether a particular crew can perform a particular job under defined conditions.

The distinction prevents a common failure in which one document is asked to carry all three responsibilities. OSHA places management-of-change requirements inside 29 CFR 1910.119(i), including the technical basis, safety and health impact, operating procedures, time period, and authorization of the change. The OSHA process safety standard therefore supports a broader change decision than a task permit can provide.

Andreza Araujo makes the same separation practical in Safety Culture: From Theory to Practice, where control credibility depends on what leaders verify in the work rather than on the presence of a completed form. If the question is “Can this changed process be accepted?”, start with MOC. If it is “Is the modified installation ready?”, add PSSR. If it is “Can this job begin now?”, issue a permit-to-work.

Which evaluation criteria separate the three controls?

The best method is the one that matches the risk decision, evidence, owner, timing, and release condition. A comparison should therefore use at least 6 dimensions, because a method that looks efficient on timing may fail on technical basis or operational ownership.

The matrix shows why these mechanisms are complementary rather than interchangeable. A plant may need all 3, but it should not ask the permit to explain a process change whose consequences have never been assessed.

When does management of change win?

Management of change is the strongest starting point when the proposed condition changes the technical basis, operating envelope, safeguards, people, materials, or time period of work. It is especially important when a temporary measure will remain in place across shifts, because the original decision can become invisible to the people who inherit it.

A useful MOC records at least 5 core questions: what is changing, why it is changing, what hazards are introduced, which procedures and competencies must change, and when the temporary condition ends. The record should name an owner, define the expiry or review date, and identify the verification required before closure. If the answer to any of those questions is “the permit will cover it,” the change has probably been classified too narrowly.

The UK HSE guidance on technical measures for change reinforces the need to consider modifications before they become normal operation. That matters because a temporary bypass can create a new failure path even when the job itself is performed exactly as authorized. Andreza Araujo’s executive experience across 25+ years of multinational EHS leadership points to the same practical test: leaders should ask which control will remain effective after the original decision-maker leaves the room.

When does a pre-startup safety review win?

A pre-startup safety review wins when equipment, software, a process line, a chemical, or a major configuration has been installed or modified and the organization is about to put it into service. Its purpose is readiness, not merely approval. The review checks whether construction matches the design, procedures exist, training is complete, safety-critical tests have passed, and unresolved actions are controlled before startup.

For covered process-safety operations, OSHA requires a pre-startup safety review for new facilities and for modified facilities when the modification is significant enough to require a change in process safety information. The review should confirm that construction and equipment are in accordance with design specifications, safety procedures are in place, and training requirements have been completed. A PSSR is therefore a release gate for the system, not a substitute for the MOC that explains why the system changed.

ISO 45001:2018 also places emphasis on operational planning and control, including managing changes and preventing unintended consequences. The ISO 45001 standard page is useful when the organization needs to connect readiness evidence to its wider OH&S management system rather than treating startup as an isolated engineering event.

When does a permit-to-work win?

A permit-to-work wins when the work is specific, time-bound, location-bound, and dependent on controls that must be checked at the job site. Hot work, confined-space entry, line breaking, excavation, energized work, and simultaneous operations often require this level of control because conditions can change after the review was approved.

The permit should identify the exact task, boundaries, isolations, hazards, responsible people, atmospheric or equipment checks, communication route, and suspension conditions. Its authority is narrow by design. A permit can stop a crew from starting when an isolation is missing, but it does not determine whether the business should operate a temporary bypass for 30 days or whether a substitute chemical changes exposure assumptions.

Andreza Araujo’s book Make The Difference: Be a Leader in Health & Safety frames operational leadership around the decisions supervisors make close to the work. That is where the permit becomes meaningful. The form is only evidence; the control is the supervisor’s verification that the stated conditions exist, remain valid, and are understood by the people doing the job.

What does the decision matrix recommend?

The decision matrix recommends MOC when the change itself is the uncertainty, PSSR when readiness for service is the uncertainty, and permit-to-work when execution conditions are the uncertainty. The three methods should be sequenced when one change creates all three uncertainties.

When two controls appear in the same case, assign one as the decision owner and the others as evidence-producing gates. That prevents the familiar outcome in which everyone signs, yet no one can say who has authority to stop startup or extend the temporary condition.

Which option fits your operating context?

Choose MOC first when the organization is still deciding whether and how to introduce the change. Choose PSSR when the technical solution is built and the question is whether it is ready to operate. Choose permit-to-work when the system is accepted and the remaining risk depends on how a defined task is performed today.

For a small site, one accountable change owner can coordinate the three records without creating a large committee. For a complex site, the owner should separate technical approval, readiness verification, and job authorization across qualified roles, because independence becomes valuable when production pressure is high. A 24-hour review cadence may be appropriate during commissioning, while a temporary change lasting 90 days needs a scheduled review rather than an open-ended approval.

The practical answer also depends on the consequence of delay. A permit may be the fastest control for an urgent repair, but speed does not remove the need to review a changed process. If the change affects a critical safeguard, escalate to MOC before the workaround becomes routine. Risk-matrix limits matter here because a low calculated score should not erase a material change in the system’s failure path.

How should leaders close the loop after approval?

Leaders should close the loop by verifying that the control chosen before the work still matches the condition observed during and after the work. That means checking the field, confirming the owner, reviewing open actions, and making an explicit decision to close, extend, or redesign the temporary state.

A simple review can occur at 3 moments: before implementation, before startup or return to service, and at the expiry or scheduled reassessment date. Each moment should answer a different question, because repeating the same signature does not prove that the control worked. Track the status of actions, the age of temporary conditions, the number of extensions, and whether field verification found a gap between the document and the installation.

Across more than 250 cultural transformation projects, Andreza Araujo’s central message remains relevant to this comparison: safety becomes credible when leadership changes decisions and work conditions, not when it collects more completed forms. The review is complete only when the organization can explain what changed, who owns the risk, what evidence supports release, and what will happen when the temporary condition expires.

Every week that a temporary condition remains open without a named review date increases the chance that a workaround will be treated as normal work, especially when new supervisors inherit the decision without its original technical context.

The right choice is not MOC versus PSSR versus permit-to-work. MOC governs the change, PSSR confirms readiness, and permit-to-work controls execution. When a temporary process change involves all three questions, use all three mechanisms, assign distinct owners, and make the expiry decision visible before the workaround becomes the standard.