MOC vs PTW vs PSSR: Which Control Fits Operational Change

Management of change, permit to work, and pre-startup safety review are often placed in the same procedural family, although they answer different risk questions. MOC asks whether a change should be allowed and under which conditions. PTW asks whether a specific high-risk task can start today. PSSR asks whether the changed system is ready to run without creating new exposure.

The problem starts when companies use one tool to compensate for the absence of another. A permit cannot repair a weak engineering change. A startup checklist cannot discover every risk that should have been evaluated before installation. A management-of-change form cannot control a live confined-space entry if the permit issuer never verifies atmospheric conditions.

This comparison is written for EHS managers, plant managers, maintenance leaders, and risk owners who need to decide which control should lead. Across 25+ years in multinational EHS leadership, Andreza Araujo has seen the same pattern in different industries: operational change becomes dangerous when the organization treats paperwork sequence as control quality.

Evaluation criteria for operational change controls

A useful comparison needs criteria that match the way risk actually moves through an operation. The first criterion is timing, since risk can enter during design, task execution, or restart. The second is authority, because the person who signs a permit may not have the authority to approve an engineering modification. The third is evidence quality, which determines whether leaders can prove that controls were evaluated, installed, and verified.

The fourth criterion is failure mode. MOC fails when the organization normalizes small changes until the accumulated risk becomes invisible. PTW fails when the permit becomes a signature ritual, disconnected from field verification. PSSR fails when restart pressure turns a readiness review into a last-minute checklist. These are not administrative differences. They are different ways for serious exposure to pass through the system.

James Reason's work on latent failures is useful here because operational change often exposes decisions made far from the worker who later faces the hazard. A mechanic may be blamed for a restart event, although the earlier failure sat in design review, isolation planning, contractor handover, or leadership acceptance of incomplete verification.

Andreza Araujo's The Illusion of Compliance is also relevant because these three tools can look strong in an audit while remaining weak in field reality. Compliance records matter, but only when they preserve the decision trail behind the control.

Management of change fits when the system itself is being altered

Management of change should lead when the organization alters equipment, process conditions, materials, software logic, staffing, layout, contractor scope, operating limits, or emergency response assumptions. The central question is whether the change introduces new risk or weakens an existing barrier.

MOC is strongest before the work becomes a task. It should force leaders to identify what changed, which hazards changed with it, which controls must be redesigned, and who has authority to approve the new condition. When MOC is treated as a late form after the change has already happened, the organization has moved from risk management into damage control.

A good MOC review should connect with the logic in critical control registers, risk registers, and bow-tie analysis, because a change may affect controls that were assumed stable in the risk register. If a ventilation system is modified, if a guarding interlock is bypassed for troubleshooting, or if a chemical concentration changes, the question is not only whether the task can proceed. The question is whether the risk model is still true.

The trap is treating MOC as an engineering-only procedure. Maintenance, production, procurement, EHS, and operations all create change. A substitution in cleaning chemicals, a contractor method statement, or a change in shift staffing can be as important as a piping modification when it alters exposure.

Permit to work fits when high-risk work needs field authorization

Permit to work should lead when a specific task creates exposure that needs live authorization, field verification, and stop authority. Hot work, confined space entry, line breaking, energized work, excavation, lifting near people, and work at height usually need permit logic because the control decision occurs at the worksite.

PTW is strongest on the day of execution. It verifies whether conditions are safe enough to begin, whether isolations are in place, whether the crew understands the hazard, and whether the permit issuer has seen enough field evidence. The article on building a permit-to-work audit trail expands this point from the evidence side.

A permit does not replace MOC when the task exists because the system changed. If maintenance needs hot work because a temporary repair altered the process layout, the permit controls ignition risk today, while MOC should control the design and operating assumptions behind the temporary condition. Confusing the two produces a dangerous shortcut, because the permit team may control the spark while nobody owns the changed process risk.

The PTW failure mode is speed. When a permit is filled out quickly, copied from yesterday, or signed by someone who has not visited the field, the organization has documentation without authorization. That is why field verification must remain visible in the permit process, especially before line breaking, confined space entry, and restart after isolation.

Pre-startup safety review fits when the changed system is about to run

Pre-startup safety review should lead when a new or modified system is ready to be energized, commissioned, restarted, or returned to service. Its central question is readiness. Have the controls identified earlier been installed, tested, communicated, and transferred to the operating team?

PSSR is strongest after design and installation, but before operation. It should verify drawings, alarms, interlocks, guarding, isolation points, procedures, training, emergency arrangements, and open actions. OSHA's Process Safety Management standard uses pre-startup review logic for covered processes, and the discipline is useful beyond regulated chemical operations because any restart can expose gaps between design intent and field condition.

The link with LOTO handback and equipment restart is direct. A restart is not a single switch-on moment. It is a transfer of risk from maintenance control back to operational control, and that transfer can fail when temporary bypasses, unfinished guards, weak alarms, or incomplete training remain unresolved.

The PSSR trap is ceremonial readiness. Leaders want the asset online, the project team wants closure, and production wants capacity. Under that pressure, open items get reclassified as minor, evidence becomes verbal, and startup approval is granted before the system is truly ready.

Decision matrix: MOC vs PTW vs PSSR

The table below separates the three tools by the decision they are supposed to make. The strongest risk-management system uses all three, but it does not let one pretend to be the other.

A practical sequence works in many industrial sites. Use MOC to decide whether the change is acceptable, PTW to control the high-risk task that installs or modifies the asset, and PSSR to decide whether the changed system can be handed back to operations.

Which control should lead in common scenarios

When the site changes a pump seal material because the original part is unavailable, MOC should lead. The change may affect chemical compatibility, temperature limits, maintenance frequency, or emergency response. A permit may be needed for the task, but the permit cannot answer whether the new material changes process risk.

When a maintenance crew opens a process line for repair, PTW should lead at the field level. Line breaking, isolation, residual energy, depressurization, drainage, barricading, and worker briefing must be verified before work starts. If that job results from a design modification, MOC may sit upstream, but the live authorization still belongs to the permit system.

When a modified conveyor, burner, tank, or packaging line is ready to return to service, PSSR should lead. The review should confirm that guarding, alarms, interlocks, procedures, training, emergency stops, and open actions are complete enough for operation. If unresolved items remain, leaders need a documented risk decision instead of an informal promise to fix them later.

When the change is temporary, the decision becomes harder. Temporary bypasses, temporary repairs, temporary staffing, and temporary operating limits still need formal control because temporary conditions often become normalized. The right question is not whether the change is permanent. The right question is whether the change alters exposure before the next review cycle.

Common traps when companies mix the three tools

The first trap is using PTW as the universal safety permission. A permit can verify today's conditions, although it cannot approve a new operating envelope, validate a substitute material, or decide whether an alarm logic change is acceptable. When every risk decision is pushed into the permit, the permit issuer becomes responsible for decisions outside the permit's design.

The second trap is closing MOC before field controls are real. A change can be approved on paper while the procedure remains outdated, training has not reached the night shift, labels are missing, and supervisors do not know which abnormal condition should stop the job. In more than 250 cultural transformation projects supported by Andreza Araujo, this distance between declared control and operated control appears frequently.

The third trap is accepting PSSR with weak open-item discipline. Some open items are genuinely minor, but the category can be abused. If an item affects a critical control, worker understanding, emergency response, isolation, guarding, or alarm function, it should not be treated as cosmetic simply because startup is late.

The fourth trap is missing contractor-driven change. Contractors often introduce methods, equipment, sequencing, scaffolds, temporary power, temporary ventilation, and shift patterns that change risk. If procurement and project teams do not trigger MOC, the first real review may happen at the permit table, when the field team has little room left to redesign the work.

Final recommendation for EHS and operations leaders

Choose MOC when the system changes. Choose PTW when a high-risk task needs live authorization. Choose PSSR when a changed system is ready to run. The comparison sounds simple, but the discipline is difficult because operational pressure tries to compress all three decisions into one signature.

Andreza Araujo's safety culture work argues that leaders must test what the organization repeats under pressure. Operational change is one of the cleanest tests. If people skip MOC for small changes, rush permits to protect schedule, or soften PSSR findings to restart faster, the culture is telling leaders where risk is actually being managed.

For organizations that need to strengthen change control, Andreza Araujo's safety culture consulting and executive programs help leadership teams connect engineering, creativity, and care with routines that keep operational change under control.