Link to .pdf
Link to Seveso Inspection Series Home Page
CIC - Management of Change (MOC)
THE ROLE OF MANAGEMENT OF CHANGE
The management of changes (MOC) over the life of a major hazard establishment is one of the basic elements in an effective Safety Management System (SMS). Studies from past accidents, (e.g., Flixborough, BP Texas City as well as many less well-known accidents) clearly show that a vast portion of chemical accidents have resulted from a failure to screen or analyse the impacts of a proposed change on risk, whether temporary or permanent. Even establishments that have management of change procedures can be vulnerable to accidents if the management of change process is incomplete or not systematically applied to all changes. For examples, sometimes, organisational changes are not analysed and controlled as thoroughly as plant changes, resulting in reduced defence against accidents. Similarly, temporary changes or extraordinary changes in emergency situations may be overlooked.
Common types of management of change failures associated with chemical accidents include:
- Failure to identify increased risk potential of a proposed change (screening failure)
- Inadequate assessment of the risk associated withthe change (risk assessment failure)
- Lack of or inadequate implementation of the recommendations of the risk assessment (follow-up failure)
- Inadequate communication and documentation of the change (communication failure)
- Exclusion of certain types of changes from the management of change process, in particular, temporary changes, and changes associated with procedures, staffing, site management, and infrastructure.
- Failure to apply MOC to all life cycles of the plant, e.g., start-up and decommissioning
The management of change element of the SMS recognises that an operator can inadvertently increase risk by failing to recognise the risk implications of a change.
Figure 1. Management of change is an important part of the safety management system
DEFINITION
MOC is a review and authorization process for evaluating proposed adjustments to plant design, operations, organization or activities prior to implementation, to make certain that no unforeseen new hazards to personnel, the public, or the environment is not unknowingly increased. It also includes steps to help ensure that potentially affected personnel are notified of the change and that pertinent documents, such as procedures, process safety knowledge, training programs, etc., are kept up-to-date. The design and authorization procedures of changes should involve all departments and units concerned as well as other specialised staff involved in the operations, such as maintenance, health and safety, etc.
The term "change" itself is defined as "any change, permanent or temporary, which may have some influence on safety conditions". It includes all changes to facilities and equipment with the exception of the substitution of the same elements (replacement in kind) and instrument or control system changes within pre-defined parameters (e.g. temperature may be allowed to fluctuate in a certain range).
Indeed, changes affecting accident risk can involve any aspect of the establishment, including processes, equipment, infrastructure and staff. They can be changes that introduce something new as well as changes that remove or substitute something that existed previously. Hence, not only installation of a new part inside the plant or a new piece of equipment should be considered a risk-relevant change, but also the introduction of a new material, the change of a value of a process variable, change in procedures or those arising from the acquisition of new knowledge in chemical-physical and toxicological sectors. Organizational changes are also now commonly recognised as changes that can address risks, for example, changes in management roles or structures, or changes in the safety-related responsibilities of managers, or levels of resourcing which may affect the ability to test safety critical elements in a timely manner, to operationally respond in a process upset, etc.
APPLICATION OF THE MOC AND TYPES OF CHANGES COVERED
It is particularly important that the MOC process is designed and implemented to capture all possible changes that could increase site risk. Failure to identify a safety-relevant change is a primary cause of many accidents, as numerous studies have shown.
Generally, changes can be of two types: technical and organisational. Within these categories, depending on the site, there can also be subcategories of changes with similar patterns and pathways leading to increased risk. for example, maintenance and repairs, equipment change, part replacement, and process redesign are all subcategories of technical changes. These categories are important for identifying and evaluating hazards associated with specific proposed changes.
1Executing the decommission of a plant in a safe manner requires its own procedures, including establishing appropriate and timely communication with affected plant personnel, coordinating safety management with contractors, safe removal and disposal of hazardous substances and contaminated items with appropriate attention to hidden sources (e.g. dead-legs), and mechanical and electrical isolation of the plant.
The MOC process applies equally to temporary changes and unanticipated changes. It should have specific provisions that adapt the MOC process to the specific needs of these change situations. Moreover, an inspector should pay particular attention during decommissioning.1
Technical changes
Technical changes are generally process-related changes associated with equipment (e.g., replacement, maintenance, modification, change of use), process operations (e.g., inputs, procedures, operating parameters), and supporting infrastructures (e.g., control room settings, energy supply, etc.).
Typical changes in this category could include:
- Introducing new equipment
- Changing the use of equipment (e.g., change in type of product handled, change in functional role)
- Changing the location of items (e.g. equipment, plant, product, hazardous substances)
- Temporary changes that compensate for the unavailability of equipment
- Replacement of equipment parts, when the new part is not identical to the original
- Varying the production capacity of the plant
- Adjustments to maintain the continuity of the process, e.g., increased temperature or pressure
- Change of inputs (e.g., change in input substance properties or product formula)
- Change of process procedure (adding or eliminating a step, changing the order of steps)
- Change in maintenance procedures or frequency
- Process testing or plant trials, for the improvement of process performances or to obtain new products
- Changes in the external environment (e.g. change of sensitive receptors, construction activities)
- Changes affecting power or water supply
- Changes in supporting IT programmes and control room configurations
- Decommissioning a section of plant, or recommissioning a section of plant which has not been operated for some time (as effects on the operation of the decommissioned part of plant may not have been considered when changes were made to surrounding plant).
Organizational changes
The identification of organizational changes should take into account changes in the organization of work (changes in procedures, training) as well as re-organizations, particularly changes in the structure or quantity of staff resources at all levels (operators, supervisors, managers). Changes in the allocation of tasks and responsibilities should be considered organizational changes. Moreover, any changes that could affect the ability of staff to perform the work assigned, such as changes in training qualifications, presence or number of qualified staff present or involved in certain operations, etc., also fall into this category. Other types of organizational changes could be changes in reporting lines (the way work is approved and checked) and staff reductions. Staff reductions are a special category of change that may often be overlooked. Safety-relevant changes to staff can occur in numerous ways, planned staff reductions, retirement, relocation of expertise to another site, etc. Scenario assessments should also be considered when an organizational change impacts staff who may have a role in handling emergencies or other crises.
Typical changes in this category may include:
- Staff reductions on safety critical processes
- Staff reductions tied to horizontal functions supporting all processes (e.g., reduction in control room staff)
- Changes/loss of key personnel including retirement
- Modification of training programmes, e.g., reducing frequency or subjects covered
- Changes in job qualifications for new hires
- Relocation of functions to another site (e.g., line management, technical specialists)
- Outsourcing of existing staff tasks/functions
- Change of site ownership
- Change in management strategy
- Changes to communication systems or reporting
The UK Health and Safety Executive has published summary guidelines on identifying and managing organizational change that can be downloaded at: http://www.hse.gov.uk/pubns/chis7.pdf
Temporary changes
Temporary changes, whose potential hazard may be greater or equal than permanent changes, should comply with the following conditions:
- A precise time limit for the change is fixed with possible extension subject to reapproval.
- The change is recorded in all the documents concerned (technical documentation, operating manual, maintenance instructions)
- After a fixed number of time extensions, the change is considered permanent, and hence, documented in procedures, operating manuals and technical documentation or reverted to original condition;
- A specific procedure is in place to verify that the established time limit for the change is respected.
- When the temporary change is no longer needed, there is a formal procedure to verify that the situation has been restored to prechange conditions or alternatively, to a new (permanent) condition that has been approved through the MOC process.
Extraordinary changes in emergency situations
In principle, the site should identify and evaluate potential extraordinary changes, such as emergency shut downs or power loss, as part of the overall site risk assessment process. Nonetheless, the MOC process should also cover the possibility that an unforeseen event requires an extraordinary change, with specific provisions adapted as necessary for emergency situations.
THE MOC PROCESS
An effective MOC should adopt and implement procedures for planning and implementing modifications throughout the life cycle of the plant, from design to decommissioning, and for all process conditions, normal and abnormal.
These procedures should specify (Subject to the evaluation of competent authorities, according to the national laws, where applicable):
- Definition of changes covered by the MOC process, with site-relevant detail as appropriate (i.e., examples of typical changes requiring MOC)
- The basic MOC process
- Guidance on how and when to initiate the MOC process
- Analytical inputs to evaluate practical, economic, and potential safety impacts of the change
- A risk assessment process with guidelines for identifying hazards and evaluating risks associated with change
- Procedures for documentation and approval of risk assessment recommendations
- A control system to ensure that steps of design and execution are carried out in the appropriate order and late changes in design are properly evaluated.
- Authorization to implement the change following the MOC procedure and verify its proper execution according to the MOC recommendations
- Procedures and criteria to ensure that all relevant competencies and operational staff and/or third parties are involved in the MOC evaluation process
- Clear roles and responsibilities of operational, technical and management staff in the MOC process for updating all relevant documentation, including the site risk assessment and the safety report
- Pre-startup safety review to:
- Ensure that the change has been implemented as per design i.e. "as-building".
- Ensure that the change has resulted in the intended outcome and no additional hazards can be identified.
- Documentation of the change in relevant procedures and other necessary communications
- Documentation of the change in all relevant technical documents and drawings
- Training for all staff and third party workers on the management of change process, as relevant to their role and responsibilities
Figure 2 is a flow chart of a typical MOC process.
Figure 2. Typical flow chart for the MOC process
How and when to initiate the MOC process
The organization should have a clear policy for implementing management of change with a clear and inclusive definition of changes that are candidates for the MOC process. The definition of MOC-applicable changes may include site-specific examples and typical situations that help staff to recognise that a change should be subjected to MOC. For example, it could describe a typical scenario surrounding parts replacement to illustrate when such a replacement is not a "replacement in kind" and therefore, must undergo an MOC process.
It should be possible for any staff to launch the MOC process. In addition, a senior level manager should be accountable for ensuring that the MOC process is launched and implemented consistent with the MOC policy.
Involvement of relevant staff and competencies
A crucial element of the MOC process is the involvement of relevant staff and expertise from the earliest stage of the process. A person with adequate knowledge to monitor the progress of the activities should be nominated for managing the change in place. All levels of staff with experience and expertise associated with activities affected by the change should be included, including third parties, such as contractors and consultants. The MOC procedure should involve both the staff of the operating line, and those who are interested in the implementation of the change, even for small changes. The emphasis should be on active involvement where input is solicited prior to execution of each step with follow-up for comment on results of each stage.
Initial phase: Evaluation of the proposed change(s)
The MOC typically requires a number of inputs at the initial stage that determine if and how the change will be implemented. These inputs include different analyses and tests that determine advantages and disadvantages of a specific change and alternatives. At minimum such information should include:
- Explanation/diagrammes of the affected process(es), including underlying engineering concepts, if relevant, and reasons for the change
- Proposed design of the change
- A risk analysis of the change
- A feasibility study
- A cost estimate
- Description of:
- How the change will be implemented, including interim stages of construction (if appropriate)
- Length of time needed to complete the change
- Who will be involved, necessary safety precautions, and
- Pre start-up testing procedures
If more than one alternative is proposed, then the same information should be provided for each alternative, with a summary comparing the different options.
The risk assessment process
The risk assessment should be carried out addressing the proposed changes, using an appropriate methodology. The result should have reference both to related responsibilities, and to subsequent reviews and variations. The risk assessment should take into consideration the potential impacts from all foreseeable conditions and scenarios, including all activities relevant to the safety of the plant, the safety management system, and emergency response.
The risk assessment procedures may include a preliminary screening process to guide the risk assessment, for example, to evaluate the magnitude of the hazards concerned and the effort and resources required in consideration of the complexity of the change.
The approval process
There should be an approval process with appropriate involvement of senior management for every step of the MOC procedure, starting with the initial evaluation phase until the start-up of operations. The process should follow implementation of the change in order to ensure that each step is aligned with the established MOC procedure. The MOC procedure itself should be well-documented for this purpose, including all relevant information to ensure the integrity of the risk assessment, such as:
- a description of scenarios and impacts evaluated
- evaluation of options to address identified hazards and recommendations
- time needed to implement recommendations
Once a change has been evaluated and executed, a pre-start-up check should be completed before the modified process is placed into operation. Verification prior to start-up should include controls to ensure that any training, communication and documentation requirements associated with the change have been fulfilled.
The final authorization for inclusion of the change in the process should be given only after this activity. The procedure should specify the required approvals and level of approval for different types of changes.
Pre-startup review
Once a change of system has been evaluated and realized, must be carried out a pre-seed occurs before the modified process is placed into operation, in order to ensure that the provisions has been correctly carried out and that the staff has received the information and training needed; for this purpose may be suitable as the use of a checklist. The final authorization for inclusion of the amendment in the process should be given only downstream of the pre-seed control.
TRAINING NEEDS
Prior to the testing and commissioning of the plant modification, or implementation of the new organizational structure and a new procedure, training and communication needs for relevant personnel should be established as appropriate and executed. Relevant personnel should be considered all staff, including third parties, whose responsibilities may be affected by the change, including line staff, supervisors, and affected support teams for example, emergency responders.
Evaluation and establishment of training needs should include:
- The identification of any gaps in skills and knowledge associated with potential hazards
- Development of a strategy to address gaps
- Allocation of the necessary time and resources to complete the training prior to implementation of the change
DOCUMENTATION
Final approval of the change should also require documentation of the change as appropriate in relevant procedures, such as the safety management system, operating instructions, the site risk assessment, etc. In addition, other instrumentation. documentation (P & IDs), maintenance instructions, piping and relevant communication measures might need to be considered and implemented, depending on the type of change, e.g., change alerts for staff and management, signage, or other awareness measures as deemed necessary.
INSPECTING AND AUDITING THE MOC
To carry out an objective evaluation of the effectiveness of a MOC system, it is necessary to examine both the documentation prepared by the organization and to make a site visit to verify, through interviews with the personnel involved, the sharing of information, the related awareness and that the changes were made in compliance with the procedures. In particular documentation should be examined to verify and assess:
- Procedures in place for the MOC
- Forms used (change request, change approval, planning, risk analysis, authorization, execution, etc.)
- Documentation of past changes
Interviews and observations should also be conducted to assess the consistency of application of the MOC procedure and to assess adequate staff awareness and training following the change. It is often useful to review the application of the MOC for the different categories of change, i.e., technical, organizational, temporary and extraordinary with safety, environmental or technical experts. Depending on the size and complexity of the site, the effectiveness of the MOC process should be measured with specific performance indicators to assess that each step of the MOC procedure has been properly conducted. The HSE guidance on the MOC process provides examples of both active and reactive measures.
TIPS FOR INSPECTING/AUDITING THE MOC
The tips below may help the inspector/auditor to carry out the necessary assessment for the MOC.
Technical, procedural and organizational changes
- Verify that the permanent changes and, where applicable, also the temporary changes are defined, taking into account the requirements of national laws.
- Verify the existence of a procedure to plan, design and implementation of change which includes at least:
- Identification of authorization procedures necessary for the implementation of the modification (including those concerning the increase of a risk of major accident according to National laws, where applicable);
- Hazards identification and risk assessment with deepening level adequate to the complexity of intervention in all the steps of performance of change;
- Check of the compliance with safety criteria and requirements;
- Final approval of the project of change;
- Definition of the documentation required;
- Planning of the activiites of implementation of change;
- Issue of the necessary permit to work;
- Control of any technical, procedural and organizational fall-outs resulting from the changes on the other parts of the installation and organization;
- Assignment of responsibilities;
- Final approval depending on the safety audit;
- Recording of the change;
- Updating of the plans and programs of information, and training related to the complexity of the change of all the potentially involved internal and external subjects and carrying out of the resulting activities;
- Updating of the checking plans, inspection and maintenance of the installations and procedures of inspection;
- In case of temporary changes, the maximum duration of such changes is established, after its expiry the changes will be removed or considered as permanent.
- Verify that personnel is aware of the specific hazards associated with the work and is able to determine that the risks involved are acceptable.
Documents update
Verify that before the final approval of the change, the updating of the following documentation is established:
- Risk assessment, internal emergency plan, (if appropriate, the safety report) and other requirements of the current regulations and anything else required by law
- Schemes, drawings and any other tool to identify and describe technically the plants, devices and equipment in use and the parameters which characterize its operation
- Updating of the operating procedures of conduct and maintenance, and any other documentation useful to describe correctly the modes for operating the plant
- Updating of the documentation for the information and training of the personnel
- Filling of the documentation concerning the aspects of change such as minutes of review and approval of change, performed training, etc.
PDF versions for printing
Suggested checklist questions
Go back to the Common Inspection Criteria website
