Key Principles of Process Safety For: Management of Change: KP1 - MOC, January 2024
Key Principles of Process Safety For: Management of Change: KP1 - MOC, January 2024
Management of Change
The American Institute of Chemical Engineers (AIChE) and the Center for Chemical Process Safety (CCPS)
express their appreciation and gratitude to all members of the Golden Rules of Process Safety for Key
Principles project subcommittee for their generous efforts in the development and preparation of this
important guideline. CCPS also wishes to thank the subcommittee members’ respective companies for
supporting their involvement during the different phases in this project.
The collective industrial experience and know-how of the team members make this guideline
especially valuable to those who develop and manage process safety programs and management systems.
Before publication, all CCPS guidelines are subjected to a peer review process. CCPS gratefully
acknowledges the thoughtful comments and suggestions of the peer reviewers. Their work enhanced the
accuracy and clarity of this guideline.
Peer reviewers for the Key Principles of Process Safety for MOC:
Although the peer reviewers provided comments and suggestions, they were not asked to endorse
this guideline and did not review the final manuscript before its release.
This document is made available for use with no legal obligation or assumptions (i.e. use at your own
risk). Corrections, updates, additions, suggestions & recommendations should be sent Dr. Anil Gokhale,
Sr. Director CCPS Projects at [email protected]
If you are reading this offline, you may not be reading the latest version. Please check on the CCPS web
site for the current release. https://www.aiche.org/ccps/tools/golden-rules-process-safety
It is sincerely hoped that the information presented in this document will lead to an even more
impressive safety record for the entire industry; however, neither the American Institute of Chemical
Engineers, its consultants, CCPS Technical Steering Committee and Subcommittee members, their
employers, their employers' officers and directors, and its employees warrant or represent, expressly or
by implication, the correctness or accuracy of the content of the information presented in this
document. As between (1) American Institute of Chemical Engineers, its consultants, CCPS Technical
Steering Committee and Subcommittee members, their employers, their employers' officers and
directors, and its employees and subcontractors, and (2) the user of this document, the user accepts any
legal liability or responsibility whatsoever for the consequence of its use or misuse.
Table of Contents
This monograph addresses Management of Change which is a key element of Risk Based Process Safety (RBPS)
[1]. The key principles presented reflect good, common, or successful practices and are intended to assist in the
design and implementation of this element. This module is intended to strengthen and support Management
of Change programs.
❖ Why:
Defining a change that triggers the MOC process:
Understanding what is considered a change within your organization helps define the scope and
boundary of the MOC process.
Interpreting the definition of replacement-in-kind (RIK) as it applies to each proposed change
permits identification of those situations needing MOC review. RIK means that the design
specifications of the item being replaced, which could be equipment, chemical, etc., match the
design specifications of the original item. If the new item does not match design specifications of
the original item, it can lead to inconsistent implementation and may adversely impact the safety of
affected workers, the community, the environment, or business continuity [2].
Incident History:
On October 9, 2012, a flash fire at an ink manufacturing facility caused burn injuries to seven workers,
including three who sustained third-degree burns. Workers responded to a flash in the black ink
mixing room and to a loud thumping noise from the rooftop. The initial fire occurred in a bag
dumping station. As the workers congregated at the doorway, they observed a small fire in the
ductwork of a newly installed dust collection system above a process mixing tank. Suddenly, a large
flash fire emerged from the pre-mix room and engulfed the seven employees in flames. A new dust
collection system had been commissioned 4 days before the incident. An MOC had not been written
for this new dust collector system as engineers and senior management considered the dust
collector system as a replacement-in-kind for the old wet scrubber system, even though the original
design of the dust collection system had been modified. The original design was intended strictly
for dust collection but was modified before commissioning to include a vacuum cleaning function.
The new system provided insufficient air flow rate for the vacuum cleaning function, resulting in an
accumulation of hazardous materials in the duct system. This incident demonstrates that RIK must
be interpreted carefully and adhere to the principle that “in kind” means the same
design/engineering, same characteristics, same properties, same materials, etc. In this case the dust
collector that used a completely different operating concept was classified as a replacement-in-kind
and an MOC was not prepared for this change [3].
An MOC is required unless the change is a replacement-in-kind (RIK). RIK is described as an item,
which could be equipment, chemical, etc., that meets the design specifications of the item it is
replacing [2]. This means that the change doesn’t just fulfill the same purpose of what it is
replacing, but also has the exact same design and engineering, size, capacity, and all other
technical features.
Change can occur to process technology, the chemicals/materials used in a process, the
equipment, operating and other procedures, utility systems, infrastructure and organizations [2].
Operational or other options that are part of an approved operating, maintenance, or other
procedure are not changes and selecting one of those options (subject to the criteria and
conditions imposed by the procedure) does not represent a change. Essentially, these options
are pre-approved by being included in an approved procedure.
Management of Organizational Changes (MOOC) are sometimes addressed in a separate
procedure from technology, hardware, or procedural changes [2].
The change definition in the MOC and MOOC procedures should address when additions,
deletions, or revisions to a process or its supporting systems or an organization are considered
as a change to be managed [2].
The MOC procedure must include local regulatory requirements and local requirements
regarding the definition of change.
Change in service or conditions in existing equipment should be covered by MOC procedures.
For example, changes in operating conditions such as temperature, pressure, flow, etc., location,
or the intended purpose of the equipment would all be changes that require MOC.
RIK should be carefully considered with respect to changes in valves. For example, replacing a
gate valve with a globe valve of the same size would not meet the RIK description and thus
would qualify as a change because the hydraulic conditions are different for gate and globe
valves.
If a change affects operating procedures, sequence of operation, control system programming
or permitting of the process it would not meet the RIK description and thus would qualify as a
change.
Provide a written process to determine when MOC is required including situations where
applicability of the MOC procedure may be difficult to determine. Many companies have a flow chart
or checklist to help determine if the proposed change requires MOC or not. When the facility applies
MOC concepts to certain types of changes to personnel, staffing, or organizational changes, i.e.,
MOOC, then the definition of RIK should also include the types of organizational changes covered.
If it does not meet the RIK description, then an MOC should be generated for the change [2].
Provide specific examples of cases in which MOC or MOOC is or is not required in the facility’s MOC
and MOOC procedures with clear explanations why the example warrants or does not warrant an
MOC or MOOC. Local examples using facility processes, equipment, procedures, etc. will be the most
illustrative to site personnel.
Train all facility personnel on when an MOC is required and when it is not required, focusing on how to
interpret unusual or unclear changes. [1, pp. 423-448]
Key Principle #2: Follow the MOC procedure completely when creating, reviewing, approving and
managing an MOC
❖ Why:
Unauthorized or inadequately reviewed changes can create new or unknown hazards or risks. Changes
can also weaken or remove protections against previously identified hazards if not reviewed
adequately. Sometimes these hazards can go unnoticed for some time then later result in an incident
[2]. Also, MOCs for temporary changes present risks associated with changes that will be in place for a
defined, finite duration. Follow-up to ensure that the change is reversed, and conditions are returned
to their original configuration. Otherwise, a temporary change can become a permanent change,
invalidating the assumptions in the initial risk evaluation.
Incident History:
On October 9, 2012, a flash fire at an ink manufacturing facility caused burn injuries to seven workers,
including three who sustained third-degree burns. Workers responded to a flash in the black ink
mixing room and to a loud thumping noise from the rooftop. The initial fire occurred in a bag
dumping station. As the workers congregated at the doorway, they observed a small fire in the
ductwork of a newly installed dust collection system above a process mixing tank. Suddenly, a large
flash fire emerged from the pre-mix room and engulfed the seven employees in flames. A new dust
collection system had been commissioned 4 days before the incident. An MOC had not been written
for this new dust collector system as engineers and senior management considered the dust
collector system as a replacement-in-kind for the old wet scrubber system, even though the original
design of the dust collection system had been modified. The original design was intended strictly
for dust collection but was modified before commissioning to include a vacuum cleaning function.
The new system provided insufficient air flow rate for the vacuum cleaning function, resulting in an
accumulation of hazardous materials in the duct system. This incident demonstrates that RIK must
be interpreted carefully and adhere to the principle that “in kind” means the same
design/engineering, same characteristics, same properties, same materials, etc. In this case the dust
collector that used a completely different operating concept was classified as a replacement-in-kind
and an MOC was not prepared for this change [3].
On June 1, 1974, a cyclohexane oxidation plant was destroyed by a vapor cloud explosion. The
incident occurred due to an atmospheric release of cyclohexane which formed a vapor cloud that
was ignited by an unknown source. The resulting explosion destroyed the entire plant and resulted
in the 28 fatalities and 89 injuries. The effects extended beyond the plant into the surrounding
community, damaging over 1,800 houses and 167 businesses. The explosion resulted because a
temporary change had been made to the process. Plant personnel had decided to temporarily
bypass a reactor which was leaking to allow continued operation of the process. However, the
changes were done hastily, and the temporary bypass failed, releasing the cyclohexane. No MOC
process was in place at the plant. If an MOC process had been in effect at the plant, it would have
called for a proper design to the same standards as the original design, a proper safety review and
evaluation, and adequate approval at all stages of the change process [4].
On February 19, 1999, an explosion in a distillation system caused 5 fatalities and 14 injuries.
Employees were distilling the first commercial batch of an aqueous solution of Hydroxylamine.
Records indicate the Hydroxylamine concentration reached 86 wt. %. It was known in the pilot-plant
operation that high concentrations in excess of 70 wt. % of Hydroxylamine were explosive. That vital
information was not adequately shared with the plant [5].
❖ Key Principle #2: Follow the MOC procedure completely when creating, reviewing, approving and
managing an MOC
❖ How – All Users:
Follow the written MOC procedure completely.
An MOC should be written and approved prior to making the change to allow for proper review and
approval. Avoid using MOC as a documentation tool after the change has been implemented
(sometimes referred to as a “post-MOC”).
The review of the impact of the change on safety and process safety is the most important part of
the MOC process (see KP #3). This review helps identify and evaluate the hazards associated with
the proposed change.
MOC reviews and approvals can be performed 1) via face-to-face meetings , 2) individually or 3) a
combination of both [2]. More complex, or higher risk, changes may warrant multiple face-to-face
meetings.
With the advent of electronic MOC systems the individual review-in-isolation process has
become more prevalent. The isolation of individual reviews can lead to lack of understanding of
the change and missed hazards.
When MOC reviews are performed using meetings, care should be exercised to ensure that
participants are not pressured to agree with the group opinions.
The MOC reviews should include those who are most knowledgeable of the process and its
operations and the engineering details associated with the proposed change.
If MOC and PSSR have been combined, the PSSR must be completed before the MOC is considered
closed.
Ensure that all required relevant supplemental technical analyses are conducted, e.g., relief device
sizing calculations.
Ensure that physical change is managed safely and responsibly, i.e., operating procedures and
administrative processes are followed, e.g., work orders are issued, safe work permits are issued and
followed, etc. [2].
Temporary MOCs should be carefully managed.
Temporary MOCs should not be allowed to remain in place beyond their approved duration. If
additional time is needed and is warranted, then the procedure should contain provisions for
extending the duration of the temporary MOC, following appropriate review and approval. The
procedure should also address those situations where, following appropriate review and
approval, the temporary MOC can be converted to a permanent MOC [1, pp. 423-448].
Establish controls to ensure that the process or procedure is returned to its original
configuration, before the temporary MOC has expired.
Monitor temporary MOCs that are open to ensure that they do not become overdue.
Ensure that personnel with the necessary competencies perform the review and approval of MOCs,
particularly the safety and health review (see KP #3). While all of the following may not be required
for every MOC, consider including the following expertise:
Knowledgeable safety review leaders who understand and can apply various hazard
identification and risk assessment analytical methods. At least one of the MOC reviewers should
be trained and experienced in performing safety reviews or PHA’s, as appropriate (see KP #3).
Process safety
Environmental, Health, and Safety
Operations
Process Technology
Maintenance and reliability
Mechanical design
Instrumentation
Logistics
Human Resources, when the change involves staffing or organizational changes, i.e., MOOC is
being used.
Others as defined by the type of change.
The review team, including supervision and management who will approve the change must be fully
aware of the design basis, i.e., the reasons why every piece of equipment is installed in a process and
is designed the way it is.
Supervision and management must be fully aware of limitations in the internal organization’s
technical expertise and when external expertise/assistance is required during MOC reviews.
Avoid conflicts of interest in the review and approval of MOCs wherever possible. For example, the
initiator of an MOC should not be the safety and health reviewer, and the initiator of an MOC should
not be the approver of that MOC [1, pp. 395-448].
Process Knowledge (Process Safety Information), procedures, and other documents impacted by the
MOC must be updated for the MOC to be considered complete.
Define and implement a documented process for updating PSI and other information impacted
by the MOC.
Identify the persons responsible for each category of information to ensure new or revised data
meets requirements and is entered in the appropriate storage location/system.
Verify that information impacted by the change is accurate. For example, ensure the P&ID
matches the as-built conditions of the equipment in the field; ensure the operating procedures
properly describe actual operations performed [1, pp. 39-66].
Ensure that the MOC documentation or the PSSR addresses the distinction between information
that must be updated before start-up of the changed equipment and information that can be
updated after the startup.
Set expectations for the timely closure of action items to update the information due to a
change. Timely in this case should be measured in months (not years) [1, pp. 39-66].
Types of PSI that will likely need to be revised for most MOCs:
Documents describing the chemicals involved in the process, e.g., SDSs, incompatibility
matrices, etc.
Documents describing the technology of the process, e.g., PFDs, SOL/COD tables, etc.
Documents describing the process equipment, e.g., P&IDs, relief device design basis
calculations, equipment data sheets, etc.
Hazard Identification and Risk Analysis and other safety reviews [2]
Operating, ITPM, and emergency response procedures
Safety controls and safety systems.
Facilities, utilities, or infrastructure.
When the facility applies MOC concepts to certain types of changes to personnel, staffing,
or organizational changes, update job descriptions, organization charts, or other similar
records as necessary after organizational changes are made.
Other policies, procedures, or written practices as appropriate.
Consider using multiple MOC procedures or forms to effectively address all possible changes because
a single MOC process does not always work efficiently. When using multiple MOC procedures or forms:
Ensure that all basic requirements of MOC are included in the multiple procedures. This should
include the core parts of an MOC, i.e., the technical justification; analysis of the EHS impacts of the
change; the approvals; informing affected personnel before operating the change; identification of
whether the change temporary or permanent, and update of PSI.
Examples:
Special MOC procedure for operating procedure changes
Special MOC procedure for installing pipe clamps
Special MOC procedure for adjusting equipment testing and inspection frequencies
Temporary MOC procedure for bypassing safety devices
Management of Organizational Change (MOOC) procedures
MOC strongly relies on the prevailing process safety culture. MOC requires that all personnel believe
that MOC is important, and that changes, however simple and obvious they may seem, should only be
implemented with the appropriate review and authorization [5] [1, pp. 423-448]. This strong MOC
culture is accomplished primarily via awareness training and management reinforcement. Activities that
should strengthen acceptance of the MOC program include:
Providing training that emphasizes the reasons for why a strong and consistent MOC system is being
deployed.
Stressing management expectations for MOC conformance, including the responsibilities for the
various roles under the MOC program.
Including case studies of incidents where MOC was a contributing cause in training. These should
include both industry and local incidents and near misses where an inadequate or missing MOC was
a contributor.
Describing the findings of audits and other evaluations of the MOC program in training [2].
If the implementation of the MOC is delayed for an excessive amount of time, then the risk /hazard
analysis of the MOC should be repeated to ensure that the hazards identified in the original review are
still controlled adequately. If any new or modified hazards are identified, recommendations should be
made, and actions taken, to control them.
A common industry practice is to combine MOC and the PSSR portion of the Operational Readiness
(OR) elements of a process safety program. Where this has occurred the PSSR is the last step in the
MOC before starting or restarting the process. PSSRs often have long-form or short-form checklists
depending on scope and complexity of the change that they are a part of [6].
Either in the MOC procedure or in the PSM metrics procedure include appropriate MOC Key
Performance Indicators (KPI) to measure the quality and health of the MOC program and to drive MOC
improvement. Examples of MOC KPIs include the number of open MOCs and their aging, the status of
action items from MOC reviews and their aging, etc. These KPIs should be collected frequently (e.g.,
monthly) and analyzed by appropriate management personnel to determine corrective action when
needed.
❖ Key Principle #2: Follow the MOC procedure completely when creating, reviewing, approving and
managing an MOC
❖ How – Operators, Mechanics, and Technicians:
If an MOC is associated with a work order, ensure that the MOC has been approved before executing
the work order and making the physical change.
Raise issues when the MOC process is not being followed.
Be aware of all temporary MOCs in your area of responsibility and understand their impact. [1, pp. 39-
66, 395-448]
❖ Key Principle #2: Follow the MOC procedure completely when creating, reviewing, approving and
managing an MOC
❖ How – Management:
Ensure that the facility has sufficient resources and priorities to execute the MOC process. Procedures
should address both the primary roles and responsibilities as well as back-up personnel.
Ensure that the written process is properly followed.
Develop performance indications and data collection to evaluate the status and implementation of
the MOC system. For example, an audit of work orders to determine if work orders that required
MOC received them and were all required steps completed before field implementation [1, pp. 39-
66, 631-647]
Incident and near miss reports, and audit reports, should be reviewed to gauge the strength of the
MOC system and identify needed improvements.
Exhibit beliefs and behaviors that strengthen the culture in support of the MOC process, and the
overall process safety culture of the facility. Communicate and reinforce expectations for the execution
of the MOC process, including expectations for conducting MOCs when required [2].
Ensure that the appropriate personnel receive training. MOC initial awareness and refresher training
are provided to affected personnel.
❖ Key Principle #2: Follow the MOC procedure completely when creating, reviewing, approving and
managing an MOC
❖ How – Engineers and Designers:
Understand when an MOC is required following the site procedure, particularly for projects [2].
Assist in the definition of RIK on specific changes where technical input is needed.
Key Principle #3: Evaluate the hazards or risks of the proposed change and identify needed risk
controls
❖ Why:
The review of the impact of a proposed change on safety and process safety is the most important part
of the MOC review and approval process. The safety review helps identify and evaluate the new
hazards and risks presented by the prospective change, or how the change may alter existing hazards
and risks. It also identifies the additional or modified protective features necessary to prevent or
mitigate any risk added or increased by the proposed change.
Incident History:
On July 17, 2001, an explosion occurred at a refinery. A crew of contractors was repairing grating on
a catwalk in a sulfuric acid storage tank farm when a spark from their hot work ignited flammable
vapors in one of the storage tanks. One contractor was fatally injured, and eight other workers
suffered acid burns, burning eyes and lungs, and nausea. Tank 393 was one of six 415,000-gallon
carbon steel tanks originally built in 1979 and located in a common diked area. The tanks stored
fresh and spent sulfuric acid used in the refinery’s sulfuric acid alkylation process. Over the years, the
tanks had experienced significant localized corrosion. Leaks were found on the shell of tank 393
annually from 1998 through May 2001; all of the reported leaks were repaired, except for one
discovered in May 2001. However, at the time of the incident, several additional undetected holes
were in the roof and shell of tank 393. Tank 393 was one of four tanks originally designed for fresh
H2 SO4 that had been converted to store spent acid. Since spent H2SO4 normally contains small
amounts of flammable materials, the company had installed a carbon dioxide (CO2 ) inerting system
and a conservation vent with a flame arrestor on tank 393. However, the system was poorly designed
and did not provide enough CO2 flow to prevent the formation of a flammable atmosphere in the
vapor space of tank 393. The company did not use its MOC system to assess the conversion of tank
393 from fresh to spent acid service. As a result, the conversion did not benefit from the following
MOC good practices, particularly the safety and process safety ramifications of proposed changes:
review and sign-off on the proposed changes by subject matter experts (e.g., corrosion, tank design)
and higher level management; a process hazard review; or a pre-startup safety review (PSSR) [7].
❖ Key Principle #3: Evaluate the hazards or risks of the proposed change and identify needed risk
controls
❖ How – All Users:
In addition to the technical reviews that typically occur during the consideration and approval of
MOCs, conduct a review to fully analyze the potential safety and process safety impacts of the change.
When the facility applies MOC concepts to personnel, staffing, or organizational changes, the MOOC
should also include a separate safety and health review of proposed organizational changes [2] [1, pp.
423-448].
The purpose of the safety and process safety review of a proposed change is not to approve the
change. Its purpose is to identify and thoroughly assess potential safety and process safety issues
associated with the change. The safety and process safety reviewer(s) should not regard themselves as
an advocate for the proposed change, regardless of who is proposing it or why. When the facility
applies MOC concepts to certain types of changes to personnel, staffing, or organizational changes,
the purpose of examining the safety/health/process safety impacts of the organizational changes is the
same in an MOOC [2] [1, pp. 423-448]
The MOC procedure should specify the type, scope, level of detail, participants, ground rules, and
documentation for the hazard reviews that are performed in support of MOCs. These reviews should
be commensurate with the risks associated with the proposed change. This decision process should
include a deliberate, knowledgeable decision, that is independent of the originator, and address
whether the proposed MOC should be subject to a formal process hazard analysis (PHA). If a PHA is
not considered necessary, then another form of documented safety and process safety review should
be performed [2] [1, pp. 423-448].
If a safety and process safety review other than a PHA is performed, checklists or other tools should be
incorporated into the review process so that this step is performed consistently and is thoroughly
documented. Care should be exercised to ensure that the hazards considered are not constrained to
only the entries on a standard checklist. Reviewer(s) should be encouraged to add or modify the
checklist contents to address any unique considerations of the proposed change [2] [1, pp. 423-448].
The MOC safety and process safety review workflow can be designed to be performed:1) via meetings
(face-to-face or remotely); 2) with each team member working individually; or 3) as a combination of
both. Each of these approaches have advantages and disadvantages [2] [1, pp. 423-448].
With the advent of electronic MOC systems, individual reviews have become more prevalent, which
has increased the percentage of such reviews being performed. However, without the benefit of
collaborative meetings, these individual reviews can lead to lack of understanding of the change and
hazards may be missed, particularly when only one safety and process safety reviewer is assigned to
an MOC.
When MOC safety and process safety reviews are performed using collaborative meetings, care
should be exercised to ensure that participants are not pressured to agree with others and conform
to the group’s opinions [1, pp. 67-87] [5].
When the MOC safety and process safety review workflow specifies individual MOC reviews, they can
be performed either in series or in parallel. The following issues should be considered when choosing
which pathway to take:
Parallel reviews among multiple reviewers occur more quickly, however, the results of one reviewer’s
comments and concerns might not be available to the other reviewers, unless some sort of final
summary review follows the parallel individual reviews.
Series reviews take longer to accomplish but allow reviewers to see what the previous reviewers have
said about the safety and process safety impact of the change (assuming the entire review record is
accessible to all reviewers). Of course, the first few reviewers in the review process will not have as
much previous opinion available as the last few reviewers.
The decision to perform a formal PHA versus a simpler safety review for MOCs should be based on
established criteria in the MOC procedure. Examples of such criteria include: [2] [1, pp. 423-448].
A new process being installed onsite.
A new chemical that has toxic, reactive, or flammable properties is being used or introduced to the
site.
The inventories of hazardous materials are being significantly changed (increased or decreased).
The process includes creation of an explosive mixture.
Undesired release to a sewer or non-contained area.
Significant changes in the operating conditions for the process.
Alteration of the chemical composition, corrosivity, or reactivity of existing hazardous materials
onsite, including catalyst alteration.
Alteration of the physical properties of process fluids (e.g., the vapor pressure).
❖ Key Principle #3: Evaluate the hazards or risks of the proposed change and identify needed risk
controls
❖ How – Operators, Mechanics, and Technicians:
Participate in MOC safety and process safety reviews and PHAs when requested to provide your
expertise or your experience.
If participating in MOC safety and process safety reviews or PHAs do not be intimidated or hesitant to
express your opinion, even when it seems at odds with the opinions of others [1, pp. 67-87] [5].
❖ Key Principle #3: Evaluate the hazards or risks of the proposed change and identify needed risk
controls
❖ How – Management:
Ensure that adequate resources are provided to allow MOC safety and process safety reviews to be
performed in a timely and thorough manner.
Assign competent personnel to lead and perform MOC safety and process safety reviews, or approve
the assignments if they are made by others in the organization. When the facility applies MOOCs the
review should include appropriate personnel who can examine a proposed organizational changes and
reach cogent conclusions regarding the safety and process safety impacts, i.e., Operations,
Safety/Process Safety, Human Resources.
Provide training in MOC safety and process safety reviews for those personnel who will participate in
these reviews.
Do not approve MOCs if any doubt remains regarding the safety or process safety ramifications of a
change, or if the review of an MOC has not been completed in the correct manner or may not have
effectively identified and evaluated the hazards and risks of the proposed change.
Do not allow any participant in an MOC safety or process safety review or PHA to be pressured into
agreeing with the other reviewers. Those offering dissenting opinions regarding the safety or process
safety ramifications of proposed changes must be allowed to express their opinions without fear of
peer pressure or negative human resources ramifications.
Establish and monitor metrics that are relevant to the conduct and status of MOC safety and process
safety reviews and the implementation of recommendations that are generated by those reviews.
Prescribe that more than one person is required for MOC safety and process safety reviews. At a
minimum, if only one person performs a review then at least one other person should review the
results. To the extent possible the review of the results should be performed by someone who is
independent from the proposed change.
❖ Key Principle #3: Evaluate the hazards or risks of the proposed change and identify needed risk
controls
❖ How – Engineers and Designers:
Participate in MOC safety and process safety reviews and PHAs when requested to provide your
expertise or your experience.
Lead MOC safety and process safety reviews and PHAs when requested because of your expertise or
your experience, particularly PHA experience when required.
If participating in MOC safety and process safety reviews and PHAs do not be intimidated or hesitant
to express your opinion, even when it seems at odds with the opinions of others.
❖ Key Principle #3: Evaluate the hazards or risks of the proposed change and identify needed risk
controls
❖ How – Emergency Responders:
Participate in MOC safety and process safety reviews and PHAs when requested because of your
expertise or your experience.
If participating in MOC safety and process safety reviews and PHAs do not be intimidated or hesitant
to express your opinion, even when it seems at odds with the opinions of others.
❖ Why:
Emergency MOCs are often used when something has to be changed quickly and cannot wait for the
normal MOC process to be completed. In this context, “emergency” actually means “emergent,” i.e., it
means that the MOC needs to be performed quickly. It does not mean that the change the MOC is
avoiding an emergency situation, unless the situation has never occurred before or has not been
previously evaluated. If this is an emergency condition or situation, the emergency MOC should
include revising the SOPs or other procedures governing the activity to allow options to avert the
condition or situation in the future so as not to rely on an MOC for that purpose. The use of
emergency MOCs will bypass temporarily the critical and deliberate thinking that is needed in an MOC
process, and also may bypass careful safety reviews of each change. Therefore, emergency MOCs
should not be used frequently [2, pp. 27-60].
Emergency MOCs are sometimes necessary to abate an immediate safety or process safety hazard
that represents a clear and present danger. However, a detailed review of the change should be
conducted as soon as possible after implementation to identify any additional controls needed to
ensure the safety of the change, including revisions to SOPs or other procedures which will allow
operators or other personnel the flexibility to quickly and safely deal with the hazard without relying
on the MOC process.
Emergency MOCs are sometimes used because they represent a simpler and quicker way of getting
an MOC approved than the normal process. The urge to use emergency MOCs because they are
easier and more convenient should be resisted.
Incident History:
An automatic drum loading system developed problems on a Friday evening. A temporary “quick
fix” was put in place by the shift foreman without an MOC so that the drum loading system could
be used in a manual mode until it could be permanently repaired on Monday when the maintenance
staff would be available. In the manual mode a valve had to be opened with an adjustable wrench
and the drum had to be carefully positioned under the filling head, which could not be lowered into
the drum. A week later this manual mode was still being used because the maintenance personnel
had not yet repaired it. A drum was not positioned accurately, and the liquid splashed into the
operator’s face causing an injury. While it is sometimes necessary to make changes on short notice
in order to keep a system running, in such cases, the normal management of change process should
be implemented as soon as possible and not later than the next working day [8]. Not reverting a
temporary or emergency change back to normal after it is no longer needed is an example of the
normalization of deviance and should be avoided. In this case allowing the “quick fix” change to the
drum loading system to remain for a week after it was needed (without permanently correcting the
problem with the automatic loading features) normalized the manual loading mode, which is not
the operational intent of the system.
when all or most of the normal reviewers/approvers are onsite and available [1, pp. 423-448] [2, pp.
27-60].
The situations where emergency MOCs can be used should be limited to changes needed to
preserve the normal environmental, health, safety, or process safety status of the facility, e.g., to
prevent an imminent release of hazardous materials.
Emergency MOCs should not be used for programmatic changes in policies or procedures where
an imminent EHS threat or vulnerability does not exist.
Emergency MOCs should not be used for changes that will preserve or enhance the ability to
meet production goals.
Emergency MOCs should never be renewed—they should only be approved and then reversed
when they are no longer needed. If a permanent change is needed, then a revised or new MOC
should be generated following the normal MOC process.
Emergency MOCs are not exempt from risk / hazard reviews as described in KP #3. The hazard or
risk review may be performed verbally using available personnel and fully documented later if
necessary. Although this important step in the MOC process might have to be performed over the
telephone, using e-mail, or by similar more rapid means, it is vitally important that the safety and
process safety ramifications of an emergency MOC be examined by competent personnel and that
any issues raised during this more rapid evaluation be discussed thoroughly until closure is reached
on them.
Require that emergency MOCs be allowed to exist for time periods that are no longer than is needed
for a normal temporary or permanent MOC to be created, reviewed, and approved. This should
normally be the next regular workday plus a nominal amount of time required to process a normal
MOC as expeditiously as possible [8].
Typically require that senior level staff will be required to approve an emergency change.
The rules for emergency MOC approval should include verbal approval for emergency MOC
during off hours. Sometimes, personnel have no time to make offsite calls and the approval is
limited to those personnel on site at the time.
Emergency MOCs should involve several people to help ensure nothing important is missed
during the abbreviated review and approval. [2, pp. 27-60].
Define the communication methods that are allowed for verbal approvals of emergency MOCs and
specify how these communications are to be documented.
Various communications means should be allowed, including voice, texting, e-mail, video or
audio teleconferencing, or face-to-face reviews and approvals.
Communications of emergency MOCs between shifts should be part of the shift turnover
process.
In general, emergency MOCs should receive the same level of communication and
importance as bypassed or removed safety devices.
Emergency MOCs should be agenda items during daily operational meetings held among senior
staff at the facility.
Require an abbreviated form of documentation for the emergency MOC that can be easily and
quickly completed by those seeking the approval. This can be brief hand-written forms,
computerized versions of such forms, pre-formatted email or text submittals and approvals, or other
forms of recording what is being proposed and what has been approved for each emergency MOC.
The emergency MOC process and documentation should still include the core parts of an MOC,
i.e., the technical justification; known EHS impacts of the change; any required risk controls; the
persons approving the change; requirements for informing affected personnel before operating
the change.
Temporary procedures needed to implement the emergency MOC should be included with the
emergency MOC. Other topics that are typically addressed during the normal MOC process, such
as permanent modifications to SOPs and PSI can wait until the emergency MOC is replaced with
a normal MOC.
The date and time of the approval and execution of the emergency MOC should be recorded.
Perform a thorough review of each emergency MOC at the first available opportunity, normally on the
next working or operational day when staff that typically review a temporary or permanent MOC are
available [1, pp. 423-448] [2, pp. 27-60].
The replacement of the emergency MOC with a normal temporary or permanent MOC should be
expedited without sacrificing technical correctness or completeness, or the ability to adequately
think through the possible ramifications of the change, particularly the possible safety and process
safety impacts.
The replacement of the emergency MOC should be accomplished expeditiously because the change
already been made to equipment or procedures. If the follow-up MOC reveals a critical flaw in the
emergency MOC (e.g., if the change is judged to be imprudent, or the need for additional risk
controls is identified) mitigation of the emergency MOC needs to be implemented as soon as
possible.
Train all relevant facility personnel on the process for issuing and approving emergency MOCs.
When the emergency MOC is being replaced with a normal MOC at the next opportunity, the full
technical capabilities and knowledge of the facility, the company, or other subject matter experts
should be involved in the review and approval of the normal MOC [2, pp. 27-60].
Key Principle #5: Communicate changes to personnel whose jobs are affected by the change
❖ Why:
Personnel need to be aware of changes to the process, equipment, and procedures they work with
each day and how those changes affect their roles and responsibilities.
Personnel need to be aware of how the MOC process affects their areas of responsibility.
Incident History:
On October 9, 2012, a flash fire at an ink manufacturing facility caused burn injuries to seven workers,
including three who sustained third-degree burns. Workers responded to a flash in the black ink
mixing room and to a loud thumping noise from the rooftop. The initial fire occurred in a bag
dumping station. As the workers congregated at the doorway, they observed a small fire in the
ductwork of a newly installed dust collection system above a process mixing tank. Suddenly, a large
flash fire emerged from the room and engulfed the seven employees in flames. A new dust collection
system had been commissioned 4 days before the incident. The workers had received 15 minutes of
training and had attended a walk-through of the new dust collection system.
As designed, the new dust collection system started automatically when any of the mixing tank
motors was energized and automatically shut off (after a specified delay) when all mixers were
inactive. However, the dust collection system actually continued to run overnight, even when all the
ink mixers were shut off. The CSB concluded that the explosion and flash fires occurred because of
continuous manually controlled heating of the mixing tanks and operation of the dust collection
system for several hours after commissioning, with the system continuing to draw condensable
vapors into the ductwork. Continuous operation of the dust collection system led to self-heating
and spontaneous self-ignition of the accumulated sludge-like material and the powdery dust mixture
of carbon black and clay in the ductwork. Although aware of the change, the communications to the
operators did not include enough detail on operations of the ink mix tank heating systems when
connected to the new dust collection system [3].
❖ Key Principle #5: Communicate changes to personnel whose jobs are affected by the change
❖ How – All Users:
Define and implement a documented process for appropriately communicating changes to all affected
personnel [1, pp. 395-448].
Identify the facility personnel affected by each change. Examples include operations, maintenance,
laboratory, or anybody else who will interact with the impacted systems or procedures.
Simple changes may only require documented communications that inform affected personnel
about them.
More complicated changes will require more detailed training. Training may range from required
reading and sign off to classroom or hands-on practical training.
For MOOCs, informing affected personnel of the staffing or organizational change by using typical
company provisions for providing HR-related information to facility personnel will be adequate.
❖ Key Principle #5: Communicate changes to personnel whose jobs are affected by the change
❖ How – Operators, Mechanics, and Technicians:
Understand each change and its impact on your role and responsibilities [1, pp. 39-66].
Do not operate or maintain a changed system until receiving adequate training or information.
Seek out assistance from supervision if further clarification is required [1, pp. 39-66].
❖ Key Principle #5: Communicate changes to personnel whose jobs are affected by the change
❖ How – Management:
Ensure that the communications are made to all impacted personnel prior to operating or maintaining
the change [1, pp. 395-448].
Verify that the communications that are made to all impacted personnel are understood through
interviews, walk throughs, simulations, or other appropriate training techniques when required [1, pp.
395-421].
Maintain documentation of the communications provided (either informing or training).
Management review should assess the effectiveness of change communications to include reviewing
communications/training records and interviews with affected personnel [1, pp. 631-647].
❖ Key Principle #5: Communicate changes to personnel whose jobs are affected by the change.
❖ How – Engineers and Designers:
Understand and appreciate the change and its impact on your role on projects.
Often, engineers are assigned as MOC Coordinators. In this role, greater knowledge will be required on
how the MOC procedure at the facility is intended to work, the flow of MOC documentation either
electronically or via hard copy, and the status of various MOCs. Part of the responsibilities as MOC
Coordinator is to make decisions about MOC reviews, perhaps make assignments of personnel for
these reviews, and maybe approve MOCs [1, pp. 39-66].
Seek out assistance if further clarification is required about a specific MOC and its impact. These may
be internal or external subject matter experts as needed [1, pp. 39-66].
If assigned, create and share change communications as defined by the MOC procedure policy [1, pp.
423-448].
Ensure that communications and training that you deliver are clear and understandable to the
audience [1, pp. 395-448].
❖ Key Principle #5: Communicate changes to personnel whose jobs are affected by the change.
❖ How – Emergency Responders:
Understand each change and its impact on your role and responsibilities as an ERT member if the
change applies to emergency response procedures, capability, or equipment [1, pp. 39-66].
Do not operate or maintain changed emergency response equipment or use revised emergency
response procedures without first seeking adequate training or information.
Seek out assistance from supervision if further clarification is required [1, pp. 39-66].
References
[1] CCPS (Center for Chemical Process Safety), Guidelines for Risk Based Process Safety, Hoboken, NJ: John
Wiley & Sons, 2007.
[2] CCPS (Center for Chemical Process Safety), Guidelines for Management of Change for Process Safety,
Hoboken, NJ: John WIley & Sons, 2008.
[3] CSB, "US Ink/Sun Chemical Corporation Ink Dust Explosion and Flash Fires Final Report," US Chemical
Safety and Hazard Investigation Board (CSB), csb.gov, 2012.
[4] Center for Chemical Process Safety, "Building Process Safety Culture: Tools to Enhance Process Safety
Performance," 2015. [Online]. Available: www.aiche.org/sites/default/files/docs/embedded-
pdf/Flixborough-Case-History_0.pdf. [Accessed 5 May 2021].
[5] CCPS (Center for Chemical Process Safety), Essential Practices for Creating, Strengthening, and Sustaining
Process Safety Culture, Hoboken, NJ: John WIley & Sons, 2018.
[6] Center for Chemical Process Safety (CCPS), "Key Principles for Operational Readiness," 2021. [Online].
Available: aiche.org/ccps. [Accessed 2021].
[7] CSB, "Motiva Enterprises Refinery Incident Report," US Chemical Safety and Hazard Investigation Board
(CSB), csb.gov, 2001.
[8] T. Kletz, What Went Wrong? 5th edition, Amsterdam: Elsevier, 2009.
[9] CSB, "Concept Sciences Explosion Final Report," US Chemical Safety and Hazard Investigation Board (CSB),
csb.gov, 2002.