About Management of Change (MoC)?
Management of Change, or MoC, is the formal process an organization uses to review, assess, and approve any planned change to equipment, procedures, or organizational structure before it takes effect, so the risk it introduces gets caught before it causes harm rather than after. MoC governs whether a specific change to a physical asset, a procedure, or a reporting line should be allowed to happen at all. This article defines how MoC works and covers the concepts it overlaps with in practice: temporary versus permanent change, MoC versus a routine work order, MoC risk assessment versus FMECA, and pre-startup safety review inside the broader Process Safety Management framework.
Skipping or informalizing MoC rarely looks dangerous in the moment. A setpoint gets nudged during a shift because the original value seemed conservative. A replacement part with slightly different specifications goes in because it was on the shelf. None of these single decisions looks reckless on its own. What accumulates is a gap between the equipment, procedures, and organization that were formally approved and the ones actually running, and that gap is where process safety investigators consistently find the root cause of major incidents: not changes that were reviewed and still failed, but changes nobody reviewed at all. That exposure is sharpest in regulated, asset-intensive sectors, chemicals, oil and gas, and pharmaceutical manufacturing among them, but the discipline matters wherever equipment, procedures, or organizational structure evolve over time.
How does the MoC process work?
A working MoC process follows five consistent steps regardless of whether it runs on paper, in a spreadsheet, or inside software:
Propose and document the change. What is changing, why, and what it replaces.
Assess the risk. Evaluate safety, environmental, operational, and compliance impact, looking past the change itself to what it touches, a different valve model can shift piping stress, an altered setpoint can invalidate a trained response.
Get the right sign-off. Reviewers typically span more than one discipline, engineering, operations, and safety at minimum, so a risk one function would miss gets caught by another.
Implement under controls. The change goes live, often under interim monitoring while the organization confirms it performs as expected.
Verify and close out. Documentation, drawings, procedures, and training records are updated so what is written down matches what is actually running.
The most common breakdown happens between steps 1 and 2: someone has an idea, and the change is in place before an assessment or a second signature ever happens.
Temporary change versus permanent change
A temporary change addresses a defined, time-boxed need and carries a built-in expiration; a permanent change updates the approved baseline for good.
Temporary change: an interlock bypassed for one maintenance task, a substitute part while the correct one is on order. By design it carries an expiration: a date or triggering condition at which point it must be reversed or formally converted into a permanent change.
Permanent change: updates the approved baseline and becomes the new standard reflected in drawings, procedures, and training going forward.
This distinction is where MoC discipline erodes fastest in practice. A temporary bypass without a tracked expiration date tends to become permanent by default, simply because nobody circled back to close it out, and it never receives the review a genuine permanent change would require. A sound MoC process treats every temporary change as an owned, dated item, not a one-time approval that is filed and forgotten.
What is the difference between MoC and a work order?
A routine work order restores an asset to its original, already-approved specification: the same bearing replaces a worn one, the same-grade pipe repairs the same leak. Nothing about the approved configuration changes; the work simply returns the asset to the state it was always supposed to be in. MoC applies once something moves away from that approved state rather than back to it. A part from a different manufacturer with different tolerances, an adjusted setpoint, a resequenced procedure, these are all changes to the baseline, not restorations of it. The practical test is direction: if the work returns the asset or process to its previously approved state, it is maintenance. If it results in a state different from what was previously approved, it needs MoC. Getting the call wrong has a real cost either way: routing every like-for-like repair through full MoC buries the process in unnecessary paperwork, while waving through a genuine change as routine maintenance is how an unreviewed hazard gets introduced.
What is a pre-startup safety review (PSSR)?
A pre-startup safety review, usually shortened to PSSR, is the final confirmation step before a changed or new process is brought into operation: a check that what was physically installed matches the approved design, that procedures are current, and that everyone affected has actually been trained before working under it. PSSR happens after a change is physically built, confirming it was installed and prepared correctly before it goes live, distinct from the risk assessment that happens before a change is even approved.
What is Process Safety Management (PSM)?
Process Safety Management, or PSM, is the broader regulatory and management-system framework that governs how organizations in hazard-intensive, regulated industries, chemicals and oil and gas being the clearest cases, prevent catastrophic incidents involving hazardous materials or processes. PSM is not one requirement but a set of interlocking elements:
Process hazard analysis
Operating procedures
Training
Mechanical integrity
Emergency planning
Incident investigation
Management of Change
MoC is a required element inside a PSM program, not a synonym for it, and a weak or informal MoC process is a direct, commonly cited gap in PSM audits and incident investigations.
How is MoC risk assessment different from FMECA?
MoC risk assessment is where a proposed change gets systematically examined for what could go wrong if it proceeds, and how severe and how likely each scenario is. A thorough assessment traces downstream effects into connected equipment, operator procedures, training needs, and systems not obviously part of the original request, and its output defines the controls or added safeguards a change needs before it can proceed. That scope is deliberately narrow: one specific change under review. FMECA (Failure Mode, Effects, and Criticality Analysis) is broader by design, examining failure modes across an entire asset population over time rather than one proposed change. A reliability program asks where an organization is generally exposed to failure across its assets; an MoC risk assessment asks a narrower question: what does this particular change introduce that was not there before. Both matter, and both may inform each other, but they operate at a different scale.
Why Management of Change matters
An informal MoC process shows up later as safety incidents, regulatory findings, and unplanned downtime traced back to changes nobody properly evaluated. The underlying exposure is substantial: workplace injury costs the United States $176.5 billion a year. A structured MoC process, backed by consistent risk assessment and clear approval accountability, is one of the more direct ways an organization limits that exposure as its equipment, procedures, and teams keep changing. PETROFER, a manufacturing and chemicals company operating in a regulated environment in Germany, illustrates the compliance dimension: structured maintenance in a regulated chemical setting is exactly where MoC discipline, documented review, defined approvers, traceable records, stops being a nice-to-have and becomes the difference in an audit outcome.
Turning an approved change into scheduled work
A completed risk assessment identifies what could go wrong with a proposed change and what controls need to be in place. On its own, it does not execute the resulting work, notify approvers, track a temporary change to its expiration date, or keep documentation current once the change is implemented. That handoff, from a documented and assessed change to work that is scheduled, assigned, and tracked, is where Ultimo's Work Order Management supports the process: turning an approved change into planned, executed work connected to the same asset record the change was assessed against. Ultimo's HSE Suite supports the review side of that same handoff. Management of Change sits inside the HSE Suite alongside work permits, Lockout/Tagout (LOTO) procedures, and Incident Management, each covering a different moment in keeping work on regulated assets safe and auditable: work permits authorize specific work, LOTO controls hazardous energy during that work, Incident Management captures and follows up on what goes wrong, and Management of Change governs whether a change should be allowed to happen at all.
Management of Change in Ultimo
In practice, Ultimo customers experience MoC as part of a connected HSE Suite inside Ultimo's Intelligent Asset Management software, not as standalone management of change software: a change request tied to the specific asset it affects, a risk assessment and approval trail attached to that record, and a direct link forward to the work order, permit, or LOTO procedure the change eventually triggers. Because the change request, the assessment, the approvals, and the resulting work all live against the same asset data, asset professionals and HSE managers get a near real-time view of which changes are open, pending approval, or implemented and verified, rather than reconstructing that picture from paper trails after an audit or an incident. That connected record, not a separate point solution, is what Intelligent Asset Management contributes to a mature MoC program.
Frequently Asked Questions
What is the difference between Management of Change and a work order?
A work order restores an asset to its already-approved design or specification, a repair or a like-for-like part swap. MoC applies when a change moves the asset, procedure, or organization away from its previously approved state, which is why MoC requires a risk assessment and formal approval that a routine repair does not.
What happens if a temporary change never gets converted to permanent or reversed?
It becomes, in practice, an unreviewed permanent change, even though it never went through the approval a permanent change would require. This is one of the most common ways MoC discipline breaks down, which is why every temporary change needs a tracked expiration date and an accountable owner from the moment it is approved.
How does a risk assessment inside MoC differ from FMECA?
An MoC risk assessment is scoped narrowly to one specific proposed change and asks what that change introduces that was not there before. FMECA looks across an asset population's failure modes over time to identify where an organization is most exposed to failure in general. Both matter, but they answer different questions at a different scale.
Is a pre-startup safety review the same thing as the MoC risk assessment?
No. The risk assessment happens before a change is approved, to decide whether and how it should proceed. The pre-startup safety review happens after the change is physically implemented, confirming what was actually built or trained matches what was approved, before the change is allowed to go live.
How does Management of Change relate to Lockout/Tagout and Incident Management?
All three sit inside Ultimo's HSE Suite but cover different moments in the same lifecycle. Management of Change governs whether a change to equipment, procedure, or organization should be allowed to happen at all. Lockout/Tagout controls hazardous energy while work is physically performed. Incident Management captures and follows up on what goes wrong when something does. Together they give asset professionals one connected record instead of separate, disconnected processes.