Management of Change (MOC): Process, Triggers and a Filled Form
Management of change (MOC) is a written procedure that makes sure any change to equipment, chemicals, procedures, facilities or the organization is reviewed for its safety impact, approved by the right people and communicated before it goes live. It stops a change from quietly adding a hazard or removing a safeguard, and it closes with updated documents and trained workers.
Many serious failures in process safety did not start with a broken rule. They started with a reasonable-looking change: a bypass to keep production running, a different gasket, a smaller crew on the night shift. Each change was small on its own. Nobody asked what it did to the hazards around it.
This guide shows how to ask that question every time without drowning the site in paperwork. You will get a decision table for what counts as a change, a seven-step MOC process, a way to scale review depth to the risk, specific rules for temporary and organizational changes, and a fully filled MOC form for a worked example.
A Pump Swap That Was "Just Temporary"
Picture a paint plant (a fictional example). The transfer pump that moves solvent from a bulk tank to the mixing room fails on a Friday. The spare is on back order for four weeks. The maintenance supervisor rents an air-operated diaphragm pump, connects it with a flexible hose, and production restarts that night.
Nobody broke a rule. But nobody asked the questions either. Is the rental pump rated for the solvent? Is the hose conductive and bonded, or is it a static ignition source in a flammable atmosphere? Does the new pump bypass the high-level interlock that tripped the old one? Do the operators know the startup sequence is different? And when the spare arrives, who makes sure the rental pump actually leaves?
This is exactly the kind of change an MOC procedure exists for. It is also a real pattern, not a hypothetical one. At Flixborough, UK, in 1974, a leaking reactor was removed and a temporary bypass pipe was installed so that production could continue. The UK Health and Safety Executive's case summary records that only limited calculations were done, no drawing of the modification was made and the pipework was not pressure tested. The bypass ruptured on 1 June 1974. The vapor cloud explosion killed 28 workers and injured 36 others on site.
What Is Management of Change?
Management of change is a safety management process that identifies, reviews, approves, implements and closes out changes so that their hazards are controlled before the change is in use. It is sometimes written as "MOC" or "MoC" and is different from "change management" in the HR sense, which is about helping people accept organizational change.
The best-known legal requirement is in the US Process Safety Management standard. 29 CFR 1910.119(l) requires written procedures to manage changes to process chemicals, technology, equipment, procedures and facilities that affect a covered process. Paragraph (l)(2) lists five things the procedure must address before any change:
| 1910.119(l)(2) item | What it means in practice |
|---|---|
| Technical basis for the change | Why the change is needed and the engineering behind it |
| Impact on safety and health | The hazard review |
| Modifications to operating procedures | Which procedures, drawings and checklists must change |
| Necessary time period | Permanent, or temporary with an end date |
| Authorization requirements | Who must approve, and at what level |
Paragraphs (l)(3) to (l)(5) add that affected operators, maintenance staff and contractors must be informed and trained before startup, and that process safety information and operating procedures must be updated.
Outside process safety, ISO 45001:2018 Clause 8.1.3 requires an organization to establish a process for implementing and controlling planned temporary and permanent changes that affect OH&S performance. It covers new or changed processes, work organization, working conditions and equipment, changes in legal requirements, new knowledge about hazards and developments in technology. It also requires the organization to review the consequences of unintended changes and act to mitigate adverse effects. The standard does not prescribe a form or a workflow, so the process in this guide can be used to meet it.
Which Changes Need MOC?
A change needs MOC when it alters anything that the current risk assessment, procedures or design basis rely on. The one standard exemption is a replacement in kind, which OSHA defines in 1910.119(b) as "a replacement which satisfies the design specification." OSHA's non-mandatory Appendix C adds that change includes all modifications to equipment, procedures, raw materials and processing conditions other than replacement in kind.
Use this table to train supervisors on the borderline cases:
| Situation | MOC? | Why |
|---|---|---|
| Replacing a failed pump with the identical model from the spares list | No | Replacement in kind: meets the design specification |
| Replacing a pump with a different model "that does the same job" | Yes | Different materials, seals, ratings or controls |
| Changing a gasket material on a solvent line | Yes | Materials of construction are a listed equipment change |
| Raising a production rate above the documented range | Yes | Operating outside established parameters |
| Disabling or re-setting an alarm or interlock | Yes | Safeguards are part of the design basis |
| Switching to a new cleaning chemical | Yes | New raw material, new SDS, new hazards |
| Rewriting a startup procedure | Yes | Procedure change; operators need training |
| Moving a workstation to another building | Yes | Workplace and layout change |
| Cutting the night shift from two operators to one | Yes | Organizational change affecting response and supervision |
| Repainting a handrail in the same color | No | No effect on hazards or controls |
Two questions settle most cases. Does the change alter the design specification, a safeguard, a procedure or the people doing the work? Would the current risk assessment still be correct after the change? If the answer to the first is yes or the second is no, open an MOC.
The MOC Process in 7 Steps
An MOC process moves every change through the same seven gates, from request to close-out. Smaller changes pass through each gate quickly; nothing skips a gate.
1. Request
The person proposing the change completes the request: what is changing, why, where, for how long and who owns it. The technical basis belongs here, not in a later email.
2. Screen and classify
An MOC coordinator confirms that it is a change, not a replacement in kind, and assigns a tier (minor, moderate or major) and an end date if it is temporary.
3. Hazard review
The reviewers ask what the change does to hazards and controls. Use the method that matches the tier: a checklist for minor changes, a What-If session or Job Safety Analysis for moderate ones, a HAZOP study for major process changes. Score the risk with your usual method and pick controls using the hierarchy of controls, not PPE first.
4. Approve
Approval comes from people with authority over the affected area. For anything above minor, that means operations, maintenance and safety together. Approval is conditional on the actions from step 3.
5. Implement
The change is installed under normal work controls, including a permit to work for hot work, line breaking or confined space entry. Procedures, drawings and labels are updated, and affected people are trained before startup.
6. Pre-startup safety review (PSSR)
A short, documented walkdown confirms the change matches what was approved: equipment built to specification, procedures in place, actions closed, training done. Under 1910.119(i), a PSSR is required for modified facilities when the modification is significant enough to require a change in process safety information. Many sites use a short PSSR for every change because it is the last point to catch a gap.
7. Close out
The MOC owner confirms that documents are updated, the risk assessment reflects the new state and, for temporary changes, the original condition is restored on time. Then the record is closed.
How Deep Should the Review Be?
The review should be as deep as the change is hazardous. OSHA's Appendix C describes the range: a minor, well-understood change may need only "a check list reviewed by an authorized person", while complex or significant changes may need "a hazard evaluation procedure with approvals by operations, maintenance, and safety departments."
A three-tier scheme turns that into a rule people can apply on a Friday night:
| Tier | Typical changes | Hazard review | Approvers | PSSR |
|---|---|---|---|---|
| Minor | Equivalent component with a different part number; label or layout tweak with no new hazard | MOC checklist | Area supervisor plus one technical reviewer | Checklist sign-off |
| Moderate | New chemical, new equipment type, procedure rewrite, temporary equipment, staffing change | Team What-If or JSA, risk scored | Operations, maintenance, safety | Documented walkdown |
| Major | New process unit, change to a safety system, change in operating limits, organizational restructuring | HAZOP or equivalent formal study | Operations, maintenance, safety plus site manager | Full PSSR with punch list |
Two rules keep the tiers honest. First, anyone can raise the tier, but only the MOC coordinator can lower it, and the reason is written down. Second, any change to an alarm, interlock, relief device or other safeguard is at least moderate, however small it looks.
Temporary and Organizational Changes
Temporary and organizational changes are the two types most often missed, so they need explicit rules in the procedure.
Temporary changes
OSHA's Appendix C is direct: "Temporary changes have caused a number of catastrophes over the years." It says a time limit for temporary changes should be set and monitored, that temporary changes are subject to MOC, and that equipment and procedures must be returned to their original or designed condition when the temporary period ends.
In practice:
- Every temporary MOC has an end date on the form, not "until the spare arrives."
- The MOC register flags temporary changes that are seven days from expiry.
- Extending a temporary change needs a new approval, with the same reviewers.
- Close-out of a temporary change is a physical check that the temporary item is gone and the original is back.
Organizational changes
The UK HSE's guidance on organisational change lists reducing staffing levels, using contractors or outsourcing, combining departments and changing roles and responsibilities. It notes these are usually not analyzed and controlled as thoroughly as plant or process changes, even though subtle organizational changes can have significant effects on how hazards are managed.
HSE points out that risk comes from two places: the new organization itself and the transition to it. Its principles translate into four MOC questions:
- Which safety-critical tasks did the old roles perform, and who performs each of them after the change?
- Can the new staffing handle an emergency or abnormal situation, not just normal operation?
- What training and experienced support do people in new roles need?
- Have staff and contractors been consulted before, during and after the change?
If you are bringing in a contractor to do work your own people used to do, run the MOC alongside your contractor safety management prequalification.
Worked Example: A Filled MOC Form
Here is the MOC for the rental pump in the opening scenario, completed the way it should have been. The plant, people and numbers are fictional; the structure follows 1910.119(l)(2) and the seven steps above.
| Field | Entry |
|---|---|
| MOC number | MOC-2026-041 |
| Title | Temporary rental diaphragm pump for solvent transfer, Tank T-3 to Mixing Room 2 |
| Requested by / owner | Maintenance supervisor / production manager |
| Type and tier | Temporary, equipment. Moderate (new equipment type in a flammable atmosphere) |
| Time period | 14 October to 11 November 2026 (4 weeks). Extension needs re-approval |
| Technical basis | Duty pump P-12 failed (bearing). Identical spare on order. Rental air-operated diaphragm pump to keep supply to Mixing Room 2 |
| Is it replacement in kind? | No. Different pump type, drive, materials and controls |
| Hazard review method | Team What-If session (production, maintenance, safety, one operator) |
| Hazards found | 1. Static ignition from non-conductive hose. 2. Pump runs without the T-3 low-level and Mixing Room high-level interlocks that stopped P-12. 3. Diaphragm material compatibility with the solvent unconfirmed. 4. Compressed air exhaust may carry solvent vapor into the room. 5. Operators unfamiliar with startup and isolation |
| Controls required | 1. Conductive hose, bonding and grounding checked with a meter. 2. Pump air supply routed through a solenoid valve tripped by the existing interlocks. 3. Supplier compatibility confirmation for diaphragm and seats before use. 4. Exhaust piped outside the room. 5. Temporary operating instruction and toolbox briefing for all three shifts |
| Procedures and documents to update | Temporary operating instruction TOI-041; P&ID marked up with temporary pump; area risk assessment entry added |
| Training | All mixing room operators and the maintenance on-call team, before startup. Attendance list attached |
| Approvals | Production manager, maintenance manager, safety specialist (all signed 14 Oct) |
| PSSR | Walkdown 14 Oct: hose type verified, bonding resistance recorded, interlock trip tested twice, exhaust routed outside, TOI posted at pump. Passed |
| Close-out | 6 Nov: P-12 reinstalled (replacement in kind), rental pump removed, TOI withdrawn, P&ID markup removed, risk assessment entry closed. MOC closed by owner 7 Nov |
Notice what the form forces. Without it, the interlock gap (hazard 2) is the kind of issue nobody notices until the mixing vessel overflows. The end date and close-out row make sure the "temporary" pump does not become permanent by default.
Common MOC Mistakes
1. Treating every swap as a replacement in kind
What happens: "Same job, different brand" goes in without review. Why it is dangerous: materials, ratings and control connections differ, and the safeguard that relied on the old design silently disappears.
2. One-size-fits-all paperwork
What happens: a 12-page form for every label change. Why it is dangerous: people start working around the system, and the major changes get lost among hundreds of trivial ones.
3. Open-ended temporary changes
What happens: "Temporary" has no end date, or the date passes without action. Why it is dangerous: the plant runs indefinitely on equipment that was only reviewed for a short period.
4. Ignoring organizational change
What happens: headcount cuts or a new shift pattern go through HR and finance only. Why it is dangerous: safety-critical tasks such as gas testing, alarm response or permit issuing end up with nobody.
5. Approving before the hazard review
What happens: the manager signs because the change is urgent, and the review is "to follow." Why it is dangerous: the approval is meaningless, and the actions never get done.
6. Closing without updating documents
What happens: the equipment is in, the MOC is closed, the drawings and procedures still show the old state. Why it is dangerous: the next risk assessment, HAZOP or incident investigation starts from a false picture of the plant.
7. No way to detect unauthorized changes
What happens: the MOC procedure only works for people who use it. Why it is dangerous: Appendix C notes that employers need ways to detect both technical and mechanical changes. Regular inspections and walkdowns that compare the field to the drawings are how you find the change nobody reported. When you do, treat it like a near miss and investigate it with root cause analysis.
How FindRisk Supports MOC Reviews
FindRisk is built for the inspection and risk assessment work that sits inside an MOC. You can generate an AI checklist tailored to the change, for example "temporary pump in a flammable area", and use it as the minor-tier review or as the PSSR walkdown list.
During the hazard review and the PSSR, you can photograph the installation, mark hazards directly on the photo and let the AI analysis suggest what else to look at. Each hazard can be scored with the Fine-Kinney method so that the residual risk after the change is recorded in the same way as the rest of your risk assessment.
When the review is done, FindRisk produces a professional report in seconds, which you can attach to the MOC record as evidence of the hazard review and PSSR. It runs on iOS and Android, so the walkdown happens at the equipment, not at a desk.
Frequently Asked Questions
What is the difference between management of change and change management?
Management of change (MOC) is a safety process that reviews the hazards of technical, procedural and organizational changes before they are implemented. Change management usually refers to the HR and leadership discipline of helping people adopt organizational change. They overlap when an organizational change affects safety-critical tasks, which is why a restructuring should go through MOC as well as HR planning.
What is a replacement in kind?
A replacement in kind is a replacement that satisfies the design specification, according to OSHA 29 CFR 1910.119(b). An identical part from the approved spares list qualifies. A part with a different material, rating, size or control interface does not, even if it performs the same function, and it needs an MOC review.
Who should approve an MOC?
Approval should come from people with authority over the affected area and the expertise to judge the hazards. For minor changes this can be a supervisor and one technical reviewer. OSHA's Appendix C suggests that complex or significant changes may need approval by operations, maintenance and safety departments. Major changes usually add the site manager.
How long can a temporary change stay in place?
There is no universal limit. OSHA's Appendix C says a time limit for temporary changes should be established and monitored, and that equipment and procedures must be returned to their original condition at the end. Set a specific end date on the MOC form, and require a fresh approval to extend it.
Does ISO 45001 require a management of change procedure?
ISO 45001:2018 Clause 8.1.3 requires a process for implementing and controlling planned temporary and permanent changes that affect OH&S performance, and a review of the consequences of unintended changes. It does not require a specific form or call it MOC, but a documented MOC procedure is the most common way to show auditors that the clause is met.
Is a pre-startup safety review needed for every change?
Under OSHA PSM, a pre-startup safety review is required for new facilities and for modified facilities when the modification is significant enough to require a change in process safety information. Many organizations still run a short, checklist-based PSSR for every MOC, because it is a cheap final check that the change matches what was approved.
Do personnel and organizational changes need MOC?
Yes, when they affect how hazards are controlled. The UK HSE lists reduced staffing, outsourcing, merged departments and changed roles as organizational changes that can have significant safety effects. ISO 45001 Clause 8.1.3 also covers changes to work organization. The review should confirm who performs each safety-critical task after the change.
Conclusion
Management of change is how you stop small, sensible decisions from adding up to an accident. A good procedure asks the same questions for every change: is this really a replacement in kind, what does it do to the hazards and safeguards, who must approve it, who must be trained, and when does a temporary change end?
Start with the decision table so supervisors know when to open an MOC, scale the review to the hazard with three tiers, and make temporary and organizational changes explicit. Then use the filled form above as your template and the seven steps as your audit trail.
If you want the hazard review and pre-startup walkdown to take minutes instead of hours, download FindRisk to build change-specific checklists, mark hazards on photos and produce the MOC evidence report on site.
Try FindRisk
Ready to modernize your safety workflow?
Conduct AI-powered risk assessments, generate reports instantly, and keep your team safe — anywhere, anytime.