Management of change (MOC) is the process for reviewing and approving a change to equipment, materials, procedures, software or operating conditions before it's made, so any new hazard is caught and everything that depends on the old setup gets updated. In the US, OSHA requires it for processes covered by Process Safety Management (29 CFR 1910.119). Plenty of plants outside that scope run it anyway.
The formal definition makes MOC sound like an engineering project: a new line, a new chemical, a plant expansion. Those get MOCs. The changes that slip through are smaller, and most of them start on a work order. The original part is obsolete, so a technician fits the closest match. A relief valve keeps lifting, so someone raises the setpoint. A bypass goes in to keep the line running overnight and is still there six months later.
Each of those is a change. None of them looked like one at the time.
What counts as a change, and what doesn't
OSHA draws the line with one phrase: replacement in kind, which it defines as "a replacement which satisfies the design specification." If a replacement meets the design spec, it's not a change and doesn't need an MOC. If it doesn't, it is one.
The hard part is that "close enough" and "meets the spec" look identical on the shop floor. Some typical maintenance calls:
| Job | Replacement in kind? | Why |
|---|---|---|
| Worn mechanical seal replaced with the same part number | Yes | Same part, same spec |
| Seal replaced with a different elastomer because the original is out of stock | No | Material compatibility is part of the spec |
| Motor replaced with the same frame size but higher kW | No | Changes load, protection settings and possibly the driven equipment |
| Bearing replaced with an equivalent from another brand, same dimensions and rating | Usually yes | If it genuinely meets the spec, check it, don't assume |
| Relief valve setpoint raised to stop nuisance lifting | No | Changes the protection the system was designed with |
| PLC timer or interlock changed during a breakdown | No | Software and logic changes count |
| Temporary hose or bypass fitted to keep running | No | Temporary changes still need an MOC, with a time limit |
| Gasket replaced with the specified material and rating | Yes | Meets the spec |
A useful test for a technician or planner: if the drawing, the spares list or the PM checklist would need updating after this job, it's probably a change.
The MOC process, step by step
Sites word it differently, but the sequence is the same:
- Raise the request. Describe what's changing, why, and what it replaces. This is often the person who found the problem: the technician, the planner, or the shift engineer.
- Review it. Someone with the right technical knowledge looks at the basis for the change and what it could affect: pressure, temperature, materials, controls, safeguards, and the people who work around it. For bigger changes this is a formal hazard review.
- Approve it. The people named in the site's procedure sign off. On a small change that might be one engineer. On a process change it's usually engineering, operations, maintenance and safety.
- Make the change. Usually through a work order, with the approved scope attached.
- Update everything that depends on it. Drawings, operating procedures, PM tasks and checklists, the spares list, and asset records. This is the step that gets skipped most.
- Train the people affected. Operators, maintenance, and contractors who work on that equipment need to know before it starts up.
- Run a pre-startup safety review where the change is significant. Confirm it's built as approved, procedures are ready, and people are trained.
- Close it out. For a temporary change, that includes restoring the original setup by the agreed date.
Temporary and emergency changes
Temporary changes are where MOC programs leak most. A clamp on a leaking line, a jumper across a faulty switch, a hired pump while the main one is overhauled. They're made in a hurry, often at night, by people trying to get production back.
They still need an MOC. The difference is the time limit. OSHA's PSM guidance says a time limit for temporary changes should be "established and monitored," because otherwise they quietly become permanent. Many sites allow an emergency change to go ahead on a verbal or single sign-off, as long as the full MOC is completed within a set period, often the next working day.
The risk with temporary changes isn't usually the first night. It's month six, when nobody remembers the jumper is there and the next technician trusts the drawing.
What OSHA PSM requires
For processes covered by 29 CFR 1910.119, paragraph (l) requires written MOC procedures for changes to process chemicals, technology, equipment, procedures, and facilities that affect a covered process. Replacements in kind are exempt. Before any change, the procedure has to address five things:
- the technical basis for the change
- its impact on safety and health
- changes needed to operating procedures
- the time period the change is needed for
- who has to authorize it
Affected employees, including maintenance and contract employees, must be informed and trained before start-up. The process safety information and operating procedures must be updated when the change affects them.
Paragraph (i) adds the pre-startup safety review for modifications significant enough to change the process safety information. It checks that the equipment matches the design specs, that safety, operating, maintenance and emergency procedures are in place, and that training is done.
PSM only covers processes above certain quantities of highly hazardous chemicals. If yours aren't covered, MOC isn't a legal requirement, but the reasons for it still apply. Industry guidance, such as AIChE's Center for Chemical Process Safety (CCPS), treats MOC as good practice well beyond PSM.
A copyable MOC form
If your site doesn't have one, this covers what a reviewer needs and what PSM asks for. Keep it to one page. A form nobody fills in is worse than a short one people do.
| Section | What to record |
|---|---|
| Request | MOC number, requester, date, asset or system, linked work order |
| Change | What's changing, from what to what. Permanent or temporary (with an end date) |
| Reason | Why the change is needed (technical basis) |
| Review | Hazards considered: pressure, temperature, materials, controls, safeguards, ergonomics |
| Impact | Drawings, procedures, PM tasks, checklists, spares and training that need updating |
| Approval | Reviewer(s) and approver(s), names and dates |
| Before start-up | People trained · documents updated · PSSR done (if required) |
| Close-out | Change verified · temporary change removed by end date · records filed |
MOC vs change management
The terms sound alike but mean different things. Change management usually refers to the people side of organizational change: restructures, new systems, new ways of working. Management of change in a plant is a technical safety control for physical and process changes. If you're searching for one, you'll keep hitting the other, which is why it's worth being precise about which one a procedure means.
Why MOC fails in maintenance
Changes aren't recognized as changes. The technician fitting a substitute part doesn't think of it as a design change. It's a repair. Nobody raises an MOC because nobody saw one was needed.
The decision happens in the wrong place. The MOC procedure lives with engineering or the safety team. The decision about whether a job is like-for-like happens at the work order, at 2 a.m., with the line down. The two never meet.
Step 5 gets skipped. The change is approved and made, but the drawing still shows the old valve, the PM checklist still says to check the old setpoint, and the spares list still holds the old part. The next breakdown is worked from the wrong information.
Temporary changes don't expire. There's no date on them, or the date passes and nobody notices.
The same pattern shows up across plant safety. The JSA is in one binder, the permit to work in another, and the job itself on a work order. MOC is no different.
Where MOC connects to maintenance software
An MOC is an engineering and safety decision. Software doesn't make it for you. But the place where "is this like-for-like?" actually gets decided is the work order, and the things an approved change has to update (asset records, PM schedules, checklists and spares) are maintenance data.
In MachDatum, work order workflows are configurable, with role-gated transitions and mandatory fields. So a job can carry a "does this change the design or spec?" check and need an approval before it moves on or closes. Checklists are versioned, so when an approved change alters a PM task, the new version applies from then on and the old one stays on record. Asset records hold your own attributes, so the spec a part has to meet sits with the asset, not in someone's memory.
If your changes get decided on the shop floor and recorded nowhere, see how MachDatum CMMS handles work orders, assets and checklists.
