Safety Alert – Management of Change (MOC) Failures

What is an MOC?

Change in an industry is inevitable. As soon as a processing facility is commissioned, engineers begin to think of improvising and optimizing. New and improved products flood the market. Equipment bypasses or temporary repairs may be needed. This is a common scenario in any processing facility.

The MOC is a review and assessment process applied in process industries where any changes to plant, process, programmable electronics and personnel are subjected to hazard reviews and controls prior to resuming operation. MOC is one of the crucial elements of Process Safety Management.

Why is MOC important?

The following major accidents have made the process industries realize the importance of managing change and the potential consequences for lack of MOC’s:

Flixborough (1974) – An explosion involving 30 tonnes of cyclohexane occurred at the caprolactam manufacturing plant. It had cost the lives of 28 workers, injured 89 others as well as extensive offsite damages. The explosion event was initiated from a temporary change. The plant personnel have decided to temporarily bypass a reactor which was leaking (read more here). Temporary piping was installed to bypass the faulty reactor and continue the process. However, the changes were done hastily with the following shortfalls, which led to loss of integrity of the piping and subsequently release of cyclohexane and the explosion:

No hazard/design review was undertaken
Personnel designed and executed the change were not professionally capable
Poor documentation, design work and understanding of the changes and the hazards associated with it

Bhopal (1984) – The incident involved release of Methyl Isocyanate resulting in deaths of thousands of people in the surrounding of the plant. The disaster was initiated by a runaway reaction involving water leaking though a jumper line into Methyl Isocyanate storage (read more here). Among other factors that led to the disaster, a poor management of change of installing the jumper line (having done no hazard assessments of the change) is one of the contributing factors.

A Management of Change is crucial in any facility to ensure that:

The change does not introduce new hazards to the facility or aggravate existing hazards, and potential hazards are adequately managed;
The change does not disable / jeopardize any safety barriers in place; and
Changes (even temporary ones) are adequately designed, assessed, approved by competent people and properly documented.

What are the common contents in an MOC procedure?

While the MOC procedures vary among organizations, the following are minimum requirements in an MOC procedure (list is not exhaustive):

Accurate definition of “change” within company purview;
Adequate provision and requirement for review and hazard assessment of the proposed change;
Provision indicating that assessments and reviews should be conducted by competent people;
Provision for detailed hazard assessment and studies (i.e HAZOP, LOPA) if necessary;
Provision to record and document all assessments and reviews, as well as the decision made on the proposed change and relevant justifications;
Requirement to meet regulatory standards;
Provision to identify and update cascading changes to drawings, procedures, work instructions, Process Safety Information and HSE Case documents (CIMAH, EIA etc);
Requirement for training and instructions should the proposed change is implemented;
Review and acceptance of the change post implementation;
Assurance of implementation of identified risk control measures;
Provision for monitoring and controlling temporary changes;
Provision for audit and review of the MOC system; and
Requirement for document control management of the MOC system.

Common Failures of MOC’s

While most facilities would have well-documented MOC procedures in place, implementing them may be a challenge. The following are some common challenges industries face in implementing MOC’s

Perception: Temporary or insignificant changes do not need an MOC. This would probably the most common argument for resisting / bypassing an MOC procedure. It is often perceived that conducting MOC for a small / temporary change would be a waste of time and resources. It should be understood any change is a potential hazard and the MOC helps the facility owners to satisfy themselves that the hazards, if any are clearly understood and are managed properly. Any non like-for-like replacement should be treated as a change and an MOC should be applied. If the change is insignificant, then it should be documented as such. Temporary changes should not be neglected as they are equally hazardous as permanent changes. In many facilities, unchecked temporary changes have ended up as permanent solutions (as organizations / people forget why the change was made in the first place). Note that the Flixborough disaster was initiated from a temporary piping fixture; the incident occurred about 2 months after the change was done.
Without complete documentation / document control MOC is not possible. It is true that incomplete / unmanaged documentation (process details, drawings, technical data) associated with the facility will affect the execution of the MOC. Organizations do not have memories, they rely on experienced personnel and documented data. If up-to date data is not available, then there is a possibility of misguided decisions to be made in the MOC execution, which could also be hazardous. Organizations should keep up-to date Process Safety Information details (PSI is an element of Process Safety management), so an accurate reference is available when needed. However, lack of such information should not avert execution of MOC procedures. Teams should find other means of identifying technical data (Team discussions, HAZIDs, HAZOPs, Vendors, Site visits) and obtain as much information possible. The risk of implying a change without and MOC still outweighs the resource spent to find information.
Perception: MOC is a hindrance when companies are under time pressure / emergency situations. Time spent on assessing changes and potential hazards is not time wasted. It is time invested to adequately analyze and ensure the facility is not subjected to additional hazards. In fact, studies have reported that changes that underwent proper MOC procedures have recorded higher return on investments (>100%) compared to changes which did not (<40%). Under emergency scenarios (Emergency: life threatening situation, possible pollution or asset loss situation) the MOC should not be neglected either. The ERP procedures should take precedence and put the facility in safe mode. The MOC can be still executed to assist the ERPs where adequate thought process is done to ensure the changes do not aggravate the hazards.
Overcomplication of MOC procedures. MOC implementation requires substantial amount of paperwork and documentation. It is the intent of an MOC to document as much relevant information as possible. However, when too much emphasis is given to administrative features, overcomplication can happen. Some common overcomplication of MOC procedures include too many signatories / review cycles, extensive screening forms and automation beyond necessity. Such overcomplication could result in discouraging change initiatives among plant personnel. Personnel might not be proactive in suggesting / initiating beneficial changes in fear of extensive paperwork and authorization cycles. An MOC procedure should be aptly designed, not too complex that it becomes a paperwork burden, nor too simple that it misses its objective. It should be user friendly; with only relevant review and authorization signatories and avoid extensive forms to fill. Automation is preferred if it simplifies the documentation work.
Perception: The change does not involve hazardous processes or materials, hence an MOC can be forgone. This is quite common especially when the change involves changes by departments not directly related to the process activities. For example, the organization’s procurement might change a vendor as a business decision. Indirectly, the change may affect the process in terms of the type / quality / property. It is worthwhile that employees in all levels of the organization, even those who are not directly involved in operations, to be exposed the intent and risk reduction benefits of the MOC procedure. Whenever such “nonhazardous” changes are done, at some point the potential impact to the processes can be identified and rectifications can be planned.
The MOC is not going to identify all the hazards associated with the change, so what is the need for it? It is true there are limitations with MOC, but so is any other safety / operational procedure. The objective of MOC’s is to identify credible (if not all) hazards associated with the change, and satisfy that the change will not subject the facility to intolerable risks. The MOC, like any other safety procedures, involves continuous learning and upgrades. By having the right personnel and asking the right questions an MOC should deliver reasonable risk reduction associated with the changes.
Perception: The intent of an MOC is to get permission and budget approval to execute the change. That perception is only partially true. The primary objective is to assess the intended change, with all the stakeholders, and ensure that the risks associated are tolerable and the benefits are worth the risks and resources put in. The intent is to have the proposed changes reviewed by relevant professionals with adequate technical competence. Gaining administrative / budgetary approval is secondary in MOC.

Guidance

Guidance is available on MOC from: