1. “Working Safe, Preventing Injuries, Increasing Profits”
Management of Change
Melissa Heike, M.S.
“Working Safe, Preventing Injuries, Increasing Profits”
RJR Safety Inc.

2. Overview What is Management of Change (MOC) Why do we need MOC
Recognizing Change
The MOC Program
Main Elements
Operation
Keys to Success
The above outline illustrates the main points of the presentation.
What is Management of Change - this section provides a definition of MOC as well as some information on its history and its place in Process Safety Management.
Why do we need MOC - this is explained primarily through example
Recognizing Change - this section explains the difference between changes that require MOC approval and those that do not. It also explains the different types of changes that can occur.
The MOC Program
Main Elements - this section explains the five main parts of a MOC program - identification system, change control mechanism, training, information management system, and auditing.
Operation - this section provides information of the MOC form and Risk Ranking methods.
Keys to Success - this section lists some suggestions from industry as to how to ensure the success of a MOC program.

3. Management of Change
Policies and procedures which ensure that changes do not result in operations outside of established safety parameters
Essential element in an organization’s process safety system
Managing change can mean managing potential incidents
Change is a given in any industrial operation today. Some possible reasons for change would be:
New laws and regulations
Keeping up to date with current technology
Producing more efficiently to remain competitive
Whenever a change is made, large or small, permanent or temporary, managers and staff should assess the possible impact of the change.
Management of Change is a systematic method used to do just that.
It is defined as policies and procedures which ensure that changes do not result in operations outside of established safety parameters. This is an essential component of a plant’s process safety system.
MOC is used to answer the following four questions:
What could go wrong?
How could it affect me or others?
How likely is it to happen?
What can I do about it?
Since changes are a common cause of accidents, by managing change, we are managing potential incidents.

4. Focus of MOC
To prevent catastrophic accidents and to properly evaluate the concerns of safety and health and to accomplish this review in a timely manner.
The focus of MOC is to prevent catastrophic accidents and to properly evaluate the concerns of safety and health and to accomplish this review in a timely manner.
The “time” component of this statement is very important. If MOC cannot be completed in a timely manner than the system would be very ineffective. It is important that the program help the plant to continuously improve in a safe manner - not to impede this improvement from occurring.

5. History of MOC
Early 60s - Formal procedures first introduced in the nuclear power and defense industries.
First mention of use within chemical industry at Loss Prevention Symposium
CCPA pamphlet, “Essential Components of Safety Assessment Systems
API recommended practice “Management of Process Hazards”
OSHA , “Process Safety Management of Highly Hazardous Chemicals”
Management of Change is relatively new to the chemical industry. Formal MOC procedures were first introduced by the nuclear power industry in the early 1960s. These practices quickly spread to the defense industry.
It wasn’t until 1976 that MOC made its appearance in the Chemical industry. Some farsighted chemical companies shared their progressive modifications procedures at the annual Loss Prevention Symposium. The procedures utilized by BP Chemicals International and Imperial Chemicals Industries Ltd. were presented and many of the practices they used are still valuable today.
In 1985, the Canadian Chemical Producers Association (CCPA) acknowledged the importance of MOC in safety management systems. They released a pamphlet entitled Essential Components of Safety Assessment Systems. It included nine programs - one of which was a management program to formally examine and approve any significant changes in chemical components, process facilities, or process conditions whether temporary or permanent, prior to implementation.
Around the same time in the United States, focus on chemical process safety was increasing. In 1988, the Organization Resources Counselors, Inc (ORC) prepared a report entitled “Recommendations for Process Hazards Management of Substances with Catastrophic Potential”. This report emphasized the application of management control systems to facilities processing highly hazardous chemicals. Many future publications were based on this report, such as the API Recommended Practice 750, Management of Process Hazards, in This standard included the requirement that MOC must include a detailed safety review.
IN 1992, the ORC report helped form a new law within the United States OSHA , “Process Safety Management of Highly Hazardous Chemicals”. The law clearly outlines the ground rules for the chemical process industries to establish a method for managing change.

6. MOC and PSM
Process Safety Management is a method of identifying, understanding, and controlling process hazards and preventing process-related injuries and accidents
MOC is one of the PSM elements
MOC is different from the other elements
MOC is never complete - must be performed on a continual basis throughout the life of the process.
Process Safety Management (PSM) is the application of management principles and systems to the identification, understanding and control of process hazards to prevent process-related injuries and accidents. It was developed by the Center for Chemical Process Safety (CCPS) in the United States but has since been adopted in Canada.
PSM consists of 14 elements designed to prevent accidents in the chemical process industries. Management of Change is one of the 14 elements. It states that a system to manage change is critical to the operation of any facility and a written procedure should be required for all changes except replacement in kind.
Management of Change is a continuous process as changes are forever occurring within a company. Many of the other PSM elements have a clear start and finish. However, compliance with MOC requires that it be performed throughout the life of the plant.

7. Why do we need MOC?
80% of all large scale accidents in the process industries trace their origins back to “Change”.
Change is essential to a company’s survival
they have to be able to continuously improve their process and keep up with industry standards.
VS.
So why is MOC considered a critical operation of any facility?
It has been determined that 80% of all large scale accidents in the process industries trace their origins back to “Change”.
Unfortunately, you can’t just get rid of the cause because “Change” is also critical to a company’s survival. Companies have to be able to change in order to continuously improve their process and to stay competitive in their industry.
By successfully managing change you can reduce the number of incidents while still allowing, even encouraging, change to occur.

8. Case Study: Flixborough, 1974
Vapor cloud explosion - fueled by release of 30 tons of cyclohexane
Largest single loss by fire or explosion in the United Kingdom
killed 28 people
injured 89 others
$63 million in property damage
The following case study illustrates the catastrophic effects of implementing a change without the proper MOC procedure. Flixborough was actually one of the events that led to the development of management of change.
On June 1st 1974, the Nypro cyclohexane oxidation plant at Flixborough, England was destroyed by an explosion. The plant produced caprolactam, a raw material for the production of Nylon. The process consisted of oxidizing cyclohexane (which has similar properties to gasoline) with air in a series of reactors.
There was a release of 30 tons of cyclohexane to the atmosphere which formed a vapor cloud. The cloud was ignited by an unknown source about 45 seconds after the release. The resulting explosion destroyed the entire plant. 28 people were killed and 89 others were injured (36 employees and 53 civilians). The number of fatalities would have been much greater had the accident occurred on a weekday when the administrative offices were filled with employees.
The damage extended beyond the plant to 1821 nearby houses and 167 shops and factories. Total property damage reached $63million.
The fire in the plant burnt for over 10 days.
Flixborough is recorded in history as the largest single loss by fire or explosion to date.

9. The above photograph, illustrates the devastation caused by the Flixborough explosion.

10. The Flixborough explosion…
was the result of an unwise plant maintenance modification.
In Hindsight ...
A proper MOC procedure could have prevented this accident.
One of Main recommendations from inquiry
Any modification should be designed, constructed, tested, and maintained to the same standards as the original plant.
There was no safety review of the modification and the workers were not supervised and required no approval to implement the modification.
Some other reasons taken from the “Court Inquiry into the disaster”:
They did not realize that the piping assembly would be subject to a turning movement which would impose shear forces on the bellows.
They did not realize that the hydraulic thrust on the bellows would tend to make the pipe buckle at the mitre joints.
No calculations were done to ascertain if the assembly could withstand the forces
The Flixborough explosion illustrates the need for a system for the control of modifications.
Had a MOC system been in effect at the plant, the explosion could have been prevented. The MOC system would have called for
a proper safety review;
adequate approval at all stages of the change process, and;
a design created by trained professionals.
The resulting inquiry came to the same conclusions and one of its main recommendations was that:
“Any modification should be designed, constructed, tested, and maintained to the same standards as the original plant.”

11. Does the Oil & Gas Industry ever need to Manage Change?
The above photograph, illustrates the devastation caused by the Texas City explosion

12. BP Refinery in Texas City, 2005
A massive explosion kills 15 and injures 180 at the BP Texas City refinery. The explosion occurred in an isomerization unit at the site, resulting in the deaths and injuries. According to a report issued after the accident, actions taken or not taken led to overfilling the raffinate splitter with liquid, overheating of the liquid, and the subsequent overpressurization and pressure relief. Hydrocarbon flow to the blowdown drum and stack overwhelmed it, resulting in liquids carrying over out of the top of the stack, flowing down the stack, accumulating on the ground, and causing a vapor cloud, which was ignited by a contractor's pickup truck as the engine was left running. The report identified numerous failings in equipment, risk management, staff management, working culture at the site, maintenance and inspection, and general health and safety assessments.

13. BP Refinery in Texas City- Findings
There were a number of misapplications of the refinery MOC policy for changes pertaining to the blowdown drum, the splitter tower, and occupied trailers.
Chemical Safety Board - BP Texas City Final Investigation Report 3/20/2007 pg. 138

14. BP Refinery in Texas City- Findings
Organizational changes that could adversely impact process safety, such as changes in the management structure, budget cuts, etc., generally were not evaluated.
Chemical Safety Board - BP Texas City Final Investigation Report 3/20/2007 pg. 139

15. Macondo Blowout and Explosion, 2010
On April 20, 2010, a sudden explosion and fire occurred on the oil rig. The accident resulted in the deaths of 11 workers and caused a massive oil spill into the Gulf of Mexico.

16. Lessons not learned….
“Despite some significant progress with process safety indicator implementation in the downstream oil industry…
in the offshore sector -BP, Transocean, industry associations, and the regulator had not effectively learned critical lessons of Texas City and other serious process incidents at the time of the Macondo blowout.”
Chemical Safety Board findings 7/24/12

17. Lessons not learned…
“Systems for managing the safety of process changes were inadequate.  The plan to complete and “temporarily abandon” the Macondo drilling operation was changed five times during the week before the disaster, but there is no available documentation that management of change procedures or formal hazard assessments were conducted.”
Chemical Safety Board findings 7/24/12

18. What is Change?
Most difficult part of Management of Change is recognizing change.
Need to be able to distinguish between a change that requires approval using the MOC procedure and one that does not.
The most difficult part of management of change is recognizing that a change is taking place.
It is essential that employees can distinguish between when the MOC procedure is required and when it is not. (For example, the replacement of a valve with an identical valve would not require approval through the MOC system, while the addition of a new chemical would.)
It is also important to be able to recognize the difference between safety critical and non-safety critical changes…

19. 5-10 potentially high risk
Recognizing Change
5-10 potentially high risk
MOC
As shown in this diagram, for every 1000 work orders there would be about changes that require the employees follow the MOC procedure. Of these changes, about 5-10 of them would be considered potentially high risk changes.
So, how do you determine which work orders fall into what category? The first place to start would be with a firm understanding of the definitions.
1000 Work Orders

20. Replacements-in-kind
Defined - a replacement that satisfies the design specifications.
Examples
raising reactor temperature within safe operating envelope
replacing equipment or piping meeting the same specifications as the original
Replacement-in-kind (RIK) changes are not subject to MOC procedures (i.e. they don’t require formal authorization.)
They are equipment and procedural alterations that do not vary from the documented design specifications. It’s the replacement of a component with an identical part or an equivalent part approved and specified by the applicable engineering standard.
While they do not require MOC documentation, RIKs will require written documentation in accordance with the maintenance procedural guidelines (i.e. work orders).
Some examples of replacements-in-kind are:
Raising the reactor temperature within the “safe operating envelope”
Repairing equipment or piping
Replacing equipment or piping meeting the same specification as the original
Area paving
Painting

21. Change
Change is an alteration or adjustment to any component, variable or property within an existing system (except those within clearly defined boundaries or responsibilities).
Examples
changes that alter production rates
changes involving safety relief or vent systems
deteriorating materials
According to the OSHA standard, changes that require management are defined as “any change (except replacement-in-kind) to process chemicals, technology, equipment, and procedures; and, changes to facilities that affect a covered process.”
A simple definition used in plant awareness training is - “If new equipment is not previously documented or procedures are not already written, then it is a management of change issue.”
A third definition is “change is an alteration or adjustment to any component, variable or property within an existing system (except those within clearly defined boundaries or responsibilities).
Some examples of change are:
facility changes made to significantly increase storage capacity of a hazardous chemical
changes that alter the production rates
New tools and equipment
Changing the method or control scheme of an instrument loop
Alterations to protective equipment systems - ie. changes involving safety relief or vent systems
deteriorating equipment

22. Main Types of Changes Change of Process Technology Change of Facility
Organizational Change
Variance Procedures
Four broad categories of change are:
Change of Process Technology - When the plant was initially designed, safeguards were built in to keep the process from exceeding safe operating limits. If parts of the process are subsequently altered, a new review should be conducted to ensure it does not compromise the process safety.
Change of Facility - The introduction of new equipment could also introduce additional hazards or increase the risk.
Organizational Changes - Occur through the transfer of employees to new assignments or through the addition/reduction of staff. It is very important that this be recognized as a change and the employees acquire the safety-related knowledge required to carry out their new responsibilities.
Variance Procedures - Occurs when an operations supervisor or maintenance manager wishes to deviate from standard procedures. A review of the deviation should be conducted and appropriate approval received before the variance should take place. Do the change(s) effect?
– Standing operating procedures (SOPs)
– Mechanical integrity inspection intervals
– Mechanical integrity procedures
– Pre-startup safety review/checklists

23. Permanent vs. Temporary
MOC should be conducted on both permanent and temporary changes.
When discussion MOC, the changes are generally assumed to be permanent. MOC ensures that permanent changes are conducted without compromising the safety of the plant. But MOC is also used to control temporary changes.
Temporary changes have caused a number of serious accidents in the past. They are included in MOC to ensure that all of the safety considerations are addressed. They may not have same requirements as permanent change (ie. P&IDs won’t be changed), but when the change is being considered, the procedure used for a permanent change should be reviewed. Temporary changes must have a specified time limit - if it is later desired to extend this time, a new review should be conducted. MOC will keep track of the temporary changes and ensure that they are returned to their original conditions.
Some examples of temporary changes are:
substitution of parts pending delivery
system testing
operate unit above specified design conditions to meet production quota
replacement workers

24. Key Elements of a Program
Identification System
Change Control Mechanism
Training
Information Management System
Auditing
The requirements for each element should be detailed in a company’s MOC policy.
The key elements for a successful Management of Change System are:
An identification system - used to recognize when changes occur
Change Control Mechanism - provides clear instructions on how to manage the change.
Training - Employees must be trained in MOC procedure
Information Management System - used to keep track of all changes.
Auditing - to ensure the MOC system is effective
A company should have a MOC policy and procedure which will detail the specific requirements for each of these elements within the company. .

25. Identification System
Screening process for identifying changes.
Includes risk ranking process based on effect item could have on safety of process
Requires clear, written, definition of system boundaries and what constitutes “change”
As we’ve already seen, the most difficult part of a MOC system is identifying change. It is therefore extremely important to have an effective identification system.
Most identification systems use a systematic approach. A detailed list of all hardware which is to be controlled is provided. The employee can use the list as a check-list to determine if the modification falls under any of the categories.
There will also be a risk ranking system to determine the level of control the change requires. (ie. 5 approval signatures and a thorough hazard analysis vs. 1 approval signature and no formal risk assessment)
As each company is unique, they may have different guidelines for determining changes. It is thus extremely important to have clear, written, definitions of system boundaries and what constitutes “change”. These are generally found in the beginning of the Management of Change Policy.

26. Change Control Mechanism
Explains how to manage the change.
Must clearly identify:
the work flow procedures (MOC form)
responsibility and authority
approval level
The Change Control Mechanism is the method used to control or manage a change. It is formalized in the MOC policy and procedure to ensure that the same methodology is used for every change.
The change control mechanism includes a description of the work flow procedure. This shows all the steps that must be taken to control the change. Most companies have adopted a MOC form to help guide the employee through the procedure. The work flow procedure and MOC form will be discussed further in a later section.
The Change control mechanism must also include a detailed list of who is responsible for what. This is imperative as many tasks could involve multiple staff, and all participants must understand their role for the change to be managed effectively.
Finally the level of approval must be identified. In most companies this is directly linked to the risk ranking process in the identification system. As a change increases in risk, the level of required approval increases. Who’s approval/signature is required for each risk level must be clearly documented.

27. Training
Anyone who could affect a change must be properly trained in the Management of Change system
Commitment from all levels of management and staff
Training is imperative to the success of a MOC program as it will only function on the level that employees are trained to properly use it.
Process safety could be jeopardized during a modification by the unintentional actions of one untrained individual. Employees should possess the proper respect for management of change and they can only acquire this through training.
Anyone associated with a covered production process who could affect a change must be aware of and conform to the policies and procedures of change control.
It is equally important for both management and regular staff to receive program awareness training as they all play an active role in the MOC process.

28. Information Management System
“Status Accounting”
Software/documentation that tracks all changes and their progress
Allows access to most current information
ie. If two changes are inter-related they will be aware of one another
The information management system is used to account for the status of all changes currently under review. The system should ensure that:
The most up to date information is available when considering a change, and;
All changes are incorporated in the same database which is accessible to everyone.
This prevents two inter-related changes from occurring concurrently without being aware of one another.
The system must include a list of all documentation that must be reviewed and revised when a change occurs. For example, operating procedures, P&IDs, maintenance and testing procedures, and unit alarm listings.

29. Auditing Ensures system is working as it should
MOC system should be constantly evolving and improving in efficiency and effectiveness
Verifies changes are assessed accurately
More often while the system is new to ensure all the “bugs” are found
Audits are used to ensure that the MOC system is working as effectively as possible. No matter how good a system is, there is always room for improvement, and audits are a way of continuously improving the management of change program.
The audits determine whether all changes are assessed for their impact on safety and whether the documentation of the change is accurate and complete.
Annual audits of the MOC system tend to be the norm in industry. However, if a MOC system is new then more frequent audits should be performed during the initial stages to ensure all the “bugs” are found.

30. Operating the MOC system
A MOC system is very dependent on the specific company
no two systems will be the same
ie. one company could require 1 signature for approval while another could require 5.
They are all based on the same fundamental principles
MOC systems are different at every corporation and even slightly different at each location. They must be developed to fit the specific hazards, the available resources, the culture of the organization, and any required regulations. The result is broad differences in review and authorization philosophy.
For example, some organizations would require only 1 signature for authorization of a specific change while others could require 5 for the same type of change.
Despite the differences, the programs are all built on the same fundamental principles and with the same goal of preventing incidents.

31. MOC Form
A MOC form is used by many companies to guide employees through the procedure
The MOC form should include:
Description, purpose, and technical basis for the change
Assigned level of risk
Safety, Environmental, and Health impacts
Necessary time period for the change
Authorization for the proposed change
Most MOC procedures utilize a MOC form to document the review and authorization of all changes. The form will be coupled with support documentation such as drawings and equipment specifications as needed for the safety review. The package will at all times remain intact and be routed to all reviewers and endorsers.
The form ensures that no steps or signatures are skipped in the MOC process.
MOC forms will generally include the following sections:
Description, purpose, and technical basis for the change
Assigned level of risk
Safety, Environmental, and Health impacts
Necessary time period for the change
Authorization for the proposed change

32. Ranking changes Must delineate changes
small
medium
large
Don’t manage all changes with same rigor
Hazard analysis method and level of approval dependent on type of change.
Most MOC procedures will include a method of ranking the changes based on the potential risk. It’s important to distinguish between low, medium, and high risk changes to avoid unnecessary work. If all changes were managed with the same rigor than the system would be too tedious and people would start to look for shortcuts.
The level of risk involved with a change will have a direct impact on what sort of hazard analysis methods are used and what level of authority is required for the change to proceed. This allows low risk changes to be implemented quickly and ensures the proper assessment is made prior to making high risk changes.
There are many different methods of ranking changes. The following slides illustrate one of these methods. It includes first determining the hazard level and the potential severity. This is followed by a risk ranking matrix to determine the risk level of the change.

33. Determine Hazard Level
Examples of yes/no questions to determine the hazard level:
Does the change introduce a significant source of energy (chemical, mechanical, thermal, electrical)?
Does the change result in any increase of toxic, flammable, or reactive material?
Does the change significantly increase the potential for personnel exposure to a hazardous material?
The degree of potential hazard can be classified as either high or low.
Checklists composed of yes/no questions can be used to determine the hazard level.

34. Determine Potential Severity
Examples of yes/no questions used to determine potential severity level:
Could the change take the process outside the safe operating envelope?
Does the change significantly alter the heat and material balance?
Does the change introduce new molecules?
The potential severity or significance of the change is also classified as either high or low.
Checklists are generally used to determine the level of severity.

35. Risk Matrix Severity of Change Low High
Degree of Low Risk Level 1 Risk Level 2
Hazard High Risk Level 3 Risk Level 4
Risk Level Type of Safety Review Authorization
1 Simple Checklist Shift Supervisor
2 What-if Checklist Unit Supervisor
3 FMEA or HAZOP analysis Area Supervisor
4 HAZOP with consequence analysis Plant manager
The risk matrix shows how the hazard level and the severity level can be used to determine the overall Risk Level.
The risk level is then used to determine the type of safety review and authorization that is required for the change approval process.

36. A successful MOC program is dependent on ...
Management Support
Implementation not just documentation
Understanding and utilization of developed procedures
Training
Essential to keep stakeholders informed throughout the MOC process.
Management support is critical to the success of a MOC system.
One of the major obstacles to overcome in a MOC program is employees not using it properly.
One of the reasons for this could be the employees don’t understand the importance of the MOC system. If management actively supports the system it will build credibility and instill a sense of priority.
Definition - “A stakeholder is a party who might be adversely affected by a change and/or who might be required to take compensating action to prevent against loss. Includes internal and external stakeholders.”
A stakeholder is essentially anyone with a vested interest in the change. Stakeholder communication has taken a prominent role in safety and loss management programs.
The principles of stakeholder involvement come down to “Don’t keep secrets”. It is much better keep everyone informed right from the start so that they don’t put up “road blocks” for you down the road. Bypassing people in the beginning could upset them once they find out and they could make your life much more difficult.

37. Simplicity
A modest MOC system that is regularly used and works is much better than an elaborate, sophisticated system with an impeccable paper trail that is occasionally winked at, bypassed, or sometimes totally ignored.
Basically, you don’t want the system to be so cumbersome that employees look for ways to get around it. It should be easy to use and the paperwork should not take too much time.

38. Conclusions
Unmanaged process and organizational modifications have been a major cause of accidents.
A formal method to deal with change will help prevent future accidents from occurring.
Change is unavoidable in our industry
all organizations should have a MOC program. !
Changes are the leading cause of accidents and thus a system to manage them will prevent future accidents.
Change is unavoidable in industry, thus all organizations should take preventative measures to protect themselves from the potential impact change can have.

39. Questions or Comments? Thank you
Melissa Heike, M.S.
“Working Safe, Preventing Injuries, Increasing Profits”
RJR Safety Inc