Management of Change is one of the most important controls for preventing process safety risk from increasing unnoticed. Modifications can change process conditions, equipment capability, control logic, operating procedures or the performance of existing barriers. Not every change needs a full HAZOP or LOPA, but every change should be screened consistently so the level of review matches the risk.
Start with the nature of the change
The first question is what is actually changing. Physical modifications, control-system changes, operating envelope changes, chemical changes, bypasses, temporary repairs and procedural changes can all affect process safety. A replacement in kind may need only confirmation that design, material, function and performance are truly equivalent. If any of those attributes change, the modification deserves further screening.
When HAZOP is appropriate
A HAZOP review is particularly useful when the modification changes process flow paths, control philosophy, operating conditions, equipment configuration or interactions between systems. The review may be a focused HAZOP of the affected nodes rather than a repeat of the entire facility study. The key is to define boundaries that capture upstream and downstream effects, including start-up, shutdown and abnormal operation.
When LOPA should be revisited
A LOPA should be reviewed when the change affects an initiating event frequency, consequence, independent protection layer, conditional modifier or target risk criterion. Changing a trip set point, valve closure time, proof-test interval or operator response can alter the calculated risk. Removing or degrading a credited layer may require replacement risk reduction before the change can be accepted.
Bowtie and barrier impacts
Changes should also be checked against bowties and critical control registers. A modification may create a new threat or weaken a barrier without changing the basic process flow. For example, changing metallurgy, inspection strategy or maintenance interval can affect containment integrity. A control-system migration can affect several shutdown barriers simultaneously. These impacts should be visible in the MOC record.
Temporary changes
Temporary modifications deserve the same discipline as permanent ones. Hose connections, inhibited trips, temporary power supplies and operating workarounds can create risk that is difficult to see in normal drawings. The MOC should define duration, compensating measures, monitoring and removal requirements. Extensions should not become routine without reassessing whether the temporary arrangement remains acceptable.
Practical screening questions
Ask whether the change alters pressure, temperature, flow, composition, inventory, isolation, relief loads, shutdown response, alarm philosophy, operator workload or hazardous area classification. Check whether any safeguard previously credited in HAZOP, LOPA or bowtie is affected. Consider abnormal operation, commissioning and maintenance states as well as normal production. Where uncertainty remains, use a focused review rather than assuming the original risk basis still applies.
Traceability through the lifecycle
Good MOC keeps the installed plant, drawings, procedures and process safety studies aligned. If the change affects a scenario that feeds LOPA or SIL classification, those records need to be updated. If it changes a critical barrier, performance standards and maintenance tasks may need revision. The goal is a controlled transition from old design to new design with no hidden loss of protection.
Close-out and documentation
Risk review actions should be closed before start-up unless there is a formally approved basis for deferral. Drawings, procedures, training material, inspection plans and barrier registers should be updated. If the change affects a safety instrumented function or relief system, the relevant design and verification records also need revision. Good close-out prevents the facility from operating with a risk model that no longer matches reality.
A proportionate review process
The best MOC systems do not require the same workshop for every change. They use screening questions to identify process safety significance and select the right method: checklist, What-If, focused HAZID, HAZOP, LOPA, bowtie review or specialist calculation. Proportionate review saves effort while still protecting against the changes that can materially increase major accident risk.
How Pro Engineers can assist
Pro Engineers supports brownfield modifications and project changes with practical process safety review, including HAZID, HAZOP and LOPA. The focus is on clear scenarios, defensible safeguards and actions that can be carried through design and operations.
Examples of changes that deserve closer review
Changes that appear minor can have significant process safety effects. Increasing a compressor discharge pressure can change relief loads and equipment exposure. Replacing a shutdown valve actuator can alter closure time and therefore the inventory released before isolation. A new control valve trim can change maximum flow into lower-rated equipment. Extending proof-test intervals can reduce the reliability of a credited SIF. Even a revised operating procedure can affect an operator-response safeguard if the available response time or staffing arrangement changes.
These examples show why MOC screening should focus on function and risk rather than physical size or project cost. A low-cost change can still affect a major accident barrier. Conversely, a large project may require only a focused review if the process safety interfaces are well defined and existing protection remains unchanged.
What evidence supports MOC closure?
Closure evidence should match the technical concern. This may include updated P&IDs, relief calculations, shutdown timing calculations, revised cause-and-effect diagrams, SIL verification, updated proof-test procedures or confirmation that a material remains suitable for the revised operating envelope. The response should demonstrate why the risk is controlled, not simply state that the action has been accepted.
Where a change creates a new scenario, the relevant hazard study should be updated so future engineers can trace the basis. Where it affects an existing barrier, the barrier register, maintenance strategy and performance standard should be revised. This traceability is especially important in brownfield facilities where many incremental changes accumulate over time.
Connection with brownfield project risk
Management of change and brownfield process safety are closely linked. Our guide to process safety in brownfield modifications explains how tie-ins, legacy equipment, simultaneous operations and shared protection systems can create additional interfaces. MOC provides the governance framework that ensures these risks are identified and resolved before the modified plant is placed into service.