Management of Change (MOC): The Complete Guide for Oil and Gas Operations

The common thread across all frameworks is documentation, hazard assessment, and communication. OSHA specifically requires that employees involved in or affected by the change be informed before startup. In fiscal year 2023, OSHA issued over $6.5 million in PSM-related penalties, with MOC deficiencies appearing in a significant share of those citations. The EPA's updated RMP rule adds another layer: facilities that experience a qualifying release must now conduct a third-party root cause analysis, and MOC failures discovered during those investigations can trigger additional enforcement action.

The five most common MOC failure modes

Even organizations with written MOC procedures experience failures. These are the patterns that show up most frequently in incident investigations and audit findings.

1. Misclassifying changes as replacement in kind

When field personnel are unsure whether a modification qualifies as a change, they often default to RIK because it is faster. This avoidance behavior skips the hazard review entirely. The fix is a clear, examples-based decision tree that operators can reference in the field, not a 50-page procedure manual that nobody opens. Some leading operators have reduced misclassification rates by 60% simply by embedding a five-question screening checklist into their work order system.

2. Incomplete hazard reviews

A hazard review that checks a box without genuine analysis defeats the purpose of MOC. The Center for Chemical Process Safety (CCPS) recommends using structured methodologies such as what-if analysis or HAZOP for MOC reviews rather than open-ended professional judgment alone. The rigor of the review should match the risk of the change. A tiered approach, where simple changes get a structured checklist and complex changes get a multidisciplinary workshop, balances thoroughness with practicality.

3. Temporary changes that become permanent

Temporary bypasses, piping modifications, and instrument overrides are among the highest-risk changes because they often outlive their intended duration. A process safety study by the CCPS found that temporary changes that extend beyond their original timeframe are involved in a disproportionate number of process safety events. Every temporary change needs an expiry date, a defined owner responsible for reverting or formalizing it, and an automated alert system that escalates overdue items to site leadership.

4. Poor notification and training

OSHA requires that affected employees be notified of changes before startup. In practice, notification often means an email that sits unread or a toolbox talk that happens after the change is already live. Effective MOC programs embed notification into the approval workflow: the change cannot reach the "approved" state until training records confirm that impacted operators have been briefed. This is not about adding bureaucracy; it is about ensuring that the people who operate the equipment every day understand what has changed and why.

5. Documentation that lives in silos

MOC records stored in filing cabinets, personal drives, or email threads are effectively invisible to auditors, incident investigators, and new employees. When documentation is scattered, the organization cannot trace the history of a piece of equipment or verify that all changes since the last PHA were properly reviewed. The result is that every process hazard analysis (PHA) revalidation becomes an archaeological exercise, consuming weeks of engineering time that could be spent on actual safety improvement

The end-to-end MOC process: a step-by-step breakdown

While specific implementations vary, an effective MOC process follows a consistent lifecycle. Here is the sequence that aligns with OSHA PSM requirements and CCPS best practices.

Step 1: Change initiation

Anyone in the organization should be able to initiate a change request. The form captures what is changing, why, the proposed timeline, the affected equipment or area, and whether the initiator believes it is a change or RIK. Lowering the barrier to entry reduces the risk of undocumented changes happening informally. Mobile-friendly forms with auto-populated asset data make it possible for field personnel to submit a request in under five minutes.

Step 2: Classification and screening

A designated reviewer, typically a process engineer or safety professional, evaluates the request. They determine whether the change triggers a full MOC review, qualifies as RIK, or requires emergency handling. This is the critical decision point where misclassification errors occur most often. Embedding a decision-tree logic directly into the digital form, with branching questions that guide the reviewer through the classification criteria, significantly reduces subjective judgment errors.

Step 3: Hazard assessment

The heart of the MOC process. The assessment team evaluates how the proposed change affects process safety, environmental compliance, and operational integrity. Depending on the complexity and risk, methods range from a simple checklist (for low-risk changes) to a full HAZOP study (for significant modifications). Key questions include:

• Does this change introduce new hazardous materials or alter existing concentrations?

• Does it affect relief system capacity or safety instrumented function integrity?

• Does it change ignition sources, ventilation, or drainage near process equipment?

• What are the consequences if the change fails or is reversed mid-operation?

• Are there cumulative effects when combined with other recent changes?

• Does the change affect environmental permits, air emissions, or wastewater discharge limits?

• Will operating procedures, P&IDs, or training materials need to be updated?

Step 4: Approval and authorization

Multi-level approval ensures accountability. Typically, the change requires sign-off from operations, engineering, safety, and maintenance. For high-risk changes, senior leadership or a site PSM committee may also need to approve. The approval chain should be predefined by change category, not negotiated on a case-by-case basis. Digital platforms enable parallel approval where multiple reviewers can evaluate simultaneously, reducing the sequential bottleneck that plagues paper-based systems.

Step 5: Implementation planning

Before work begins, the team defines exactly how the change will be executed: work permits required, isolation plans, contractor coordination, testing protocols, commissioning steps, and rollback procedures. This step also identifies which P&IDs, SOPs, training materials, and operating manuals need to be updated. A well-defined implementation plan prevents scope creep and ensures that the actual work matches the hazard-reviewed proposal.

Step 6: Notification and training

All personnel affected by the change receive a briefing before the change goes live. This includes operators, maintenance technicians, emergency response teams, contractors working in the area, and control room staff. Training should be documented with names, dates, topics covered, and acknowledgment signatures. For complex changes, hands-on walkdowns at the equipment level are more effective than classroom briefings alone.

Step 7: Execution and verification (PSSR)

The physical change is carried out according to the implementation plan. Upon completion, a pre-startup safety review (PSSR) verifies that all items on the MOC checklist have been addressed: hazard review completed, P&IDs updated, training delivered, safety systems tested, environmental permits confirmed, and operating procedures revised. The PSSR is the final quality gate before the modified equipment or process is returned to service.

Step 8: Documentation and close-out

The completed MOC package, including all forms, hazard review records, training logs, updated drawings, and PSSR sign-offs, is archived in a central, searchable system. The change status moves to "closed," and the MOC register is updated. For temporary changes, a follow-up action is scheduled to ensure reversion or permanent formalization before the expiry date. The closed MOC record becomes part of the facility's permanent process safety information (PSI).

How MOC differs across upstream, midstream, and downstream

While the MOC principles are universal, the implementation details vary by sector. Understanding these differences helps operators tailor their programs to their specific operational context.

Upstream (exploration and production)

Upstream operations face unique MOC challenges because of remote locations, harsh environments, and the inherent variability of well conditions. Drilling programs frequently require real-time modifications to casing design, mud weight, and well control procedures based on downhole conditions. The challenge is distinguishing between routine operational adjustments (which may not require full MOC) and substantive changes that alter the well's risk profile. BSEE's Safety and Environmental Management Systems (SEMS) rule requires offshore operators to have a formal MOC process, including for temporary equipment like coiled tubing units or wireline BOPs.

Midstream (pipelines and terminals)

Pipeline operators must manage changes across hundreds or thousands of miles of linear assets. A change to a compressor station, metering system, or pipeline coating specification can affect integrity management plans, MAOP calculations, and emergency response zones. The Pipeline and Hazardous Materials Safety Administration (PHMSA) requires pipeline operators to incorporate MOC into their integrity management programs. The geographic spread of midstream assets makes centralized digital tracking especially important, as changes at a remote valve station need to be visible to engineering teams at headquarters.

Downstream (refining and petrochemicals)

Downstream facilities have the most mature MOC programs because they have been subject to OSHA PSM since 1992. However, maturity does not mean perfection. Refineries process hundreds of MOC requests per year, and the sheer volume creates pressure to streamline reviews. The biggest downstream challenge is managing the interaction between simultaneous changes: a piping modification in one unit may affect relief system capacity in an adjacent unit. Cross-functional review and a centralized change register are essential to managing these interdependencies.

Digital transformation of MOC: moving beyond paper and spreadsheets

A 2022 survey by Deloitte found that 67% of oil and gas executives identify digital transformation of safety processes as a top-three priority. Yet many MOC programs still depend on paper forms, email-based approvals, and spreadsheet tracking. The gap between aspiration and execution is significant, and it creates real risk.

The limitations of paper-based MOC

• Forms get lost, misfiled, or stuck on someone's desk for weeks while changes wait for approval

• No real-time visibility into where a change request stands in the approval pipeline

• Audit preparation requires physically assembling documents from multiple locations, consuming days of staff time

• Temporary changes lack automated expiry alerts, increasing the risk of permanent drift

• Cross-facility benchmarking is impossible without standardized digital records

• Historical trend analysis for MOC volume, cycle time, and failure modes cannot be done manually at scale

What a digital MOC platform delivers

Modern workflow platforms digitize the entire MOC lifecycle without requiring custom software development or months-long IT projects. Here is what that looks like in practice:

• Automated routing: Change requests are automatically routed to the correct reviewers based on change type, facility, risk level, and affected area. No manual forwarding, no bottlenecks, no emails lost in someone's inbox.

• Built-in classification logic: Decision trees embedded in the digital form guide initiators through the RIK-vs-change determination, with branching logic that adapts based on the type of equipment and process involved.

• Parallel approvals: Engineering, safety, operations, and maintenance can review simultaneously instead of sequentially, cutting cycle time by 40-60% while maintaining the same rigor.

• Expiry tracking: Temporary changes trigger automatic alerts at 30, 15, and 7 days before their defined end date, with escalation to management if they are not resolved.

• Audit-ready records: Every action, approval, comment, and timestamp is captured in a single digital record. Auditors can pull the complete MOC history for any piece of equipment in seconds, not days.

• Dashboards and analytics: Site leaders can track MOC volume by category, average cycle time, overdue reviews, open temporary changes, and approval bottlenecks, turning reactive compliance into proactive risk management.

• Mobile access: Field operators can initiate MOC requests from their phone or tablet at the equipment location, capturing photos, asset IDs, and GPS coordinates as part of the submission.

MOC metrics that matter: what leading operators track

Mature MOC programs go beyond counting completed forms. Here are the key performance indicators that correlate with actual risk reduction.

According to the Campbell Institute, organizations that track leading indicators like open temporary changes and MOC cycle time experience 30% fewer process safety events compared to those that rely solely on lagging metrics like total recordable incident rate (TRIR). The shift from counting past incidents to managing present-day leading indicators is what separates compliance-driven programs from genuinely proactive ones.

Real-world MOC lessons from major incidents

Every major process safety incident investigation reveals MOC deficiencies. Understanding these cases helps operators recognize the patterns before they repeat.

BP Texas City (2005)

The CSB investigation found that modifications to the blowdown drum and raffinate splitter column were not subject to adequate hazard review. Changes to startup procedures also bypassed MOC. The CSB final report specifically cited MOC failures as a contributing cause. The incident killed 15 workers, injured 180, and resulted in billions of dollars in settlements and penalties. It remains the defining case study for why MOC cannot be treated as administrative overhead.

T2 Laboratories (2007)

A reactive chemical explosion at a Jacksonville, Florida facility killed four workers and injured 32 others after the company scaled up a batch process without performing a hazard review for the change in reactor size. The CSB found that no MOC process existed at the facility. The company had increased batch sizes over time, and each incremental increase was treated as a routine production decision. This case demonstrates that MOC is not just for large refineries; any operation involving hazardous chemicals needs a formal change management process.

DuPont La Porte (2014)

A toxic release of methyl mercaptan killed four workers at the La Porte, Texas facility. The CSB investigation found that changes to the ventilation system and waste gas handling were not reviewed through the MOC process. The CSB report recommended that DuPont strengthen its MOC implementation and ensure that all process changes, including seemingly minor ones, are properly assessed. The case illustrates a common pattern: changes that appear small or routine to operators can have outsized safety consequences when they interact with other system vulnerabilities.

Chevron Richmond refinery (2012)

A pipe rupture and fire at Chevron's Richmond, California refinery sent 15,000 residents to hospitals for treatment. The CSB found that the failed pipe had been identified as corroded years earlier, and decisions about its replacement were not managed through a rigorous MOC process. The incident underscored the importance of treating material degradation and deferred maintenance decisions as changes that require formal safety assessment.

Best practices for building a robust MOC program

Based on CCPS guidance, OSHA best practices, and lessons from leading operators, here are the practices that separate effective MOC programs from checkbox exercises.

Make initiation easy and accessible

If submitting a change request takes more than 10 minutes or requires navigating a complex system, people will skip it. Use mobile-friendly forms with guided fields that auto-populate based on asset ID, location, and department. The goal is to make the right thing the easy thing.

Standardize classification with decision trees

Replace subjective judgment with structured criteria. A visual decision tree with yes/no questions ("Does the modification change the process flow?" "Is the replacement identical in specifications?") reduces misclassification and improves consistency across shifts and facilities. Publish the decision tree as a laminated pocket card and embed it in the digital form.

Scale review rigor to risk level

Not every change needs a HAZOP. Define three to four tiers of review intensity based on the risk profile of the change. Low-risk administrative changes might require a checklist. Equipment modifications in high-hazard areas require a full multidisciplinary review. Proportional rigor prevents both under-review (which creates safety gaps) and over-review (which creates bottleneck fatigue and drives workaround behavior).

Embed training into the workflow

Do not treat training as an afterthought. Build it into the approval sequence: a change cannot move to "approved" until the system confirms that all affected personnel have been briefed and have acknowledged the briefing. This eliminates the gap between approval and communication that causes so many near-misses.

Set and enforce temporary change limits

Every temporary change should have a maximum duration (e.g., 90 days) with automatic escalation if not resolved. Track open temporary changes as a leading KPI and include them in management review meetings. Some operators have implemented a rule that any temporary change open for more than 120 days requires re-approval at the site director level.

Centralize documentation in one searchable system

All MOC records, from initiation through close-out, should live in a single searchable system. When an auditor asks for the MOC history of a specific vessel, the answer should take seconds, not days. Centralization also enables trend analysis: are certain departments generating more changes? Are specific types of changes taking longer to close? Is the RIK reclassification rate trending upward at a particular facility?

Conduct periodic MOC program audits

The MOC process itself should be audited annually. Check a random sample of completed MOCs for documentation completeness, hazard review quality, and training verification. The API Recommended Practice 754 provides a framework for process safety metrics that can be applied to MOC program evaluation. Include MOC program health as a standing agenda item in quarterly PSM steering committee meetings.

Integrate MOC with related safety processes

MOC does not operate in isolation. It connects directly to process hazard analysis (PHA), pre-startup safety review (PSSR), mechanical integrity, operating procedures, and training. When a change is approved, the system should automatically trigger related actions: update the PHA register, schedule a PSSR, flag affected operating procedures for revision, and add training items to the affected workers' records. This integration ensures that MOC is not an isolated form-filling exercise but a connected part of the facility's safety management system.

How Kissflow helps oil and gas operators manage change

Kissflow is a no-code/low-code work platform that enables operations teams to digitize MOC workflows without waiting for IT backlogs or custom software builds. With Kissflow, you can design the exact MOC process your facility needs, including change initiation forms with embedded classification logic, automated multi-level routing based on change type and risk level, real-time dashboards showing MOC volume, cycle time, and overdue temporary changes, and audit-ready documentation with a complete digital trail.
The platform's drag-and-drop workflow builder means process safety teams own their MOC system. When regulations change or a new facility comes online, updates happen in hours, not months. Kissflow also integrates with existing enterprise systems so MOC data flows into your CMMS, ERP, and document management platforms without manual re-entry.
Oil and gas companies like Puma Energy have used Kissflow to standardize HSSE safety and audit workflows across 40+ countries, achieving 30-50% more efficient compliance reporting and 40-60% faster approval cycles. When changes are tracked, reviewed, and documented in a single platform, compliance is built into the workflow rather than bolted on after the fact.