Gregory Jevyak has been privy to enough turnaround meetings and control room handoffs to recognize the quiet moment that precedes many industrial accidents when someone alters a valve lineup, setpoint, bypass, or staffing plan, and nobody asks what else the alteration touches. Management of change seldom draws the attention that flashier safety programs enjoy.
Investigators return to its absence with striking regularity. Facilities that treat the procedure as clerical paperwork often learn its value the hard way, while those that practice it as a disciplined habit avoid the surprises that injure workers, destroy equipment, and invite regulatory scrutiny. Change control reaches past refineries and chemical plants.
Any operation that combines hazardous materials with high-energy equipment and complicated sequences leaves little room for improvisation. Understanding what the procedure demands, where it breaks down, and how to keep it workable under schedule pressure separates durable process safety programs from those that exist only in binders.
What Management of Change Actually Covers
The OSHA process safety management standard for highly hazardous chemicals requires employers to maintain written procedures governing changes to process chemicals, technology, equipment, procedures, and facilities that affect a covered process. Only a true replacement in kind escapes review. Before any change proceeds, the procedure must address its technical basis, its effect on safety and health, necessary modifications to operating procedures, the time period involved, and who holds authority to approve it.
Parallel obligations appear in EPA’s Risk Management Program, where 40 CFR 68.75 imposes essentially the same discipline on stationary sources handling regulated substances. Employees and contractors whose tasks the change affects must be informed and trained before startup, and any resulting shifts in process safety information or operating practices must be documented.
Many managers assume the procedure applies only to hardware, but OSHA has made clear in an interpretation addressing organizational change that staffing reductions, restructured responsibilities, and revised policies can alter process risk just as surely as a new pump. Temporary changes, which have a habit of becoming permanent, deserve the same scrutiny as permanent ones.
Why Small Modifications Cause Large Accidents
Industrial processes behave as interconnected systems, and a modification that looks trivial in isolation can undermine assumptions buried elsewhere in the design. A relocated sensor may leave a hazard unmonitored. A substituted material may alter reaction behavior. A hurried workaround may defeat a protection layer that engineers installed for a reason nobody on the current shift remembers.
Federal investigators have documented the pattern repeatedly. The U.S. Chemical Safety Board found that ExxonMobil’s Torrance refinery explosion involved a failure to conduct a management of change review or hazards analysis for non-routine work, a circumstance the Board compared to the earlier Chevron Richmond fire. Testimony on the BP Texas City disaster likewise described deficient management of change processes at a facility whose own policies called for reviews that were not performed.
“The dangerous change is almost never the big one, because big changes get meetings,” Jevyak says. “It’s the quick fix on a Tuesday night, a jumper here or a different gasket there, that nobody thought deserved a signature.”
Building a Procedure That Crews Will Actually Use
A change control program succeeds or fails on usability. Elaborate forms combined with unclear thresholds and slow approvals teach operators to find shortcuts, and every shortcut erodes the protection the procedure was designed to provide. Effective programs begin with a clear gatekeeper who decides if a proposed action is a replacement in kind or a genuine change, then assign a risk tier that determines how deep the review must go.
Hazard evaluation follows, scaled to consequence. A minor piping adjustment might need a brief checklist and a supervisor’s signature, while a modified reactor feed demands a multidisciplinary team, updated hazard analysis, and senior authorization.
“If the form takes longer than the fix, people will route around it, so the process has to scale to the risk,” Jevyak explains. “A like-for-like swap shouldn’t need the same review as rerouting a process line, and your crews know the difference even if the paperwork doesn’t.”
Completion matters as much as approval. Affected personnel need training before the change goes live, process safety information and operating procedures need revision, and a pre-startup safety review should confirm that the field condition matches the paper. Formal closeout, where someone verifies every requirement was met and removes any temporary provisions, prevents the half-finished modifications that haunt facilities for years.
Applying Change Control During Shutdown, Decommissioning, and Turnaround Work
Facilities in transition may face the greatest exposure of all. A plant moving toward shutdown, unit in turnaround, or even a site under demolition changes continuously, and each alteration shifts what the next crew believes regarding the system. Equipment gets isolated, interlocks come out of service, lines are blinded or cut, utilities are rerouted, and emergency response arrangements adjust as personnel leave.
Teams working from drawings that no longer match the plant invite exactly the kind of misunderstanding that change control exists to prevent. Closure and demolition projects add contractors unfamiliar with the facility’s history, which magnifies the risk.
“A plant being shut down is changing every single day, and each of those days carries risk,” Jevyak says. “Every blind installed, every interlock pulled out of service, every piece of equipment cut out of the line alters what the next shift believes about the system, so the documentation has to keep pace with the steel.”
Practical steps include maintaining redlined drawings that reflect actual conditions, briefing every incoming crew on the current state of isolation, and treating the removal of safeguards as a change requiring its own authorization. Project managers who embed these checkpoints in the schedule protect both workers and timelines, since an unplanned incident costs far more than a documented review.
Management of change succeeds when every modification prompts a reflexive pause over what it might alter. Organizations that audit honestly while acting on findings, and rewarding the pause keep ordinary work from becoming an investigation report.
.
Gregory Jevyak is a retired management professional with more than 30 years in the petroleum and environmental industries, specializing in refinery closure, demolition, and environmental cleanup, with recognition from the Illinois EPA and U.S. EPA for excellence in the field.
Disclaimer: This article reflects general industry practices and the professional perspective of Gregory Jevyak. It is not legal or regulatory advice; readers should consult qualified professionals and applicable agencies for project-specific requirements.