- Management of change ensures modifications are assessed, approved, implemented and verified before they become normal operation.
- Temporary changes are the highest risk, because they skip the process and then never get removed.
- Replacement in kind is not a change; replacement with something similar usually is, and the distinction needs a written rule.
A bypassed interlock for a trial, a hose fitted for a shutdown, a manual step added while a sensor is on order. Each is justified at the time and each becomes permanent by default because nothing triggers its removal.
What counts as a change
- Equipment: new, modified, relocated or removed.
- Process conditions: setpoints, sequence, materials, throughput.
- Procedures and work instructions.
- Organisation: roles, staffing levels, shift patterns, contractor arrangements.
- Software, control logic and alarm settings.
- Suppliers of critical materials or services.
Replacement in kind
A genuinely identical replacement is not a change and should not carry the overhead of one. The trap is 'equivalent': a different manufacturer's component with the same rating may differ in failure mode, response time or materials. Write down what qualifies as in kind for your operation, or every judgement will be made under time pressure by whoever is holding the part.
What the assessment covers
- Safety and environmental consequences, including on adjacent equipment and downstream steps.
- Product quality impact, and whether validation or requalification is needed.
- Regulatory or customer notification requirements.
- Documents needing update: drawings, procedures, FMEAs, control plans, training material.
- Training required before the change goes live.
- How the change will be verified as working, and what would indicate it is not.
- How to reverse it if necessary.
Temporary changes
Give every temporary change an expiry date and a named owner, and require an explicit decision to extend rather than allowing silent continuation. Maintaining a visible register of open temporary changes, reviewed at a regular meeting, is the single most effective control here, because the failure mode is forgetting rather than deciding.
Verification after implementation
Most processes stop at approval. The step that matters is confirming, after the change is live, that it works as intended, the documents were actually updated, and the people affected were actually trained. Closing a change record on the strength of approval rather than verification leaves the gap the process was built to prevent.
Keeping it proportionate
A single process for every change guarantees either that trivial changes are burdened or that significant ones are rushed. Tier it: a light path for low-consequence changes with a single approver, a full assessment for anything touching safety, regulated product or a critical control.