How to Verify a Temporary Change Before Restart

A temporary change can be installed in 30 minutes and remain in service for 30 days, which is why restart decisions deserve more than a signed approval. This guide gives supervisors a field sequence for checking whether the altered condition is controlled before equipment or production returns to service.

The central question is not whether the change was authorized. It is whether the worksite now matches the assumptions behind that authorization. A bypass, substitute component, temporary hose, altered interlock, revised set point, or staffing change can move risk into a location that the original procedure never described. That is why a temporary change hold point should test the field condition, not only the approval record.

OSHA's process-safety standard requires covered facilities to address management of change, including the technical basis, safety and health impact, operating procedures, duration, and authorization of the change. The standard is a useful anchor, but a field verification still has to prove that the approved controls exist. OSHA specifies the management-of-change elements, while the steps below turn those elements into a restart decision.

What do you need before starting?

Before verification starts, define the temporary condition, the affected hazard, the release authority, the expiry point, and the evidence that will permit restart.

Bring the approved change record, current operating procedure, isolation plan, relevant drawings or photos, and the emergency response instruction to the field. Include the people who will operate, maintain, and supervise the changed system, because each role sees a different failure mode.

Do not begin with a broad question such as “Does this look safe?” Use a bounded question such as “Can this pump restart with the temporary discharge hose, the altered guard, and the current isolation boundary?” A narrow question produces evidence. A broad question invites confidence.

Step 1: Define the temporary boundary

The first step is to write down exactly what changed, where it starts and ends, and what remains outside the temporary arrangement.

Record the equipment tag, work area, affected process, start date, expiry date, and named owner. If a change crosses an interface between production and maintenance, identify both sides. A temporary boundary that exists only in one department's record is not a reliable boundary.

Describe the change in operational language. “Temporary modification to pump discharge” is weaker than “eight-meter flexible hose replaces the fixed discharge line between P-204 and the neutralization header.” The second description gives the verifier something that can be located and challenged.

Andreza Araujo's work treats risk ownership as a visible management practice. The practical implication is simple: if no person can state when the change ends, the organization has not yet defined the risk it believes it is controlling.

Step 2: Identify the changed energy and exposure

The second step is to identify which energy, pressure, chemical, motion, temperature, or human exposure changed because the temporary arrangement was introduced.

List the original energy source, the new or displaced energy path, and the people who could be exposed during startup, normal operation, upset response, or maintenance. A temporary change can alter exposure without changing the equipment nameplate, which is why the original risk assessment may no longer be enough.

Ask what could now move, spray, fall, ignite, overheat, disconnect, or become inaccessible. Then ask which protection was designed for that condition. OSHA's machine-guarding guidance directs employers to inspect safeguards and correct hazardous conditions, and OSHA provides a self-inspection checklist for safeguarding that helps structure this challenge.

The point is not to produce a longer hazard list. It is to find the one changed exposure that could make the restart decision wrong.

Step 3: Confirm the technical basis

The third step is to verify that the temporary solution has a documented technical reason, a known operating limit, and a clear condition under which it must stop.

Check the calculation, specification, compatibility statement, drawing revision, or engineering note that supports the change. Confirm that the document names the same equipment and configuration that exists in the field. A generic supplier email is not a technical basis if it leaves pressure, temperature, load, or duration undefined.

Record the maximum permitted operating envelope and the signal that indicates the boundary is being approached. If the temporary hose is rated for 10 bar, the procedure must explain how the operator will know that pressure is approaching the limit and what action follows. Numbers matter because vague language cannot govern a restart.

ISO 45001:2018 places operational control inside a management system that plans for change and evaluates risk. ISO describes ISO 45001 as a system for managing OH&S risks and continual improvement. The field check gives that system a physical test.

Step 4: Walk the installation without the installer leading

The fourth step is an independent field walk in which the supervisor verifies the installation without allowing the person who made the change to explain away the evidence first.

Start from the operating position and trace the changed condition toward the energy source. Look for missing supports, sharp edges, inaccessible valves, unexpected movement, blocked access, unmarked isolation points, and controls that depend on a person remembering an exception.

Use photographs, tags, and a short evidence log. When the installation differs from the drawing, stop the walk and classify the difference. It may be harmless, it may need an engineering correction, or it may invalidate the approval. Do not resolve that uncertainty through a casual verbal agreement.

Step 5: Test the critical control at the point of work

The fifth step is to test the control where exposure occurs, because a control that exists in a document but cannot be demonstrated is not ready for release.

Choose the control that prevents the worst credible outcome and ask the responsible person to demonstrate it. The test may involve an isolation, guard, relief path, alarm, communication step, exclusion zone, or emergency stop. Confirm both presence and function. When a critical barrier is unavailable, use the same discipline described in a control-health review and make the gap explicit.

James Reason's work on latent conditions helps explain why this step matters. A control can fail long before an incident if the organization has allowed a hidden weakness to become normal. The temporary-change verifier should therefore ask what evidence proves the control will work during the first abnormal condition, not merely during a calm inspection.

When the test cannot be performed safely, define the alternate evidence and the compensating control. Never record “verified” when the control was only discussed.

Step 6: Compare approval with field reality

The sixth step is to compare the approved change with the installed condition and decide whether the difference is acceptable, correctable before restart, or a stop condition.

Use a three-way decision. Release means the evidence matches the approval. Correct before restart means the change can be fixed without accepting exposure. Stop means the basis, boundary, or control is wrong and requires a new decision. This is different from a checklist score because one failed critical control can outweigh 10 satisfactory observations.

OSHA's management-of-change guidance distinguishes organizational changes that can affect covered processes, which is a reminder that staffing, procedures, and interfaces can matter as much as hardware. OSHA explains why organizational changes can enter the MOC review.

Step 7: Run the restart conversation

The seventh step is a short conversation in which the decision owner states the changed condition, the critical control, the stop signal, and the escalation route before restart.

Ask the operator to explain what is different, the supervisor to state what has been verified, and the maintenance or engineering representative to name the remaining limitation. If their answers conflict, the change is not ready. The conversation is a control, not a courtesy briefing, much like a safety-critical shift handover that preserves risk ownership.

Use direct language. “If pressure reaches 8 bar, stop the pump and call the control owner” is operational. “Monitor the system closely” is not. The more temporary the arrangement, the less room there is for interpretive wording.

Make the person with authority to stop the restart explicit. Psychological safety matters here because a worker who cannot challenge an unclear release will convert uncertainty into exposure. As Andreza Araujo's A Ilusão da Conformidade argues, apparent agreement can conceal the question people are afraid to ask.

Step 8: Set the expiry and follow-up proof

The eighth step is to close the temporary decision with an expiry date, follow-up evidence, and a named action that prevents the workaround from becoming permanent.

Set the next review before the restart occurs. The review may be due after the first shift, after 24 hours, after the next maintenance window, or when a defined operating condition changes. Choose the shortest interval that matches the uncertainty, not the most convenient calendar date.

Assign the permanent corrective action, its owner, and the evidence that will close it. A temporary change should leave a trace that a manager can inspect later, including the decision, the control evidence, the unresolved limitation, and the removal or formalization plan.

If the temporary arrangement has no expiry, no accountable owner, or no proof that the critical control works, do not describe it as controlled. Those 3 omissions are a restart warning.

Andreza Araujo's safety-culture position is consistent with this discipline. In Safety Culture: From Theory to Practice, she argues that doing nothing is not an option when a risk is identified, and a temporary workaround is not a substitute for a controlled decision.

How is field verification different from document approval?

Document approval establishes that a proposed change has been considered; field verification establishes that the current worksite still matches the conditions under which that approval was granted.

The distinction protects leaders from a common failure mode. A change can be technically sound on paper, yet unsafe in operation because a support was omitted, an isolation boundary moved, an instruction was not transferred, or a substitute part has a different rating.

Use approval to decide whether the change may proceed. Use field verification to decide whether the changed system may operate now. Keeping those decisions separate makes ownership clearer and makes a stop decision easier to defend.

What should the supervisor record after the check?

The final record should allow another leader to reconstruct the restart decision in less than 10 minutes, including the condition, evidence, owner, limitation, and follow-up date.

• The exact temporary change and affected equipment.
• The changed energy or exposure and the worst credible outcome.
• The technical basis, operating limit, and compensating control.
• The field evidence, photographs, test result, and unresolved differences.
• The release, correction, or stop decision with the accountable name.
• The expiry date, permanent action, review trigger, and escalation route.

A temporary change is controlled only when the organization can show what changed, why it is acceptable for a limited period, how the critical control was tested, and who will act when the condition no longer holds. That is the difference between a signed workaround and a defensible restart decision.

For more conversations about leadership, safety decisions, and better workplaces, visit Headline Podcast.