Management of Change: 5 Gaps That Let Temporary Decisions Become Permanent Risk

A pump fails during a production campaign, so the team installs a temporary bypass. The change is documented, the manager signs the form, and the line keeps running. Three months later, the bypass is still there. The person who approved it has moved roles, the original maintenance plan has disappeared into a folder, and the temporary arrangement now looks like part of the plant.

This is how management of change becomes a paperwork exercise. The organization records that a decision happened, but it does not preserve the conditions that would make the decision safe. A temporary control becomes normal work, and a known exception loses the attention that made it visible.

Management of change is a controlled decision process for identifying how a modification can alter hazards, controls, responsibilities, and operating limits before the new condition is accepted. Its purpose is not to slow work. Its purpose is to prevent an unexamined change from becoming the next normal state.

Across 25+ years in multinational EHS leadership and more than 250 cultural transformation projects, Andreza Araujo has repeatedly emphasized the difference between declared control and operated control. A change is controlled only when the people who execute the work can describe the new risk boundary, apply the required barrier, and recognize the condition that requires escalation.

1. The change is defined by equipment, not by the work

Many reviews begin with a narrow question about what component, recipe, software setting, or material will be different. That description is necessary, but it is not enough. Risk changes when the task sequence, staffing pattern, access route, supervision level, isolation method, or recovery plan changes as well.

A valve replacement may alter the physical system, while the real exposure comes from a new isolation sequence that forces workers to enter a less visible area. A software update may appear administrative, although the practical effect is that an alarm arrives later and the supervisor has less time to intervene. The change record must follow the work, not just the asset.

The field test is simple. Ask the supervisor to describe what the crew will do differently during the first shift, including what they will stop doing, what they will verify, and what condition will stop the job. If the answer only names the equipment, the review is incomplete.

2. Temporary controls have no expiry that someone owns

Temporary arrangements are often treated as lower risk because they are described as short term. The opposite can happen. A temporary bypass, additional inspection, manual check, or restricted operating mode creates dependency, and dependency grows when the restoration date is not tied to a named owner with authority and time to act.

An expiry date printed on a form is not ownership. Ownership means a person can explain what must be restored, what evidence proves restoration, and what decision follows if the date cannot be met. Without those three elements, the date becomes a reminder rather than a control.

Leaders should distinguish between a temporary control and a temporary condition. The control is the action that reduces exposure. The condition is the altered state that creates the need for that action. If the condition remains, the organization should either remove it or formally redesign the work around it, because an emergency workaround cannot quietly become the operating model.

3. The risk review ends before the field verifies it

Approval meetings are usually held away from the point where the change will be executed. Participants know the design intent, the schedule, and the production consequence, but they may not see the physical access problem, the poorly placed isolation point, or the extra step that a contractor must improvise.

This gap is not solved by adding another signature. It is solved by field verification that tests whether the intended control exists in the place and sequence where work will occur. The verification should involve the person who owns the work, the person who supervises it, and someone who can challenge the risk assessment without being pressured by the schedule.

James Reason's work on latent conditions remains useful here because it directs attention toward design, supervision, maintenance, and organizational decisions that create the setting for an error. When a worker misses a new step, the investigation should ask why the step was difficult to see, remember, or perform under real conditions.

4. The change has a technical owner but no operating owner

Engineering may own the modification, maintenance may own the installation, and EHS may own the review. That arrangement can still leave nobody responsible for the daily operating boundary after the project team leaves.

The operating owner is the person who decides whether the changed condition is acceptable at the start of a shift, during abnormal work, and when production pressure rises. This role cannot be implied. It must be named in language the supervisor understands, with authority to pause the work and request a new review.

A useful test is to remove the project manager from the distribution list and ask who would notice that the temporary control had failed on a night shift. If no one has a clear answer, the change is not owned where the risk is lived.

5. Restoration is treated as administration instead of risk reduction

Organizations often celebrate the approval of a change and treat restoration as a closing task. That reverses the logic. If the altered condition introduced a new exposure, returning to the original design may be the most important control decision in the entire process.

Restoration needs proof, not a status update. The proof may be a verified equipment configuration, a completed functional test, a removed bypass, a revised drawing, a closed work order, or a supervisor observation that confirms the old operating boundary has returned. The evidence depends on the change, but it must be observable.

Heinrich and Bird's precursor-event logic also matters here. A near miss, repeated deviation, or failed check can show that the temporary arrangement is producing smaller signals before a serious event occurs. Treating those signals as administrative noise allows the organization to normalize the condition it should be removing.

What a stronger management-of-change review asks

A mature review does not ask only whether the change was approved. It asks whether the decision still matches the work, whether the controls remain practical, and whether someone has authority to reverse the condition when evidence changes.

This table is not a replacement for the site's procedure. It is a way to expose whether the procedure protects the decision or merely records it. The difference becomes visible when the schedule is tight, the original owner is unavailable, or the crew faces a condition that was not present during approval.

How EHS leaders can test the system this month

Select three recent changes, including one that was closed, one that remains temporary, and one that affected a high-consequence task. For each, trace the decision from the original trigger to the current field condition. Do not begin with the form. Begin with the worksite and ask the operating owner to reconstruct what changed.

Then compare the stated control with the control that workers actually use. Look for extra steps, informal substitutions, missing information, and decisions that depend on a person who is not always present. These differences are not proof of poor intent. They are evidence that the change process has not kept pace with the work.

Finally, choose one weak change and give it a clear end state. Remove the condition, redesign it, or formally accept the permanent operating model with the right engineering, training, supervision, and verification. A review that cannot produce one of those outcomes is still open, regardless of what its status field says.

The leadership decision behind every temporary change

Every temporary change contains a leadership choice. The organization can treat the altered condition as a short interruption that deserves constant attention, or it can let familiarity make the condition invisible. The first choice keeps risk explicit. The second transfers risk from the approval meeting to the worker who encounters the change later.

Management of change is therefore a test of operational discipline. The question is not whether the organization has a form, a committee, or a workflow. The question is whether a changed condition remains visible until it is removed, redesigned, or accepted with evidence that matches the new risk.

That is the standard EHS leaders should set. Temporary decisions need owners, field proof, and an end state. Without those elements, the temporary label hides a permanent exposure.

Explore Andreza Araujo's safety leadership work and practical resources.