MOC Explained: 4 Decisions Before Risk Becomes Routine

MOC fails when a temporary deviation is treated as a paperwork event instead of a decision about changed risk. This explainer separates the four decisions that keep a change visible before it becomes routine.

Management of Change, usually shortened to MOC, is a controlled process for identifying how a planned or unplanned change can alter hazards, controls, responsibilities, or emergency readiness. It matters whenever the work, equipment, materials, people, software, or operating conditions no longer match the basis on which the original risk decision was made.

Definition

MOC is not another name for a risk assessment. A risk assessment examines exposure, while MOC asks whether the change has altered the assumptions, safeguards, competence, or ownership that made the original exposure acceptable. A strong MOC therefore connects the change request to evidence, authority, implementation, and a deliberate closeout.

The process applies to permanent projects, short-term repairs, staffing changes, software updates, altered production rates, and temporary operating limits. The trigger is not the size of the change. The trigger is whether the basis of safe operation has moved.

Four MOC decisions that prevent routine drift

1. Decide whether the change is truly a change

The first decision is a boundary test. Replacing a component with an identical specification may fit routine maintenance, while substituting a different material, supplier, set point, or control logic may change the hazard profile even when the equipment still looks familiar.

Ask what assumption would become false if the change went ahead. That question is more useful than asking whether the request is small, urgent, or already common. If the answer affects a critical control, competence requirement, permit, alarm, or rescue arrangement, route it through MOC.

2. Decide what evidence must change

A change can invalidate more than a risk assessment. It may require updates to drawings, procedures, training, inspection limits, isolation instructions, chemical information, emergency plans, or contractor briefings. The evidence list should follow the changed assumption rather than a fixed form.

Use the risk owner’s responsibilities to make one person accountable for identifying affected documents and verification points. A completed form without updated evidence is an administrative record, not control of change.

3. Decide who can accept residual exposure

MOC should make authority visible before work starts. The person requesting a change may understand the operational need, but that does not automatically give them authority to accept a new exposure, defer a safeguard, or redefine an emergency response.

Set the acceptance boundary before implementation. The risk appetite boundary should identify which conditions require redesign, escalation, an interim control, or a stop decision. This prevents urgency from quietly becoming permission.

4. Decide how the change will be proved effective

Closeout is the point at which many MOC systems become weak. A signature can confirm that people met. It cannot prove that the new alarm was tested, that operators can execute the revised sequence, or that the temporary repair no longer needs a temporary status.

Define verification before implementation, including the owner, evidence, due date, and condition that would reopen the change. For high-consequence work, compare the planned barrier with field evidence through control-dependency checks, because separate safeguards can share one hidden weakness.

How to differentiate MOC from adjacent processes

When should a team use MOC instead of a new form?

Use MOC when the change crosses a boundary between the approved design and the way work will actually be performed. A new form is not the goal. The goal is to preserve the reasoning that connects changed conditions to changed safeguards.

For a practical starting point, compare the request with the organization’s risk register and decision record. If the record cannot show what assumption changed, who accepted the remaining exposure, and how effectiveness will be verified, the change is not ready for release.

Conclusion

MOC works when it makes changed assumptions, authority, evidence, and verification explicit before a temporary deviation becomes the new normal.