MOC vs PSSR vs Field Verification: Which Change-Control Check Fits

A process change can look closed in the system while the field is still carrying the risk. The drawing was updated, the approval routed, the startup checklist signed, and the work crew briefed. Yet the valve label is still wrong, the isolation point is harder to reach than the drawing suggests, or the temporary bypass remains in place because production needed one more hour.

That is why operations and EHS leaders should not treat management of change, pre-startup safety review, and field verification as interchangeable paperwork. They answer different questions. MOC asks whether the proposed change has been evaluated before it is made. PSSR asks whether the changed system is ready to start. Field verification asks whether the real workplace matches the decision leaders believe they approved, and a critical control verification calendar keeps that question alive after the startup meeting.

On Headline Podcast, Andreza Araujo often brings safety conversations back to the distance between formal control and operated control. In more than 250 cultural transformation projects supported by Andreza Araujo, that distance has been one of the clearest signals that a company has compliance activity without risk ownership.

Key Takeaways

• MOC is strongest before a change is implemented, when leaders still have time to reject, redesign, or condition the change.
• PSSR is strongest at restart, especially after construction, maintenance, software, equipment, or process changes that affect safeguards.
• Field verification is strongest when leaders need proof that the approved control exists and works in the place where people will use it.
• The wrong tool creates false confidence, because a signed MOC does not prove readiness and a signed PSSR does not prove routine control health.
• High-risk changes need a sequence that connects all three checks instead of choosing the easiest form to close.

Evaluation criteria for choosing the check

The comparison should begin with five criteria: timing, decision authority, evidence type, restart risk, and field drift. If the change is still being designed, the question belongs mainly to MOC. If the changed asset is about to start, the question belongs mainly to PSSR. If the system is already operating or the control depends on field behavior, the question belongs mainly to verification at the workface.

OSHA process safety management requirements name management of change and pre-startup safety review as separate duties because design evaluation and startup readiness are not the same control. ISO 45001:2018 also requires organizations to control planned changes that affect occupational health and safety, which means a change-control process has to reach beyond engineering documents when work conditions shift.

Andreza Araujo's A Ilusao da Conformidade (The Illusion of Compliance) is useful here because a closed form can hide a weak condition. The question is not whether the change has a record. The question is whether the record caused the right decision, at the right moment, by the owner who can still change the work.

For risk management, the practical test is direct. If the check cannot say what changed, which safeguard is affected, who owns the decision, and what proof will be accepted before work continues, it is not controlling change. It is documenting faith.

1. MOC: best before the change is made

Management of change is strongest when leaders still have options. Before a new chemical is introduced, a relief device is replaced, a layout is changed, a software logic is edited, or a staffing model is altered, MOC should force the organization to ask what hazards are being introduced or moved.

The advantage is decision timing. A good MOC can stop a weak change before cost, schedule, and operational pride make reversal difficult. It should test technical basis, affected procedures, training needs, emergency response, permits, maintenance plans, contractor interfaces, spare parts, alarm logic tied to overfill prevention, and temporary controls.

The trap is administrative approval without technical challenge. When MOC becomes a routing exercise, each function signs the box that belongs to its department while nobody owns the combined risk. This is where field work starts to inherit design assumptions that were never tested under real operating pressure.

Use MOC when the change is planned, material to risk, and still adjustable. Pair it with a What-If review before process change when the team needs to test abnormal scenarios before the modification reaches the field.

2. PSSR: best before startup or restart

Pre-startup safety review is strongest when the changed system is built, installed, repaired, configured, or modified, and the organization is deciding whether it is ready to start. It should not repeat the whole MOC. It should test whether MOC conditions were actually completed and whether startup can proceed without exposing people to unmanaged risk.

The advantage is readiness discipline. PSSR can confirm that construction matches design, safeguards are installed, interlocks are available, procedures are updated, workers are trained, emergency arrangements are current, punch-list items are risk-ranked, and temporary deviations are controlled.

The trap is startup pressure. A PSSR held after leadership has already promised the restart date may become a ritual that converts open risk into accepted risk. The review then asks how to start despite the gaps, instead of asking whether startup should wait.

Use PSSR when the change affects equipment, process conditions, energy sources, control logic, occupancy, emergency response, or protective systems before startup. It connects naturally to interlock bypass restart review when the change includes defeated or restored protective functions.

3. Field verification: best when real work may differ from approved work

Field verification is strongest when the organization needs evidence that the control exists, can be used, and is being used in the place where risk is created. It is not a substitute for MOC or PSSR. It is the check that protects leaders from believing the system because the system believes itself.

The advantage is exposure truth. A supervisor, engineer, operator, or EHS professional can see whether isolation points are accessible, labels match the asset, guarding is intact, workers understand the changed sequence, temporary hoses create line-of-fire exposure, and the planned control still fits the actual task.

The trap is treating verification as a walkaround with no decision rights. If the verifier can only observe but cannot hold startup, stop work, or escalate a mismatch, the activity becomes a witness tour. Real verification needs authority, criteria, and a record of what changed after the mismatch was found.

Use field verification when controls are physical, behavioral, spatial, or dependent on handover quality. The recent Headline guide on permit revalidation at shift change shows why field conditions can change faster than the permit record suggests.

Decision matrix for operations and EHS leaders

The right answer is often a sequence rather than a single tool. A chemical substitution may need MOC before approval, PSSR before startup, and field verification during the first operating window. A minor procedural change may need MOC and verification but no formal PSSR. A like-for-like replacement may need field verification if the replacement changes access, visibility, ergonomics, or isolation quality.

The matrix should be used before the check is assigned. If leaders choose PSSR for a change that is still conceptual, they are late. If they choose MOC for a system that is already built and waiting to start, they may miss readiness evidence. If they skip field verification, they may never learn that the approved control failed on contact with the workplace.

Recommendation by change context

For design or process changes that are still reversible, MOC should lead. Leaders should insist on a clear change owner, a documented technical basis, affected safeguards, and decision conditions before procurement, installation, or field execution makes the change harder to challenge.

For construction, maintenance, turnaround, software, interlock, or equipment changes that are ready to start, PSSR should lead. The review should not close until open items are classified by risk and the startup owner accepts only the residual risk that has a named control, not a vague promise.

For changes that depend on actual task execution, field verification should lead or follow immediately after startup. This is especially important when the change affects LOTO points, traffic routes, chemical transfer, pressure testing, temporary power, confined-space access, or contractor interfaces.

For senior leaders, the safest governance sequence is MOC decision, PSSR readiness, field verification, and control-health follow-up. The Headline article on dynamic risk assessment field triggers matters here because changed work often reveals risk after the formal approval window has closed.

Implementation sequence for high-risk changes

The first step is to classify the change before anyone chooses a form. The classification should ask whether the change affects energy, chemistry, pressure, movement, people, contractors, software, safeguards, emergency response, workload, or supervision. If it does, the change deserves a named owner and a planned control sequence.

The second step is to define hold points. MOC should hold approval until hazards and affected controls are understood. PSSR should hold startup until readiness evidence is complete or risk-ranked. Field verification should hold work when the approved control does not match the exposed condition.

The third step is to connect the checks. The PSSR should reference MOC commitments, and field verification should reference both the PSSR evidence and the real task. When those links are absent, each check can close in isolation while the operation still carries a combined weakness.

The fourth step is to verify recurrence across similar systems. If one change exposed a weak labeling practice, an inaccessible isolation point, or a temporary-control habit, leaders should ask where else the same condition exists. Contractor interface registers are useful when the change crosses company boundaries and nobody owns the handoff cleanly.

Governance traps that weaken change control

The first trap is closing MOC after the change is already physically complete. At that point, the organization may be documenting a decision that has already been made by schedule pressure, not by risk review.

The second trap is allowing PSSR punch-list items to accumulate with weak risk ranking. A missing sign and an untested shutdown function cannot live in the same category. Leaders need a language that separates housekeeping gaps from controls that protect against serious exposure.

The third trap is sending EHS to verify a field condition that operations can ignore. If the line owner is absent from the mismatch decision, the verification report may be accurate and powerless at the same time.

A change-control process fails quietly when every form is closed by a different owner and nobody tests whether the changed work is actually safer to perform.

Some field-verification findings should also change permit authority. Use the permit-to-work authorization matrix guide when a change, restart, bypass, or contractor interface requires a higher approval tier before work continues.

FAQ

What is the difference between MOC and PSSR?

MOC evaluates a proposed change before it is implemented, while PSSR checks whether the changed system is ready to start or restart. MOC is mainly a decision-control process. PSSR is mainly a readiness-control process.

When should field verification be used?

Field verification should be used when the approved control depends on real workplace conditions, worker understanding, physical access, labels, isolation points, temporary equipment, contractor interfaces, or task execution. It is most valuable when formal records may not reflect what people will actually face.

Can a change need all three checks?

Yes. A high-risk process, equipment, chemical, software, or safeguard change may need MOC before approval, PSSR before startup, and field verification during early operation. The three checks answer different questions in the same risk chain.

Who should own change-control checks?

The owner should sit where the risk can be changed. Engineering may own technical basis, operations may own startup and field readiness, maintenance may own asset condition, and EHS may challenge the risk logic. The final owner should have authority to hold or change the work.

How do leaders know whether change control worked?

Change control worked when the organization can show what changed, which safeguards were affected, what evidence allowed startup, what field mismatches were corrected, and where similar exposure was checked. A closed form alone is not proof of risk reduction.