Management of change for plant modifications: the test, the eight steps and the register
The test for whether something is a change at all, the eight steps from request to close, review in proportion to the class, temporary changes and their expiry, the updates that close a change, and the register that records it. With a free change register template.
Key takeaways
- Management of change is the process that makes sure a plant modification is reviewed by the people it affects, approved by someone accountable, and reflected in every record that described the old state before the plant runs on the new one.
- The first question is whether something is a change at all. A replacement in kind goes on a work order. Anything that moves the design basis, the logic, a limit, a procedure or a responsibility is a change.
- A change passes eight steps: request, classify, review, approve, implement, update, verify and start, close. The class decides how much review, and the updates are not optional.
- Temporary changes are the dangerous ones. A bypass, a jumper or a blank gets the same review, an expiry date, and a recorded reversal.
- The register is the record. A change not on it did not go through the process, and a change on it that is not closed is still open on the plant.
Most plant modifications are small. A different bearing because the right one was on a long lead. A setpoint moved to stop a nuisance trip. A line blanked for a shutdown and never reopened. A procedure changed on a whiteboard. Each was made by one competent person for a good reason, and each was reviewed by nobody, recorded nowhere, and found later by someone it hurt.
Management of change is the process that catches those. It is not heavy: a request, a classification that sends most things straight back to a work order, a review proportionate to the class, an approval by someone accountable, and the discipline that a change is not finished until every record says the new state. This guide sets out the test for whether something is a change, the eight steps, the classes and the review each needs, temporary changes, the updates that close a change, the register that records it, and where the process fails. A register template comes with it.
The scope here is engineering change on a plant. On a facility covered by process safety regulation the same process carries the hazard review those obligations require, and that review is referenced here rather than described.
Free download
Change register template
A change register with the class, the reviews required, the approval and its conditions, the documents to update and the pre-startup check against every change, three worked rows including a temporary bypass with an expiry, and the classification test and the steps on sheets of their own.
Is it a change?
The process starts with a question that most sites get wrong in one direction or the other: either everything is a change and the process drowns, or nothing is and the process is bypassed. The test is whether the design basis has moved. A replacement with the same make, model, rating and material, fitted the same way, has not moved it and goes on a work order. Anything else has, however slightly, and goes through the process at a class that fits its size.
The table gives the usual tests. The last two rows are the ones that are most often missed, because they are not physical: a procedure that changes a step or a limit, and a change to who does what. A new supervisor taking over a unit with no handover is a change to the plant's safeguards as real as a removed interlock.
| The proposal | Classification | What follows |
|---|---|---|
| Same make, model, rating and material, fitted the same way | Replacement in kind | Work order only |
| A different make or model with the same function, rating and material | Change, minor | Engineering check that the specification is met, drawings and datasheets updated |
| A different rating, material, size or setting | Change | Full review, because the design basis has moved |
| A new or removed interlock, alarm, setpoint or logic | Change | Full review with the control narrative and the hazard study |
| A new or changed procedure that alters a step, a limit or a hazard | Change, procedural | Operations and safety review, training before use |
| A temporary bypass, jumper, blank or override | Temporary change | Full review, an expiry date, and a reversal recorded |
| A change to who does what, or to the organisation around the plant | Organisational change | Review of the competence and the handover, which is often missed |
The design basis moved or it did not. If it did, somebody checks it still holds. That is the whole process.
The eight steps
The steps are the same for every class; what changes with the class is how much review sits in the middle and who approves. A minor change may be a discipline lead's check and a datasheet update inside a day. A change to an interlock is a review with the control narrative and the hazard study, an approval by the engineering manager, and reissued drawings before start-up. The register carries both on the same sheet, which is the point: the small ones are on the record too.
1Request
Anyone proposes a change, in writing, with what, why and the equipment affected
A numbered request in the register
2Classify
Is it a change at all, or a replacement in kind? If a change, what kind, and how much review does it need?
Replacement in kind closed here; a change given a class and a review path
3Review
The disciplines affected assess it: engineering, operations, maintenance, safety, environment, and the hazard review the class requires
Findings and conditions, each with an owner
4Approve
A named authority for the class accepts the change with its conditions, or rejects it
An approval with conditions, or a rejection with a reason
5Implement
The change is made as approved, with temporary changes given an expiry date
The change in place, the conditions met
6Update
Drawings, the register, the CMMS, spares, procedures, job plans, alarms and the control system backup brought into line
Every record that described the old state now describes the new
7Verify and start
A pre-startup check that the change matches the approval and the updates are done; training delivered
Start-up authorised
8Close
The change closed in the register with its evidence; temporary changes reversed or made permanent through the same steps
A closed record, or a reopened one
Replacement in kind leaves at step 2, on a work order
→ A change is not done until every record says the new state
| Step | What it does | What it produces |
|---|---|---|
| Request | Anyone proposes a change, in writing, with what, why and the equipment affected | A numbered request in the register |
| Classify | Is it a change at all, or a replacement in kind? If a change, what kind, and how much review does it need? | Replacement in kind closed here; a change given a class and a review path |
| Review | The disciplines affected assess it: engineering, operations, maintenance, safety, environment, and the hazard review the class requires | Findings and conditions, each with an owner |
| Approve | A named authority for the class accepts the change with its conditions, or rejects it | An approval with conditions, or a rejection with a reason |
| Implement | The change is made as approved, with temporary changes given an expiry date | The change in place, the conditions met |
| Update | Drawings, the register, the CMMS, spares, procedures, job plans, alarms and the control system backup brought into line | Every record that described the old state now describes the new |
| Verify and start | A pre-startup check that the change matches the approval and the updates are done; training delivered | Start-up authorised |
| Close | The change closed in the register with its evidence; temporary changes reversed or made permanent through the same steps | A closed record, or a reopened one |
Review, in proportion
Review is where a change meets the people it will affect, and the class decides who they are. Engineering checks the design basis. Operations asks what the change does to how the plant is run and what the operators need to know. Maintenance asks what it does to the strategy, the spares and the job plans. Safety and environment ask about the hazards, and on a facility with process safety obligations the class says which formal study is required. Each finding becomes a condition on the approval, with an owner.
The common failure is review by the wrong people: the person who proposed the change reviewing it, or a discipline that is affected not being asked. The register's reviews-required column is set from the class, not from who happens to be available, and the approval waits for them.
Temporary changes
A bypass of a trip while a transmitter is replaced, a jumper across a terminal, a blank in a line, a forced value in the control system, a manual check standing in for an automatic one. Each is a sensible way through a short problem and each has, somewhere, become permanent because the short problem outlasted the attention. Temporary changes get the same review as permanent ones, an expiry date that is on the register and on the equipment, a compensating measure for the time they are in place, and a recorded reversal.
An expired temporary change is a finding. The register's status moves to expired by itself, and the weekly review asks of each one whether it was reversed, extended through the process, or made permanent through the process. The bypass register in the control room is the same list seen from the operator's side, and the two agree or one of them is wrong.
Nothing temporary lasts longer than the attention paid to it. Put the expiry on the register and on the panel.
A change is not done until the records say so
The implementation is the visible part and the updates are the part that matters later. Every document that described the old state is reissued: the P&IDs, the schematics and loop diagrams, the datasheets and bill of materials, the cause and effect and functional description, the alarm database, the control system backup, the procedures, the job plans, the maintenance plans and the asset register. The document control register lists them by the equipment tags, so the list comes from the record. Operators and maintainers are told, and where the change alters what they do, trained.
The pre-startup check closes the loop: that the change matches the approval, the conditions were met, the updates are done, and the people know. On a facility with process safety obligations this is the pre-startup safety review; on any plant it is the same question. Then the change is closed on the register with its evidence, and the asset register and the CMMS say what is now installed.
The register
The register is the record that the process happened. One row per change, numbered, with the class, the reviews, the approval and its conditions, the documents to update, the pre-startup check and the close-out, and for temporary changes the expiry. The columns are the template's, and its three worked rows run a minor replacement, an interlock change and a temporary bypass through the same sheet.
A change not on the register did not go through the process, whatever anyone remembers. A change on the register that is not closed is still open on the plant, and the weekly review reads the open ones first. At a larger site the register is a module of the CMMS or a dedicated system, with the workflow enforced; the columns are the same.
| Column | What goes in it |
|---|---|
| Change number | Never reused |
| Title | As it says |
| Requested by, date | As it says |
| Equipment and area | The tags and the area, so the change can be found from the asset |
| What and why | The change and the reason, in enough words to review |
| Class | As it says |
| Reviews required | From the class |
| Hazard review | The study the class requires, or none with the reason |
| Approved by, date | The authority for the class |
| Conditions | What the approval depends on |
| Expiry | Temporary changes only |
| Documents to update | Drawings, datasheets, procedures, job plans, alarms, the CMMS |
| Updates done | As it says |
| Pre-startup check by, date | As it says |
| Status | As it says |
| Closed by, date | As it says |
Where the process fails
- Everything classified as replacement in kind, because the process is seen as slow.
- Everything classified as a change, so the process drowns and is bypassed.
- Review by the proposer, or without the discipline the change affects.
- Approval by whoever was available rather than the authority for the class.
- Temporary changes with no expiry, found permanent years later.
- Implementation closed with the drawings, the alarm database and the control backup never updated.
- Procedural and organisational changes never treated as changes at all.
- A register that is a folder of forms rather than a list that is read.
Common questions
What is management of change?
A process that ensures a modification to a plant, its equipment, its controls, its procedures or its organisation is identified as a change, reviewed by the disciplines it affects, approved by a named authority, implemented as approved, and reflected in every document, system and person that depended on the old state, before the plant operates in the new one. It exists because most modifications are small, most are made by one person, and the consequences arrive later for someone else.
What is a replacement in kind?
A replacement with an item of the same make, model, rating and material, fitted the same way, so that the design basis has not moved. It needs a work order and nothing more. The test is strict: a different maker's equivalent, a different rating, a different material or a different setting is a change, however small, because the design basis has moved and somebody has to check it still holds.
What is a temporary change?
A modification made for a limited time: a bypass of a trip while an instrument is replaced, a jumper on a terminal, a blank in a line, an override in the control system. It gets the same review as a permanent change, plus an expiry date and a plan to reverse it, and the reversal is recorded. Temporary changes that become permanent by default are the common thread in incident investigations.
Who approves a plant modification?
A named authority set by the class of change: a discipline lead for a minor change that stays within the specification, an engineering manager or the plant manager for a change that moves the design basis, with the safety function's agreement where a hazard review was required. The authority is a person with the competence to understand the change and the accountability to own the decision, and the site's management of change procedure names them by role.
What documents have to be updated after a change?
Every one that described the old state. For a physical change, the P&IDs, the general arrangements, the schematics or loop diagrams, the datasheets and the bill of materials. For a control change, the cause and effect, the functional description, the alarm database and the control system backup. For either, the procedures, the job plans, the maintenance plans and the asset register. The document register lists them by the equipment tags, which is how the list is made from the record rather than from memory.
Is management of change a process safety requirement?
On facilities covered by process safety regulation it is a legal one: the US OSHA process safety management rule has a management of change element, and Australian major hazard facility regulations require the same in substance. On every other plant it is good engineering practice and a requirement of ISO 55001, which asks an asset management organisation to control changes that could affect its objectives. The process is the same either way; the hazard review the class requires is where a process safety facility's obligations are met.
Key terms
Plain-language definitions from our glossary for the concepts this article leans on.
Standards and further reading
- ISO 55001:2024 Asset management system requirements (ISO)
- 29 CFR 1910.119 Process safety management of highly hazardous chemicals, paragraph (l) management of change (US OSHA)
- IEC 81346-1:2022 Industrial systems, installations and equipment: structuring principles and reference designations (IEC)
- ISO 14224:2016 Collection and exchange of reliability and maintenance data for equipment (ISO)
- Best practices, metrics and guidelines for maintenance and reliability (SMRP)
Related case studies and tools
- Operational readiness for a new plant asset (case study)
Related reading
Working through something like this?
See how we approach these initiatives, or tell us what you are dealing with.