MOC failures don't start with the incident — they start with the change nobody logged. Here's what that looks like at a refinery turnaround.
The incident report will say "equipment failure" or "worker error." What it won't say — because by then nobody wants to find it — is that a maintenance tech modified a pressure relief valve configuration during a turnaround three weeks earlier, no one logged it, no hazard review happened, and the written program that was supposed to catch exactly that kind of change was sitting in a binder on the safety coordinator's desk, technically current, technically compliant, and completely disconnected from what was actually happening in the field.
That's the gap. And that gap is where serious injuries and fatalities live.
Management of Change is the formal process of evaluating risk before any change happens — to equipment, materials, procedures, or personnel. OSHA's Process Safety Management standard (29 CFR 1910.119) requires it explicitly for covered processes. But the real failure isn't in PSM facilities — it's everywhere else.
Industrial maintenance contractors running refinery turnarounds and plant shutdowns are living in a constant state of change. Crews rotate. Equipment gets pulled, modified, temporarily bypassed, and put back in service. Process conditions shift. A unit that was running at 400°F last week is cold-opened this week and hot again before the next shift. Every one of those transitions is a potential MOC trigger. Most of them never touch a form.
Here's what OSHA finds when they show up: the written MOC procedure exists. It's signed, dated, and formatted correctly. The safety manager can produce it in under two minutes. What they cannot produce is evidence it was actually used — no completed MOC forms for changes made during the outage, no sign-off from the process engineer before that temporary bypass was installed, no documented hazard review when the competent person on the scaffolding crew was swapped out mid-job because the original lead called in sick.
The paper says the program works. The site says otherwise.
Most safety coordinators assume the MOC failure is a documentation problem — that people just aren't filling out the forms. But the real problem is that the forms exist for the changes everyone already agrees are changes. Nobody argues about whether swapping in a different heat exchanger requires an MOC. The failures happen on the changes that don't feel like changes.
A foreman reassigning a certified welder to a different task mid-shift. A crew deciding to re-sequence a valve line-break because the schedule slipped. A maintenance supervisor verbally approving a "temporary" jumper on a safety interlock to keep the turnaround moving. None of those feel like MOC-triggering events in the moment. All of them are. And any one of them, under the right conditions, is a fatality precursor.
That's what SIF-prevention research from the Campbell Institute consistently shows: the incidents that kill people are rarely the ones anyone was tracking as high-risk. They're the ones that fell through the gap between "this is obviously a change" and "this is just how we're handling today."
In a refinery turnaround context, an inspector isn't going to walk past a P&ID and ask if you have an MOC procedure. They're going to ask to see completed MOC records for changes made during the outage — specifically, they want to see that the hazard review happened before work started, not after. They're going to ask your process safety coordinator, your maintenance foreman, and your contract safety manager separately whether they know what triggers an MOC. Inconsistent answers are findings.
A serious OSHA violation — the kind that lands on a PSM-related MOC failure — runs up to $16,131 per violation. A willful or repeat citation: up to $161,323. Per violation. In a turnaround environment where dozens of undocumented changes are routine, that math compounds fast.
Beyond the fines, there's the prequalification consequence that hits before anyone's even thinking about regulatory exposure: a serious incident during a contractor turnaround gets logged against the contractor's ISNetworld or Avetta profile. EMR climbs. The safety grades drop. The next bid invitation doesn't come — not because the owner-operator formally disqualified the contractor, but because the contractor no longer clears the threshold filter. Those contracts disappear quietly. No denial letter, no explanation. Just silence.
Picture a plant shutdown at a refinery. The contractor's crew is in day 11 of a 14-day turnaround. The original competent person for confined space entry on the crude unit — the one who attended the pre-job safety meeting, reviewed the JSA, and signed the entry permit — is pulled to handle an emergent issue on another unit. A different maintenance tech, qualified on paper, steps in. Nobody updates the permit. Nobody triggers an MOC review for a personnel change on a high-energy confined space entry. The new competent person hasn't been briefed on the specific atmospheric hazards documented in the pre-entry survey for that vessel.
Nothing happens that day. But that is a SIF precursor — an event with fatality potential that didn't end badly only because of luck, not because a control actually worked. Most programs never count it as such. The near-miss form, if it gets filled out at all, describes it as a "minor documentation gap." The real description is: the Swiss Cheese Model's holes lined up and stayed open.
A 15-minute MOC process that gets used beats a 2-week process that gets bypassed every time. For contractor maintenance teams on turnarounds, the MOC trigger list needs to be laminated and on the foreman's clipboard — not buried in a digital system back at the office. Personnel changes on high-hazard tasks, any temporary deviation from the approved work sequence, any modification to safety-critical equipment, any change to isolation points — those are the four categories that should auto-trigger a review. The review doesn't need to be a committee. It needs to be documented, it needs to happen before work restarts, and the safety coordinator needs to be in the loop.
The written program and the field practice need to describe the same reality. Right now, at most contractor organizations running turnarounds, they don't.
MOC applies wherever there's a change that could affect safety — which means it applies to contractor crews on every major maintenance project, not just PSM-covered processes. Contractors who work in PSM facilities are often contractually required to follow the facility's MOC program, but many don't have a functioning internal MOC process for their own operations, which is where the gap shows up.
Any change from the approved work plan — equipment substitution, personnel reassignment on high-hazard tasks, temporary bypasses of safety systems, sequence changes on energy isolation work, or modifications to materials being used. The key word is "temporary" — contractors frequently treat temporary changes as exempt from MOC, which is exactly backwards.
Inspectors ask for completed MOC records during the inspection window — not the written procedure, the actual completed records. No records means no evidence the process was followed. That's the citation. In PSM-covered facilities, it's a process safety citation. In general industry, it can still support a serious violation finding under the General Duty Clause.
EHS, Inc. manages the written programs, training, and compliance documentation so safety managers have the bandwidth to actually work the problem in the field instead of maintaining paperwork. If your MOC program exists on paper but not in practice, that's the exact gap the managed service is built to close.
If the admin is eating your time and the field program is suffering for it, that's the conversation worth having. Talk to EHS — we handle it.
Aaron West
Founder, EHS, Inc. — 18+ years in EHS compliance and contractor safety
Aaron West has spent over 18 years helping contractors and businesses navigate OSHA compliance, ISNetworld® certification, and workplace safety management. He founded EHS, Inc. to make enterprise-level EHS accessible to companies of all sizes — serving contractors and businesses nationwide — without long-term contracts or enterprise overhead.
Our team handles the complexity so you can focus on running your business. No long-term contracts, no learning curve.
Talk to EHSWhen headcount drops during a turnaround, critical control ownership doesn't disappear — it just becomes nobody's job.
Running ISO 14001 and your safety program as separate systems isn't just inefficient — it has a specific dollar cost. Here's what it is.
In upstream drilling and pipeline work, OSHA doesn't cite the hazard — they cite the missing communication record. Here's what that looks like.
Framework to achieve zero incidents
Stop hitting paywalls
54 topics in English & Spanish