A Small Change Can Create a Large Risk

Risk follows the effect of a change, not its size

A modification can look small in the work pack and still alter how a major-accident hazard is controlled. A temporary hose, a revised valve line-up, a changed alarm setting, different chemical composition, new software logic or an amended operating step may affect pressure, flow, containment, ignition control, human response or the availability of safeguards. The physical size, cost or planned duration of the change does not determine its process-safety significance.

UK HSE states that poor management and control of changes to plant and process often increases risk to people, plant and the environment. Its guidance calls for proposed changes to be identified, technically investigated and formally authorised by competent personnel. The practical lesson offshore is simple: screen the proposed effect before deciding that the change is minor.

Replacement in kind must truly preserve the design basis

Management of change is not required merely because a component is being replaced. A genuine replacement in kind preserves the relevant design specification and function. The label should not be used casually. A substitute may have the same connection size yet a different pressure rating, material, flow characteristic, failure position, electrical classification or maintenance requirement. Those differences can introduce new hazards or weaken existing controls.

OSHA's Process Safety Management standard requires written procedures for changes to process chemicals, technology, equipment and procedures, and to facilities that affect a covered process, except replacements in kind. Before implementation, the review must address the technical basis, safety and health effects, required procedure changes, time period and authorisation. This is a useful process-safety benchmark even where a different legal regime applies.

Hypothetical example: a temporary drain connection

Consider a hypothetical offshore team proposing a temporary flexible connection to route a hydrocarbon-containing drain to another collection point during maintenance. The connection appears familiar and is intended for only one shift. However, the receiving system may experience a different pressure, composition or flow, the hose may have different compatibility or restraint requirements, and the temporary route may affect area exposure, drainage or simultaneous work.

This is an illustrative scenario, not a documented incident. It does not establish a suitable design or operating method. The point is that duration and familiarity do not answer the safety questions. The team should pause implementation, define the technical basis, assess credible deviations and interactions, obtain the required competent approvals, and specify controls and removal criteria through the installation's approved process.

Calling the arrangement temporary does not reduce the energy or inventory it may carry. If the review cannot establish that the change is safe within the approved envelope, the change should not proceed.

Review the whole system, not only the modified item

A sound review asks what the change can influence upstream, downstream and during abnormal operation. Confirm compatibility with process conditions and materials; equipment and piping ratings; relief, shutdown and alarm functions; hazardous-area controls; drainage and ventilation; inspection and maintenance; emergency response; and human tasks. Consider startup, shutdown, testing and reinstatement as well as normal operation.

Interfaces deserve special attention. A change that is acceptable for one package can create an unexpected demand on a connected utility or collection system. SIMOPS can add ignition sources, restrict access or place another team inside the affected area. In the control room, altered displays, priorities or response steps can change operator workload. The review should involve the disciplines and operational knowledge needed to expose these interactions.

Close the gap between approval and the field

Approval is not the end of management of change. Before startup or use, complete the actions required by the review. Update affected drawings, process-safety information, procedures, alarm or cause-and-effect documentation, inspection tasks and maintenance instructions. Inform and train personnel whose work is affected before they operate or maintain the changed arrangement. Verify in the field that construction and configuration match the approved design.

Temporary changes need an owner, defined validity, visible status and restoration plan. They should be reviewed before expiry rather than allowed to become permanent through familiarity. At handover, communicate what changed, why it remains in place, its limitations, compensating measures, outstanding actions and the conditions requiring escalation or removal. A register entry is useful only when it reflects the actual plant.

Reassess when reality differs from the approved change

Work sometimes reveals that the plant, materials or access differ from the assumptions used in the review. That discovery is itself new information. Stop the affected activity and return the proposal for reassessment through the authorised process. Do not solve an unexpected fit, routing conflict or operational constraint with an undocumented field adjustment.

After implementation, confirm that the change performs as intended and that no new problem has appeared. Capture abnormal behaviour, repeated operator intervention, nuisance alarms, leakage, vibration or maintenance difficulty. Close the change only when required documents, training, inspections and outstanding actions are complete, or when an approved temporary arrangement has been safely removed and the original configuration verified.

Three practical actions for today's shift

First, identify one temporary or recent plant change and confirm that its technical basis, risk review, authorisation, validity period and accountable owner are current. Second, compare the approved documentation with the field configuration and operator understanding; escalate any mismatch. Third, before accepting any apparent replacement in kind, verify that the relevant specification and safety function truly remain unchanged under the site's approved screening process.

Discussion question: Which temporary arrangement on our installation has become so familiar that we may no longer see it as a change—and what evidence shows its risk remains controlled?

This article provides general process-safety learning. All modifications, temporary arrangements, approvals, training and reinstatement must follow the installation's approved management-of-change, operating and escalation procedures.