A Fast Pass for PM Improvement: Don’t Let MOC Block Progress
You spent a month improving the PMs in your area. You have new scope, new Execution References to attach to the work orders, and a list of useless “check pump” tasks to remove that no one has done anyway since you contracted for vibration rounds with visual inspections. You printed the whole package, organized it, walked through it with the lead tech who actually runs that equipment, and he agreed with every line.
Then you tell your boss. Your boss discusses it with the safety and engineering police. After a lot of tutting and wise phrases, they advise you that it needs to go through the Management of Change process. MOC backlog? Six to nine months.
The reason, beyond the excessive conservatism of the bureaucrat, is that every change — a no-brainer PM improvement to introducing a brand-new chemical reaction into the same unit — gets routed through an identical package. Even in plants where PM work does not formally trigger MOC, there is often some other friction: the hand-wringer who wants a series of meetings, slides, and interrogations, at the end of which comes a theatrical nod from the throne and a promise to consider the proposal.
Our approach to risk management manages the wrong risks. It manages bureaucratic risks and risks to the approver — not the true risks operating in the field. Understanding how this happened starts with where the reflex originates. Plants need a Fast Pass lane that focuses deep analysis on the truly novel and enables evidence-backed improvements and corrections to hit the field after a much abbreviated review.
The reflex that feels like rigor
After every incident or near-miss, another approval layer accumulates on top of the last one, and the accumulation feels like safety even as it makes the organization slower to correct what it already knows is wrong. The result is a sclerotic organization that is measurably less safe, and the safety science literature has been saying so for four decades.
Charles Perrow’s argument in Normal Accidents (1984) was that in tightly coupled systems, every new safeguard adds what he called “interactive complexity” — new pathways to failure that did not exist before the safeguard arrived. His demonstration case was the Fermi breeder reactor: a zirconium sheet installed as a safety device broke loose and caused the partial meltdown it was designed to prevent. Perrow also identified a contradiction that no engineering organization has resolved: complex, tightly coupled systems simultaneously demand centralized procedural control (because the cost of freelancing is catastrophic) and decentralized operator judgment (because no procedure anticipates every way equipment finds to fail). Engineering resolves this contradiction the way it resolves most things — in favor of the document.
The deeper problem is that this procedural reflex is itself what enables normalization of deviance, as laid out in Diane Vaughan’s 1996 investigation of the Challenger launch decision. The decision to fly with repeatedly documented O-ring deficiencies and expert warnings of catastrophe was made in complete accordance with bureaucratic process: the Flight Readiness Review, with its elaborate checkpoints and certification layers. Vaughan called it “structural secrecy” — organizational specialization filtered and compressed risk information as it climbed the hierarchy, so the apparatus was simultaneously thorough in form and blind in function. The procedure ran perfectly. The shuttle was lost.
Karl Weick and Kathleen Sutcliffe presented a paradox. “To manage the unexpected is to be reliably mindful, not reliably mindless. Obvious as that may sound, those who invest heavily in plans, standard procedures, protocols, recipes, and routines tend to invest more heavily in mindlessness than in mindfulness."
The more elaborate the system, the more the system itself becomes the object of attention — and the reality it is meant to manage falls into the background.
This is so prevalent, that it has a term: safety clutter. These are the procedures, forms, sign-offs, and roles performed in the name of safety that contribute nothing to it. The word undersells it. Clutter implies inert mass. The reality is worse — the hours spent building, reviewing, and signing the clutter are the same hours that would otherwise go toward solving actual problems.
Erik Hollnagel’s efficiency-thoroughness trade-off explains the mechanism: in operational work, you trade some thoroughness to stay efficient. When all the thoroughness is loaded onto administrative review instead, what gets crowded out is the capacity to fix things. An organization that has spent everything on the paper has nothing left for the equipment.
“Safety first,” in practice, tends to mean the absence of recorded bad outcomes, audited and filed, while the capacity to keep operating safely quietly erodes underneath it.
The reflex toward more analysis fails because the analysis is looking in the wrong place.
FMEA, RCA, HAZOP, and so on – these tools exist to discover what can go wrong. They assume the binding constraint is a knowledge problem: if we understood the failure modes well enough, ranked them precisely enough, we could prevent them. The incidents tell a different story. Texas City, Tesoro Anacortes, Chevron Richmond — none involved failure modes that no study had imagined. They were cases of fully known, fully named damage mechanisms where the analysis had been done, sometimes for decades, and the execution never followed. Between 2002 and 2011, Chevron personnel made at least six internal recommendations to inspect or upgrade the sidecut line that eventually ruptured at Richmond. Every recommendation was technically correct. None was implemented. The analysis was never the gap. The delivery was.
Six recommendations – meaning at least six analytical circles, all coming to naught. Multiply this across the other unexecuted solutions to solved problems at that plant and across the industry… Financialized corporations that will not invest in mitigations are the primary culprits, but the incessant weight of safety and engineering functions that prioritize meticulous analytical exhaustion over actionable priorities is not far behind.
There is a reason the profession keeps reaching for more analysis anyway. Analysis is institutionally safe. It sends everyone home with a binder that feels like progress. I have watched, in plants across the refining and chemical sector, the specific social comfort that settles over a room when RCA or FMEA is underway — the sense that rigor is happening, that responsibility is being exercised. Very few people in those rooms are as comfortable building the operating system that has to interface with the messy, uncooperative world where the equipment actually lives. The analysis produces a document. The document satisfies the audit. The real world continues to drift.
Stop treating correction like invention
The answer is not less governance. A plant with no change control is a plant waiting for someone to freelance a novel hazard into a running unit, and that is a real way to kill people. The answer is to stop pretending that correcting a known-deficient condition and introducing a genuinely new one belong in the same lane.
They are different kinds of work that deserve different pathways. Introducing a new chemical, a new operating envelope, an unproven configuration — that is genuine novelty, and it deserves a full review because the consequences are unknown and the analysis is doing real work. Restoring preventive maintenance actions to standards-backed best practice — that is not invention. The knowledge already exists. The decision was already made, often years ago, by engineers who understood that equipment better than any review board ever will. Routing that correction through the novelty pathway is the bureaucratic manufacture of the exact risk the pathway claims to prevent.
A change-control system that can tell the difference has a bounded, pre-approved express lane for corrections that move equipment toward its already-specified standard — a lane with a low ceiling, clear eligibility criteria, and a fast clock — and reserves the full review for work that is actually novel. The eligibility question is not how nervous the change makes the organization. It is whether the change moves equipment toward a known-good standard or into genuinely unknown territory. One of those is correction. The other is invention, and treating them identically is how organizations end up doing the most dangerous thing on most plants, which is nothing.
Go look at your own deferral register and your own change backlog. Count how many of the items sitting there are not novel hazards at all — just known corrections that cost more in process than anyone could justify in a single afternoon. That number is not your discipline showing. It is the risk your process is quietly holding open, line by line.
The following is a bit long for a reason - it is your roadmap for the MOC Fast Pass.
The Principle: Bounded Pre-Approval
A standard MoC procedure handles each change as a one-off. The procedure exists because changes whose technical basis must be developed, whose hazard implications must be assessed, and whose risk envelope is uncertain require structured review before implementation. That structure includes technical basis development, hazard review through PHA or what-if or HAZOP, risk evaluation, PSI updates, procedure updates, training, multi-level authorization, pre-startup safety review, and documentation closeout. Each element does real work. None of them is theater.
A PM change that converts an existing inspection task from prose to an Execution Reference, that adds quantified acceptance criteria sourced from an API standard, that does not alter the inspection interval recorded in PSI, and that does not change any operating procedure or safe operating limit—is not a novel change. Its technical basis is pre-validated by the standard. Its risk envelope is bounded by the change boundary. The hazard implications are zero or negative; more rigorous detection cannot increase risk.
The express lane is the recognition, in the MoC procedure itself, that this category of change has different requirements. Not lower requirements—different ones. The standard MoC procedure runs each review element on the individual change. The express lane runs the equivalent elements once, on the category, and then handles individual changes against the pre-approved category. The work does not disappear. It gets done once, deliberately, against the standard, instead of repeated against every PM.
Seven elements support the express lane. Each substitutes for the equivalent element in standard MoC. Together they preserve oversight while removing the serial cost that kills PM improvement at most sites.
1. Standards-Based Technical Basis
This is the foundational element. If a recognized standard specifies the task and interval, the technical basis is not site-developed—it is industry-validated through a process the site cannot replicate at any reasonable cost. The site is not inventing a new approach. It is adopting an existing one. The reviewer’s job is to verify the citation is appropriate, not to redo the underlying analysis.
Standards that qualify as pre-validated technical basis include API recommended practices and standards—API 510 for pressure vessel inspection, API 570 for piping inspection, API 653 for tank inspection, API 580 and 581 for risk-based inspection methodology, API 571 for damage mechanisms, API 686 for machinery installation. NFPA standards—NFPA 70B for electrical equipment maintenance, reclassified from a Recommended Practice to a Standard in 2023, NFPA 25 for water-based fire protection, NFPA 72 for fire alarm and signaling. IEC and ISO standards—IEC 61511 for safety instrumented systems, ISO 20816 for vibration measurement, ISO 4406 for oil cleanliness, ISO 21940 for rotor balance. EPRI templates, particularly the nuclear-derived PM templates that have been validated through decades of fleet experience and adapted to non-nuclear use. NETA Maintenance Testing Specifications for electrical equipment. Manufacturer recommendations when documented in OEM service manuals and applicable to the equipment in service.
The express lane requires the change request to cite the specific standard, edition, and section that supports the task or interval. It is not enough to cite “API.” The citation reads “API 570, 5th edition, Section 6.3” or “NFPA 70B-2023, Chapter 21, Section 21.4.” The technical basis review then becomes a reading of the citation against the proposed change, not a development of new analysis. The PSM or EHS reviewer verifies that the citation is appropriate to the equipment in service, that the standard is current edition, and that the change does not deviate from the standard’s recommendation. The reviewer does not redo the underlying technical work. The standards body did that work, with peer review and industry consensus, and it is not the site’s job to second-guess it.
Where the site’s practice deviates from the standard—for example, an interval shorter than the standard minimum because of local operating conditions—the deviation is documented in the technical basis library with the engineering rationale. Deviations toward more conservative practice are normally acceptable for the express lane. Deviations toward less conservative practice exit to full MoC.
What this replaces in standard MoC: technical basis development from first principles, peer review of analysis, defense of methodology against alternatives.
2. Bounded Change Envelope
Standard MoC reviews the change envelope as part of hazard review—what does the change touch, what is the risk implication of touching those things. The express lane requires the change to be pre-bounded. It must fall entirely within categories the site has already determined do not require de novo hazard review.
The express lane boundary, negotiated once with PSM and EHS:
The change does not alter equipment design, configuration, or materials of construction. The PM is performed on equipment that exists in its current configuration; the PM scope can change, the equipment cannot.
The change does not alter process chemistry, operating conditions, or safe operating limits. The PM detects what it detects within the existing process envelope.
The change does not modify setpoints, alarms, interlocks, or SIF configurations. Anything that touches a safety function exits the express lane regardless of how minor the change appears.
The change does not modify any inspection or test interval recorded in Process Safety Information. Most sites do not have PSI that names every PM, but the ones that are referenced—SIS proof-test intervals, code-required inspection intervals—are out of bounds for the express lane.
The change does not modify any operating procedure, including operator rounds, startup, and shutdown sequences. These have a parallel governance path that may have its own express lane on the operations side, with its own boundary.
The change does not introduce a new chemical, fluid, or material to the equipment. Lubricant changes, cleaning agent changes, and material substitutions exit the express lane.
If any boundary item is touched, the change exits the express lane and enters standard MoC. The boundary is the gating mechanism. The site negotiates the boundary once, in writing, with PSM and EHS, and then it operates as the entry filter for every individual change. The planner is trained on the boundary. When the planner is uncertain whether a change crosses the boundary, the default is to send it to full MoC, not to assume the express lane applies. Conservative routing on edge cases is what protects the express lane’s credibility.
What this replaces in standard MoC: full PHA or HAZOP for changes that fall within bounded envelope.
3. Improvement Classification
Most MoC procedures already distinguish “replacement in kind” from “significant change.” Replacements in kind—a worn valve replaced with an identical valve, a failed pump replaced with a same-model pump—do not require full MoC because by definition they do not alter the risk envelope. The express lane extends this concept to a category MoC procedures rarely name explicitly: improvement.
A PM change that adds detection capability—more rigorous criteria, additional measurement points, conditional actions tied to limit excursions—is, by construction, an improvement. It cannot increase the risk envelope of the existing PM. It can only improve detection within that envelope. A PM change that adds findings capture—structured recording where prose recording previously existed—is an improvement. A PM change that adds clinical context—failure history, equipment-specific guidance, asset-specific acceptance criteria—is an improvement. A PM change that maintains or shortens an existing interval is, in the conservative direction, an improvement.
The express lane recognizes “improvement” as a risk classification equivalent to “replacement in kind” for a specific purpose: changes whose direction is monotonically toward reduced risk do not require de novo risk evaluation. The pre-startup safety review for an improvement-classified change becomes a verification that the improvement was implemented as designed, not a new risk evaluation. The reviewer confirms that the new acceptance criteria are tighter than or equal to the previous criteria, that the conditional actions were correctly added, that the recording format captures what the original PM captured plus what the improvement adds.
The asymmetry matters. An “improvement” that loosens a criterion, extends an interval, or removes a verification point is not an improvement in this sense and does not qualify for the express lane. Direction is part of the classification. Loosening goes through full MoC.
What this replaces in standard MoC: full risk evaluation for changes whose direction is monotonically toward reduced risk.
4. Pre-Approved Change Categories
Rather than approving each PM change individually, the express lane approves categories of change. Each category is approved once, by the standing MoC review team, with PSM and EHS sign-off. Individual changes within an approved category receive expedited handling.
Suggested starter categories, in approximate order of how easy they are to negotiate with PSM and EHS:
Conversion of existing PM to Execution Reference format. Adding acceptance criteria, conditional actions, structured findings recording, and failure-history headers to an existing PM, with no change to scope or interval. This is the foundational category for any site implementing the framework in this book.
Adding a non-intrusive inspection task to an existing PM. Visual checks, vibration measurements, infrared scans, ultrasonic measurements, oil samples, where the equipment is already accessible during the existing PM and the addition is supported by API 580/581, an EPRI template, or OEM recommendation.
Adding a measurement point with quantified acceptance criterion to an existing inspection task. Replacing “check coupling” with “measure coupling alignment, accept if within 0.002 inches per inch” where the criterion is sourced from a standard or OEM specification.
Shortening a PM interval. Risk-reducing direction. Requires affected workforce communication and CMMS update but does not alter the underlying technical envelope.
Retiring a PM task that produces no findings. Where elimination is supported by a documented period of execution data showing zero findings, plus engineering judgment that the failure mode is detected by other means or does not apply to the equipment in service. This category is harder to negotiate because removal has a different risk character than addition; some sites will decline to include it in the express lane and require full MoC for any task elimination. Accept that.
Each category has a documented technical basis (standards cited, hazard envelope defined, PSSR requirements specified) approved once. Individual changes cite the category, cite the standard within the category, and ride on the category’s pre-approval. The MoC log reflects each individual change. The risk review reflects the category approval.
New categories can be added over time. The site builds credibility with the first category, demonstrates that the boundary holds and the register reads cleanly, and proposes additional categories at annual recertification. Starting narrow and expanding works. Starting broad and contracting after a problem is much harder.
What this replaces in standard MoC: serial review of individual changes when the change pattern is repetitive.
5. Bundled Authorization with Periodic Register Review
Standard MoC requires multi-level signoff on each change—engineering, operations, EHS, sometimes regulatory. The express lane runs authorization differently, in two layers.
The first layer is per-change authorization, limited to the planner and the responsible engineer. For maintenance-side PM changes, the responsible engineer is the reliability engineer for the equipment class. The planner verifies that the change fits the category, cites the standard, and stays within the envelope. The reliability engineer verifies the technical correctness of the change against the standard. Two signatures, both technical roles, no escalation required for changes that fit the category.
The second layer is periodic aggregate review by the standing MoC team. Quarterly is typical; monthly works for sites with high change volume. The MoC team—maintenance leadership, reliability, EHS, operations—reads the express-lane register: every change made in the period, every category cited, every standard referenced. The team verifies the boundary held, that the category was correctly applied, and that no change should have exited to full MoC. Issues are raised, corrected, and used to refine the boundary or the category definitions for the next period.
This produces equivalent oversight to per-change MoC review, applied at the aggregate level rather than the individual level. The PSM and EHS functions read the register, not the individual changes. The aggregate read is faster, more pattern-aware, and produces better governance feedback than the serial read because patterns across changes become visible.
Annual recertification closes the loop. The express lane itself is recertified annually by the same authority that approved it originally. Categories are reviewed for continued appropriateness. New categories are added or existing ones retired based on the year’s experience. The boundary is reviewed. Off-ramp criteria are refined. The technical basis library is audited for currency.
What this replaces in standard MoC: per-change multi-level signoff when the changes fall within pre-approved categories.
6. Documented Technical Basis Library
The express lane requires a maintained library of source documents that support the technical basis for each category and each PM strategy. Without the library, the citation in the change request points to nothing the reviewer can read. With the library, the citation points to the specific section of the specific edition of the specific standard that supports the change.
The library includes the standards cited as technical basis, in current edition, with controlled access—the site holds a license, the planner can pull the relevant section, the reviewer can verify the citation. It includes the OEM documentation that supports manufacturer-recommended practices for installed equipment. It includes the EPRI templates or industry equivalents that the site has adapted to its specific equipment. It includes the site’s deviation log—where local practice differs from the standard, the documented reason and the engineering authority behind the deviation. It includes the category approval documents themselves, so a reviewer or auditor can trace any individual change back through its category to the original PSM and EHS approval.
The library is owned. Typically by the reliability engineering function, sometimes jointly with the maintenance engineering or technical service function. Ownership means a named individual is responsible for keeping the library current, processing standards updates when new editions are published, retiring obsolete content, and answering questions about citations.
The library is the audit trail. When the regulator asks why a PM is done this way, the answer is in the library. When an investigation following an incident reaches the maintenance program, the technical basis defense is in the library. When the next site in the company adopts the program, the library transfers. Without the library, every defense is reconstructed from memory under pressure. With the library, the defense is the documentation that already existed.
What this replaces in standard MoC: case-by-case technical basis defense, ad hoc construction of audit trails, the institutional memory problem when key people retire or transfer.
7. Defined Off-Ramp Criteria
The express lane works only if the boundary is defended. A change that should have gone through full MoC but rode the express lane is the failure mode that destroys the express lane’s credibility, ends the program, and damages the relationship with PSM and EHS for the next attempt. The off-ramp criteria are the integrity mechanism. They are the reason everything else can work.
The off-ramp criteria are stated explicitly, posted in the planning area, included in planner training, and enforced at the entry point to the express lane. A change that meets any of the following criteria does not enter the express lane regardless of how minor it appears or how much faster the express lane would be:
Any change that touches the bounded envelope items from Element 2. Design, materials, process conditions, SOLs, setpoints, alarms, interlocks, SIF, PSI-recorded intervals, operating procedures, new chemicals or fluids.
Any change to a SIS proof-test, regardless of how minor. Proof-test interval, scope, method, coverage. The SIS lifecycle has its own governance under IEC 61511 that the express lane does not substitute for.
Any change to a code-required inspection interval. API 510, 570, 653, NBIC, jurisdictional inspection requirements. These are governed by external authorities and the site’s inspection program, not by the maintenance program.
Any change to a PM interval recorded in PSI. If the interval is on the list, the change goes through PSI update procedure, which is full MoC.
Any change to an operating procedure or operator checklist. Operator rounds, startup, shutdown, abnormal-event response. These have separate governance regardless of express-lane availability for maintenance-side changes.
Any change that introduces a new failure mode to the equipment. A new chemical cleaning step, a new disassembly procedure, a new test that loads the equipment differently than the existing PM does.
Any change without a clear technical basis citation. If the planner cannot cite a standard, OEM document, or EPRI template that supports the change, the change does not qualify for the express lane regardless of category. It goes to full MoC where the technical basis can be developed under proper review.
The planner is trained on these criteria as part of the express lane onboarding. The criteria are referenced in the change request form. When the planner is uncertain whether a criterion applies, the default is full MoC, not express lane. Erring conservative on edge cases is what allows the express lane to be expansive on the clear cases.
What this replaces in standard MoC: nothing. This is what makes everything else legitimate.
Negotiating the Express Lane with PSM and EHS
The express lane requires the active support of the PSM and EHS functions that own the MoC procedure. This is not optional. The technique that fails is the maintenance organization trying to add the express lane unilaterally and running into PSM and EHS opposition the first time a change is questioned. The technique that works is maintenance and reliability proposing the express lane to PSM and EHS as a structured improvement to the MoC procedure, with the integrity mechanisms above as the basis for support.
What to bring to the conversation: the specific categories of change being proposed for express lane handling, the standards that pre-validate the technical basis for each category, the bounded envelope that defines the express lane boundary, the off-ramp criteria that protect the boundary, the aggregate review cadence and recertification cycle, the library structure and proposed ownership.
What to expect: initial skepticism, particularly from PSM functions that have been burned by past attempts to bypass MoC. Requests to start with a narrower category and expand later—accept this; the credibility built by a clean first year supports later expansion. Requirements to align the express lane with site procedures for change classification, particularly the “replacement in kind” definition that already exists in most procedures. Requests for a trial period or pilot before the express lane is added permanently to the MoC procedure document.
The right framing for the conversation is not “we want a faster path for our changes.” It is “we want to preserve the credibility of the MoC procedure by routing changes appropriately. The current procedure forces every PM change through a path designed for design changes. That path is degrading at both ends—PM improvements are not happening, and the MoC queue is congested with changes that do not need its rigor. The express lane reserves MoC’s cost for the changes that genuinely require it.” That framing positions the proposal correctly. PSM and EHS are not gatekeepers being asked to lower their standards. They are owners of a procedure being asked to improve its routing.
The output is a documented amendment to the MoC procedure. The express lane is not a workaround. It is a recognized path within the procedure, sanctioned by the same authority that sanctions the full path, with the same documentation requirements, the same audit posture, and the same governance structure. It just runs at a different scope.
