Nothing Changed, Except Everything

Risk assessments are written for a plant as it was on the day somebody walked round it. Plants do not stay that way. A pump is replaced with a slightly different model, a chemical comes from a new supplier, a crew moves to twelve-hour shifts, a temporary bypass is fitted during a breakdown and is still there two years later. Each change is small, sensible and locally correct. None of them triggers a review, because no procedure says they should.

The changes that go unassessed

• Like-for-like that is not. A replacement part with the same function and a different material, pressure rating or response time.
• Supplier substitution. The same product name, a different formulation, and a safety data sheet nobody re-read.
• Organisational change. A shift pattern, a reduced night crew, or the retirement of the one person who understood a system.
• Temporary becoming permanent. The bypass, the jumper, the propped door, the hose instead of the pipe.
• Cumulative change. Ten alterations, none significant alone, that together mean the assessment describes a facility that no longer exists.

What a workable procedure looks like

Management of change fails when it is heavy. If every alteration needs a committee, people stop declaring changes rather than stop making them, and you lose the visibility the procedure existed to create. A usable version is short: who may authorise what, three or four questions on a single page, and a deadline for closing temporary measures.

The questions are always versions of the same ones. What is different? What could that affect — including things not obviously connected? Who needs to know and be retrained? When does this expire, and who closes it?

The expiry date is the control

Most temporary measures are safe for their intended duration and dangerous for the one they actually get. Giving every temporary arrangement a review date, and a named owner, is the single highest-return part of the procedure — and the part most often left out.