Management of change at a major hazard facility

Transcription

1 Guidance Note Management of change at a major hazard facility Advice for operators of major hazard facilities on management of change. March Introduction Why is management of change needed? Features of successful management 2 of change 1.3. Core concepts Key definitions 3 2. Planning and preparation Who should be involved in 3 reviewing a change? 2.2. Greenfield MHF/modification of existing 4 DG site to MHF 3. Essential elements of a management 4 of change system 3.1. What is change? How can changes be identified? Managing urgent changes Factors to consider when reviewing 6 a proposed change 3.5. Approving or rejecting a proposed change Implementing a proposed change Documenting the change Managing the documents Managing the quality of the change Temporary changes Review and feedback 8 4. Compliance with regulations Overlap with DG S&H Regulations Compliance and verification 9 5. Review and revision 9 6. Compliance checklist Further reading 10 1 Introduction The major hazard facility parts of the Occupational Health and Safety Regulations 2007 (OHS Regulations) set out legal duties for control of risks from operating a major hazard facility (MHF). They apply to the operator of a facility who is the employer with management or control of the facility. To obtain a licence to operate an MHF in Victoria, MHF operators are required to submit a Safety Case which sets out how the facility will be operated safely. This guidance note will assist operators with the management of change (MOC) process which is a key element of the Safety Management System (SMS) and thus an important part of the Safety Case. The MOC process needs to be consistent with specific Requirements of both the MHF parts of the OHS Regulations and the Dangerous Goods (Storage and Handling) Regulations 2000 (DG S&H Regulations) Why is management of change needed? Failure to properly manage changes to an MHF can significantly increase the risk of major incidents. This is indicated by disasters such as: Flixborough, England, June A release and explosion of cyclohexane occurred at a caprolactam production plant. Twenty-eight workers were killed and 36 injured. Hundreds of people off-site were injured, 53 sufficiently seriously to be recorded as casualties. About GUI0138/01/02.11

2 2000 residential and commercial properties were damaged over a wide area. An inquiry concluded that the disaster was caused by the introduction into a well designed and constructed plant of a modification which destroyed its integrity, specifically that temporary piping to bypass a reactor vessel had been inadequately designed, manufactured and supported. A contributing factor was that the plant management had undergone substantial change, with the result that suitable people were not available to assess engineering changes as they were being proposed. Bhopal, India, December A runaway reaction between water and methyl-isocyanate (MIC) in a storage tank at an MIC derivatives plant resulted in a release to the atmosphere of several tonnes of highly toxic methyl-isocyanate. The precise numbers of dead and injured are unknown but fatalities numbered at least The cause of the incident appears to have been water entering via a jumper line that had been installed without following the company s MOC process. In addition, certain protective systems that could have limited the consequences of the incident had been disabled; proper MOC should have identified the hazards associated with this. Finally, the high number of fatalities was in part due to uncontrolled growth of population surrounding the facility. A clear benefit of formal, robust MOC is that it ensures potential new or changed hazards are identified and dealt with before they arise Features of successful management of change The following factors are critical to successful MOC and are used in WorkSafe s reviews of MOC processes at sites: change is properly defined in the context of the specific facility the definition includes all relevant types of change; physical, operational, procedural, organisational etc all changes are reviewed and assessed before being implemented reviews are based on auditable criteria, triggering detailed assessments as necessary assessments and reviews are conducted by suitably knowledgeable and experienced people detailed assessment includes identification of hazards and assessment of safety assessments and reviews are properly recorded. Decisions are transparent and formally accepted each change is checked for compliance with regulations, codes and standards and to ensure adequate systems are in place for continuing compliance (verification activities) control measures are altered in line with changes to ensure risks remain reduced so far as is reasonably practicable maintenance, performance indicators and performance standards are established and monitoring and corrective actions are implemented for all control measures altered/implemented as a result of the change the process allows for consultation with employees and other affected workers and, where appropriate, the emergency services quality assurance and quality control processes are applied throughout each change project knock-on changes to drawings, procedures, work instructions, the Safety Case etc are fully implemented necessary instruction and training in the change takes place changes are reviewed after implementation to ensure that the control measures perform as intended and there is an improvement loop the change management system is monitored and reviewed to an established schedule processes exist for rectifying any deficiencies noted during monitoring and review there is routine monitoring for incremental, unintentional and external changes there is routine monitoring of temporary changes to ensure timely reversal Core concepts Proper MOC is critical to control of safety at facilities storing and handling large quantities of dangerous goods or other hazardous materials. While the DG S&H Regulations and the MHF regulations require the operator to manage their own changes, WorkSafe may audit, comment on, or require improvement to the operator s MOC process. The operator is required to assess the hazards and risks of each change, and to ensure that control measures will eliminate risk or (if not practicable to eliminate) will reduce risk so far as is reasonably practicable. Under the DG S&H Regulations, these requirements encompass alterations to premises, plant, processes and systems of work associated with dangerous goods. Under the MHF regulations they encompass alterations to plant, processes, substances used, quantities of Schedule 9 materials and the SMS. There is little difference between the requirements of the two sets of regulations. If the operator satisfies the requirements of the MHF regulations, it is likely they will also comply with the DG (S&H) Regulations. 2

3 1.4. Key definitions Control measure (control): Any system, procedure, process, device or other means of eliminating, preventing, reducing or mitigating the risk of major incidents arising at an MHF. Control measures are the means by which the risk to health, safety and property is eliminated or minimised the risk to health, safety and property associated with the major incidents and therefore the MHF. Controls can take many forms, including physical equipment, process control systems, management processes, operating or maintenance procedures, the emergency plan, and key personnel and their actions. Hazard (related to an MHF): Any activity, procedure, plant, process, substance, situation or any other circumstance that could cause, or contribute to causing, a major incident. Hazard identification (related to an MHF): The process of identifying hazards as described in the WorkSafe guidance note Hazard identification. Major incident (related to an MHF): An uncontrolled incident, including an emission, loss of containment, escape, fire, explosion or release of energy, that (a) involves Schedule 9 materials; and (b) poses a serious and immediate risk to health and safety. Modification (related to an MHF): Reg of the OHS Regulations related to MHF defines this as including: (a) a change to any plant, processes or substances used in processes, including the introduction of new plant, processes or substances (b) a change to the quantity of Schedule 9 materials present, including the introduction of any new Schedule 9 materials (c) a change in the safety role of employees (d) a change to the Safety Management System that has the effect of (e) creating a major incident hazard that has not previously been identified or (f) increasing the likelihood of a major incident occurring or (g) in relation to any major incident that might occur, increasing (i) its magnitude or (ii) the severity of its consequences to persons both on-site and off-site. Safety Assessment: The Safety Assessment process is consistent with international risk assessment standards, including the risk assessment process described within AS/NZS ISO Risk management. It involves an investigation and analysis of the major incident hazards and major incidents so as to provide the operator with a detailed understanding of all aspects of risk to health and safety associated with major incidents, including (a) the nature of each hazard and major incident; (b) the likelihood of each hazard causing a major incident; (c) in the event of a major incident occurring (i) its magnitude; and (ii) the severity of its consequences to persons both on-site and off-site; (d) the range of control measures considered. So far as is reasonably practicable: To reduce a risk to a level so far as is reasonably practicable involves balancing reduction in risk against the time, trouble, difficulty and cost of achieving it. This requires consideration of: (a) the likelihood of the hazard or risk concerned eventuating; (b) the degree of harm that would result if the hazard or risk eventuated; (c) what the person concerned knows, or ought reasonably to know, about the hazard or risk and any ways of eliminating or reducing the hazard or risk; (d) the availability and suitability of ways to eliminate or reduce the hazard or risk; and (e) the cost of eliminating or reducing the hazard or risk. More information on key terms is found in other MHF guidance available from the WorkSafe website and in the definitions of the OHS Regulations (reg 1.1.5). 2. Planning and preparation 2.1. Who should be involved in reviewing a change? There are requirements under the OHS Act to consult with the workforce prior to making any change to the workplace. In addition, both the DG S&H Regulations and the MHF regulations include specific Requirements to involve workers (including contractors) and to consult with their health and safety representatives (HSR) in identification of hazards and assessment of safety. Therefore workers, contractors and their HSR must be involved in the MOC process. 3

4 Representatives of all relevant and affected groups (workers and where appropriate, emergency services) should be involved in the review of all significant proposed changes. The persons who should be involved may vary from case to case but, in general, should include representatives of the safety, operations, maintenance and engineering departments. Prior to this, there may be merit in using a committee or oversight process to ensure that each change is briefly reviewed as it is proposed. This initial review would determine, via a formally established rule-set, whether there is a need for more detailed review and would identify the persons who should be involved and/or consulted. Reviews of proposed changes should involve personnel with seniority reflecting the scale of the change project and the level of the associated hazard and risk. It is essential that the reviewers have adequate knowledge, skills and experience to be able to identify all hazards associated with a proposed change and to consider them thoroughly. It should also be noted that both the DG (S&H) Regulations and MHF regulations require consultation with the emergency services in the event that the proposed change requires a revision to the fire protection systems or emergency plan at the facility Greenfield MHF/modification of existing DG site to MHF A greenfield site must develop and implement an MOC process as required by the MHF regulations. MHFs may require more robust change management than other DG sites due to the potential for major incidents. Operators of existing large DG sites, which are increasing quantities of Schedule 9 materials and will therefore become MHFs, should critically review their existing processes, and make all practicable improvements. The number of major incidents at facilities around the world caused or contributed to by MOC processes, or deficiencies in them, means that WorkSafe often includes MOC as a topic in verification for licence assessment or annual inspection. 3. Essential elements of a management of change system This section includes information on what is considered good practice for MOC at MHFs What is change? The definition of change for the purpose of the MHF regulations includes anything having potential to alter hazards or the level of risk at the facility. This is not limited to physical changes and includes changes to management systems, procedures, organisational structure and personnel. The major incidents at Flixborough and Bhopal bear this out, as they involved physical changes to process plant, changes to management organisation, disabling of safety systems and uncontrolled residential construction in surrounding areas. The table below provides examples of the range of circumstances that may be considered a change in this context and may therefore require management. Examples of changes that may need formal management Introduction of new dangerous goods or other hazardous materials. Re-introduction of particular dangerous goods or hazardous materials after a period of absence. Alteration of the activities performed (eg the chemical process technology) involving these materials. Increase in the quantity of dangerous goods or hazardous materials held on-site. Addition of new processes, buildings, plant and equipment. Changes in the design and construction of existing processes, buildings, plant and equipment. Introduction of temporary processes, buildings, plant or equipment. Increase or decrease in throughput of the facility. Temporary or permanent shutdown of the facility or a section of it. Re-start of the facility, or a section of it, after an extended period shut-down. Changes to the codes and standards applying to the facility. Changes to available knowledge of technical and operational safety issues. Changes to the content of management, operating, maintenance, engineering or emergency procedures. Variances from established management, operating, maintenance, engineering or emergency procedures. Changes to the frequency or nature of safety-critical activities (eg maintenance). Changes to the suppliers of spare parts, consumables. Changes to organisational structure, such as de-manning, out-sourcing, or relocation of personnel. Redefinition of the roles and responsibilities of safety-critical personnel. Changes to the persons filling safety-critical positions. Introduction of a new contractor group. 4

5 Reconfiguration or reprogramming of control and monitoring systems. Alteration to the range of an instrument transmitter. Changes to the set-points of alarm, shutdown systems, safety/relief valves etc. Redefinition of the facility s critical operating parameters (COPs) (see the guidance note Control measures). Bypassing or defeating of control measure (eg shutdown valves). Changes to land use around the facility. Changes to other facilities nearby or connected by pipeline or other means. Operators should develop a comprehensive definition of what is considered a change in the context of their MHF and develop the change management processes based on this definition. Any proposed activity should then be compared to the definition, to determine whether the proposal is a change that will require management under the defined processes. A clear description of the proposed change should also be documented. For example, alterations in storage tank level should not need formalised control but should be administered under operating procedures. However, storage of a product that has not been held in that tank previously/recently would need to be controlled as a change. In addition, changes to the relevant operating procedure would require formal control, as would any changes to high/low level alarm points, COPs and trip settings, if outside of previously agreed ranges. Depending on the nature of the facility, and on the overall structure of the operator s organisation and management system, it may be necessary to control different types of changes through slightly differing processes. For example, changes might be grouped as follows: changes to DG and other hazardous materials in storage and use changes to regulations, codes and standards or to technical or operational safety knowledge changes to engineering design, process technology or process operations changes to organisational structure, staffing, or personnel roles and responsibilities changes to procedures or variances from established procedures changes to control and shutdown systems software temporary bypass or defeating of alarm and trip systems abnormal operations. However, this would need careful consideration to ensure a consistently robust approach and to ensure that all necessary persons were involved in reviewing each type of change. Some MHFs have found it useful to appoint one suitably experienced and qualified person to review all change proposals to determine the level of further review and analysis required Like for like replacement Replacement of equipment by an identical item ( like for like replacement) may not need to be considered a change in this context. However, the operator should carefully define what is considered like for like replacement, as equipment of similar configuration may have a different detailed specification (eg a new model of pump may have a higher discharge pressure). This aspect of the MOC process should be reviewed regularly How can changes be identified? It is important to prevent informal changes from occurring, either individually or in aggregation. Unless all changes are formally identified as such, they cannot be properly controlled. Changes originating within the facility or the operator s organisation can be addressed by requiring all proposed changes to be formally requested, via a standard procedure and form. New people can be introduced to the procedure and form at the time of induction, and subsequently trained in the process. It is necessary to ensure that workers understand the basis for the facility s design and safe operation so that they are capable of recognising a relevant change, for this process to work. It is also important that personnel are alert for and have systems in place to ensure that incremental change doesn t occur. It may be more difficult to identify changes external to the facility as this will require either that third parties reliably notify the operator of all relevant changes or that the operator periodically requests the necessary information. The possibility of some types of external change may be minimised, but not necessarily eliminated, by suitable contractual arrangements. Examples of external changes that may affect hazards and risks at the facility include: alteration to the quality of a feedstock, including trace materials change in truck drivers used to deliver feedstock change in capacity of transfer pumps at an upstream plant changes to the location, manning or resourcing of the local emergency services changes to the capacity or reliability of the town water supply or grid electricity supply 5

6 construction of new residences or creation of other sensitive land uses near to the facility addition of plant or other changes to the risk profile of an adjacent facility changes to emergency response arrangements at an adjacent facility Managing urgent changes There may be a requirement from time to time to make urgent changes, eg to prevent a major incident from occurring or to prevent serious loss of production or serious loss of product quality. In such cases it may be undesirable to delay the change for official review and assessment. However, the change should still be reviewed and assessed as soon as possible after implementation and only then formally adopted. In fact, the change should be reviewed and assessed even if it has already been reversed. This is because the change may have had potentially undesirable outcomes, and it is necessary to identify a better solution to any such emergency that may arise in the future. Operators need to carefully consider the parameters controlling what changes can be allowed and how this can be built into the MOC process, eg what changes can be made on the run and what changes will require a shutdown. There may be benefit in linking the MOC process with the permit-to-work system. Persons administering the permit-to-work system could then check with the MOC system records, to confirm that work requests only relate to changes that have been properly assessed and duly authorised Factors to consider when reviewing a proposed change Where there is a potential for a change to alter the hazards and risks at a facility, the MOC process should trigger review of the hazards, risk and control measures, as well as any engineering or other reviews. The decision to instigate or not instigate such reviews should be taken by a senior person or persons, and sign-off should be required of all decisions. The decision should be based on auditable criteria, such as whether the change would affect a piping and instrumentation diagram (P&ID), in which case a Hazard and Operability (HAZOP) study or the like may be required. Specific factors to be considered in the reviews should include: Has risk associated with the storage and handling of dangerous goods been eliminated or (if it is not practicable to eliminate risk) reduced so far as is reasonably practicable? Is the change necessary, or can an alternative be found that does not introduce new hazards or does not increase the risk of existing hazards or results in a lesser risk increase? Is the proposed change in compliance with the applicable regulations, codes and standards? What measures/systems will be required to ensure continued compliance? What specifically are the new hazards that are introduced? What is the increase in risk? What control measures are required? What changes to the SMS are necessary (procedures, personnel, organisation etc)? What changes are necessary to notifications, licences or the Safety Case? What changes are necessary to drawings, procedures and to other documentation? What are the construction issues for new buildings, plant and equipment? What are the new maintenance requirements and are there operability issues? What are the new maintenance eg inspection and test requirements? Does the holding of spares and consumables need to change? What additional or changed education and training is necessary? The reviews should consider not only the change in itself, but also the impact the change may have on other areas, processes, plant, equipment, people and procedures. The format for the review should reflect the nature of the facility, the nature and severity of its hazards and risks, and the nature of the proposed change in relation to the hazards and risks. For example, a change to chemical process plant that requires alteration to P&IDs would typically be subject to a HAZOP study, amongst other reviews. Likewise, a change to a feedstock of a chemical process plant would also be subject to a HAZOP study. However, HAZOP would probably not be useful as a means of reviewing changes to drum storage of dangerous goods at the same facility. Other methods may be more appropriate in such cases, eg What if? Studies. For consistency, the operator may consider using the same processes for review of hazards and risks as part of managing changes, as they do for input to the Safety Case. Records of the reviews should be kept, including records of any hazard identification and safety/risk assessment. 6

7 3.5. Approving or rejecting a proposed change There should be formal criteria for accepting or rejecting change which should include consideration of hazard and risk, as well as any impact on production rates, quality, costs etc. Safety criteria could be based on risk assessment using a risk matrix method, for example, or on quantitative risk criteria. Such criteria should be consistent with the regulatory requirement to eliminate risk or reduce it so far as is reasonably practicable, and also consistent with any criteria being used in development of the Safety Case for the facility. Decisions should be transparent and should be agreed and signed for at an appropriate senior level in the organisation. In no case should the decision process allow acceptance of any change that violates the fundamental duties on the operator under the OHS and DG Acts. Some MHFs have found forms or checklists useful to identify follow up activities after a change has been approved. This also enables closeout of actions with the associated paperwork. There should be a feedback mechanism to inform the personnel who raised the initial change request, or the issue that led to the change, of the action that will be taken Implementing a proposed change Necessary changes to documentation and drawings should be drafted before any change is implemented ie before equipment is installed or person starts in a role. This may include changes to process drawings, process descriptions, safeguarding memoranda etc and also changes to the hazard identification, Safety Assessment, SMS, emergency plan and Safety Case as necessary. The drafted changes can be agreed and signed and then introduced concurrently with the change itself being made. All personnel affected by the change should be provided with training in respect of the change. Sufficient people should be trained in advance of commissioning the change to ensure safe initial operations. Any remaining training should follow immediately after the change. This minimises the potential for confusion between the status of the facility and the status of training whilst ensuring there are always people available who have been appropriately trained eg training in emergency shutdown needs to cover operation of the newly installed plant. Prior to commissioning, a check should be made that the change has been implemented as intended. Normal commissioning checks should also be carried out, including checks that all actions arising from safety, operability and other reviews have been satisfactorily closed-out. In addition, checks should be made that the control measures meet their required performance. Compliance with legislation, the design intent, and actions arising during the change project, should all be formally signed-off. Where changes are cancelled or reversed, it will be necessary also to cancel or reverse changes to procedures and the SMS. People trained in the change should be formally notified that the change is to be cancelled/ reversed. Reversing a change may need to be treated as a change in itself Documenting the change A log of changes should be maintained, and detailed records kept of each change, including any that have been reversed. The records should include at least the following information: the reason for proposing the change records of all reviews and assessments of the proposed change records of who authorised the change and when records of changes made to the change and the approval of these records of any pre-commissioning checks with formal sign-off clear records of when the change was commissioned, ie finally made clear records of when the change was reversed (if applicable) before and after copies of all affected drawings and documentation. It is also appropriate to retain records of changes that were proposed but did not proceed. This may be used to assist in management of future proposed changes. Where such proposed changes relate to hazard and risk control measures, this information may be useful in support of the demonstration of adequacy that is required under the MHF regulations Managing the documents A related issue is document control of engineering drawings, operating and maintenance procedures, the SMS and the Safety Case etc. As changes are made to these documents, it is important that either all superseded versions are withdrawn from use, or all controlled versions are updated, whilst all other versions are marked as not controlled. Operators should be aware of legal requirements related to retention of records. 7

8 3.9. Managing the quality of the change There is a link between MOC and management of quality. If the change that has been implemented is not what was intended and/or is not what was reviewed, then the agreed acceptability of the change, or the agreed control measures, may be invalid. In such cases the quality of the MOC project has been deficient. Reviews of such projects should include an investigation of why the change process failed (eg was the technical governance process inadequate to prevent a recurrence?). Therefore quality management principles should be robustly applied to all changes, whether engineered, written, operational or organisational. Further, many MOC forms are poorly completed by front-line supervisors/engineers. Organisations need to conduct regular comprehensive quality assurance/ quality control audits of their activities under their own MOC processes Temporary changes Examples of temporary changes include: bypassing of alarms where these have failed, or where their alarm settings are being exceeded frequently during an extended period of abnormal operations installation of temporary equipment, such as a portable generator or pump being used whilst permanent equipment is being maintained or repaired. Temporary changes require management just as much as permanent changes, even though it may be possible to accept lower levels of engineered control measures for short term changes than for long term changes, provided additional controls are enacted (ie the change is closely monitored). The MOC system should carefully distinguish between permanent and temporary changes and should have checks in place to prevent changes becoming permanent without thorough review when those changes were intended only to be temporary. There should be limits to the allowable duration that a temporary change may be in place, as some temporary changes may increase risks in the longer term. Consideration should be given to how best to record the nature of temporary changes in drawings, manuals and procedures etc. For short term changes document updates may be unnecessary but formal document update may be required for changes that exist for extended periods Review and feedback There will be benefit in reviewing changes after implementation. This is an important part of the process of continual improvement. Questions that may be asked during such reviews include: Has the change proceeded as originally intended or has the change itself changed? If so, the implications for safety will not be completely understood and the hazard identification, Safety Assessment and control measures should be reviewed again. Did any unexpected hazards arise during implementation of the change? If so, these hazards should be assessed, their nature and possible implications recorded, and the information communicated to people who need to know and who are able to take action to rectify the situation and prevent repetition. Has the change achieved the desired effect? If not, and there are new hazards introduced or risk has increased, then consideration should be given to reversing the change. 4. Compliance with regulations 4.1. Overlap with DG S&H Regulations The MHF regulations require the operator of an MHF to have a system in place for planning modifications to the facility and to includes a description of this within the SMS (Schedule 10, item 5). Under the MHF regulations, the phrase plant, processes or substances used or the SMS includes a wide range of types of change. These may include: the type or quantity of dangerous goods; the activities performed involving or potentially impacting those goods; related buildings, plant or equipment; operational or maintenance procedures; control, alarm or trip system software or calibration; the organisational structure or staffing; or individual s roles and responsibilities. The DG S&H Regulations prohibit use of new premises, plant, processes and systems of work until hazards have been identified, risks assessed and adequate control measures put in place to eliminate risk, or if it is not practicable to eliminate, reduce it so far as practicable (reg 410). They also require manifests, placarding, fire-protection systems, emergency plans and material safety data sheets to be updated in-line with any change to the facility (regs 427, 432, 436, 437 and 438). The regulatory requirements may apply to changes in the type and quantity of dangerous goods, changes in the activities performed, and changes to procedures and organisation. Although not explicitly stated in the MHF regulations, processes and systems of work include all these factors. 8

9 4.2. Compliance and verification DG S&H Regulations Demonstration of compliance with the risk control duties of the DG S&H Regulations requires: information that demonstrates the adequacy of the applicant s risk management process including a summary of the steps taken or to be taken in relation to hazard identification, risk assessment and risk control measures information that demonstrates the adequacy of the risk control measures a description of how the applicant will verify compliance with the risk control duties (divisions 3 and 4 of part 4). The operator must be able to show that there are robust mechanisms to initiate the necessary hazard identification and risk assessment and that the hazard identification and risk assessment procedures are valid. The operator should also be able to show how the risk control measures meet the requirement to eliminate risk or reduce it so far as is practicable. It will also be necessary to show how compliance will be maintained in the longer term. This may typically be achieved by setting appropriate performance standards and indicators for the activities, and by tracking performance through monitoring and corrective action systems. All of these requirements are similar to the requirements in the MHF regulations, so an MOC process that meets the requirements for an MHF will also satisfy the requirements of the DG S&H Regulations. However, the definition of modification under the MHF regulations is wider than changes or alterations that are to be managed under reg 410 of the DG S&H Regulations so a system that satisfies the requirements under these regulations may not satisfy the requirements of the MHF regulations. The MOC process required to be in place by the time the Safety Case is submitted to WorkSafe may need to be more comprehensive than the existing process MHF regulations An MHF licence will not be granted until WorkSafe is satisfied that the applicant has (amongst other things) complied with division 3 of the MHF regulations and prepared a Safety Case in accordance with reg In turn, division 3 requires the operator to include a description of the MOC process within the SMS and to use the SMS as the primary means of ensuring safe operation. MOC is an important control measure, and division 3 also requires the operator to justify the adopted control measures. Hence a robust, documented MOC process, which is implemented in practice, is a vital aspect of the Safety Case. 5. Review and revision There are no specific review and revision requirements for MOC as related to the review and revision of the Safety Case. However, changes during a licence term should be reviewed for inclusion in the Safety Case and for any new knowledge on processes and equipment etc. Before making any modification to the facility to comply with reg (1), the operator of an MHF must review (and if necessary revise) identified major incident hazards and major incidents, the Safety Assessment and the adopted control measures. The review and revision should ensure that the risk control measures adopted are such that the operator continues to comply with reg 5.2.8, ie control measures eliminate or reduce risk so far as is reasonably practicable. Following modification to the facility, the operator must review/revise the SMS (reg 5.2.5(4)), and must review/ revise the Safety Case if control measures have been revised (reg 5.2.5(12)). Descriptive material in the Safety Case (as required under Schedule 12) needs to be maintained as current. 9

10 6. Compliance checklist The following checklist highlights the regulatory requirements relating to management of change. Table 6.1 MHF regulations relating to management of change Section Reg 5.2.8(1) Reg 5.2.8(2) Reg (1) Reg (2) Reg (1) Schedule 10, 5 Requirement The operator of an MHF must adopt risk control measures that (a) Eliminate so far as is reasonably practicable the risk of a major incident occurring, or (b) If it is not reasonably practicable to eliminate those risks, reduce that risk so far as is reasonably practicable. The operator of an MHF must adopt risk control measures designed to reduce, in the event of a major incident occurring, its magnitude and the severity of its consequences to persons both on-site and off-site. The operator of an MHF who has (a) identified major incident hazards and possible major incidents under regulation or (b) conducted a Safety Assessment under regulation or (c) adopted risk control measures under regulation must review and, if necessary, revise those matters to ensure that the risk control measures adopted are such that the operator continues to comply with regulation A review and revision under this regulation must be conducted (b) before a modification is made to the MHF The operator of an MHF must review, and if necessary, revise the existing Property Protection Assessment for that facility (a) if there has been a change to the circumstances (i) of a Safety Case under division 4 or (ii) that formed part of the initial Property Protection Assessment Management of change A description of the procedures for planning modifications to MHFs. 7. Further reading NSW Department of Planning (1995). Hazardous Industry Planning Advisory Paper No 9: Guidelines for the Development of Safety Management Systems. ISBN American Institute of Chemical Engineers, Centre for Chemical Process Safety (1992): Plant Guidelines for Technical Management of Chemical Process Safety. ISBN

11 Further Information Contact the WorkSafe Victoria Advisory Service on or go to worksafe.vic.gov.au Related WorkSafe publications Compliance Code, Managing asbestos in workplaces, Compliance Code, Removing asbestos in the workplace Guidance note Hazard identification Guidance note Control measures Note: The information presented in this Guidance Note is intended for general use only. It should not be viewed as a definitive guide to the law, and should be read in conjunction with the Occupational Health and Safety Regulations Whilst every effort has been made to ensure the accuracy and completeness of the Guidance Note, the advice contained herein may not apply in every circumstance. Accordingly, the Victorian WorkCover Authority cannot be held responsible, and extends no warranties as to the suitability of the information for any particular purpose or actions taken by third parties as a result of information contained in the Guidance Note. 11