Temporary changes: risk review, expiry and restoration control

Define the change in terms of function and interfaces

HSE’s plant-change guidance includes equipment, procedures, people and substances within the change question. For a shipboard example, replacing a normal status indication with a temporary alternative can affect the information available to operators even if no process pipe is moved. Describe what is different from the intended configuration and who or what relies on it.

The record should identify the reason for the change and its boundary. A temporary label is not a risk classification. A small physical modification can affect a critical interface, while an extensive like-for-like activity may leave the functional basis unchanged. The actual technical comparison determines the review needed; cost, convenience or planned short duration alone does not establish equivalence.

Assess the changed state before relying on it

The US process-safety rule 29 CFR 1910.119(l) explicitly includes technical basis, safety effect, procedural changes, duration and authorization in management of change. It applies to covered US processes, not automatically to all ships. The listed dimensions are useful questions for a general temporary-change assessment within the vessel’s own governing framework.

Consider normal operation, likely disturbances, maintenance and emergency conditions. An alternate indication may be adequate for routine observation but omit the cue needed during a failure. A temporary connection may change availability, capacity or the independence of another function. The assessment should identify what evidence supports the proposed use and which conditions would invalidate it.

Check information transformations as technical changes

A temporary display or manual record can introduce a unit, scaling, sign or reference mismatch. In a basic unit example, 2.0 bar is 200 kPa. Copying the numerical value 2.0 into a field labelled kPa creates a hundredfold interpretation error. The physical pressure has not changed, but the information used for a decision has.

Other mismatches may involve gauge versus absolute pressure, temperature units, tank reference levels or stale timestamps. A familiar-looking display can conceal them. Verification should address the complete information path and the user’s interpretation, rather than only whether a value appears on screen. The example is not a proposed temporary control-system design or a substitute for equipment-specific validation.

Treat duration and expiry as part of the assessment

Suppose an invented temporary arrangement was assessed for 48 h but a delay would keep it in place for seven days, or 168 h. The proposed duration is 3.5 times the original and adds 120 h of exposure. This is a duration comparison, not a claim that risk necessarily increases by exactly the same factor.

An extension can also include operating conditions not present in the original window, such as another port call, a maintenance activity or a crew change. The question is therefore whether the original technical and organizational assumptions remain valid. An expiry date is useful only if the process recognizes it and requires a decision before the arrangement continues beyond its assessed scope.

Make compensating measures specific and observable

If the proposal relies on an additional check, watch or restriction, define the function it provides and the conditions needed for it to work. A person checking a temporary indication needs a usable signal, a clear interpretation, sufficient opportunity and an effective response within the actual operating arrangement. Naming a compensating measure does not establish its capability.

The assessment should also consider workload and shared dependencies. Several temporary changes may each assume the same person can provide extra attention or the same reserve system remains available. Together, they can create a demand that none of the individual reviews considered. Review the combined configuration rather than treating each open change as isolated from the others.

Control the transition and communicate the actual state

HSE’s organizational-change guidance separates risk in the intended end state from risk during the transition. Installation, testing, use and removal of a temporary arrangement can each create different conditions. The work plan should identify the relevant boundaries and responsibilities for each stage rather than evaluate only the final temporary configuration.

People affected by the change need the information relevant to their tasks before relying on it. This can include altered indications, operating restrictions, interfaces with other work and the action required if the temporary arrangement becomes unavailable. A register known only ashore is insufficient if shipboard personnel continue using instructions that describe a different system state.

Keep extension decisions traceable

An extension review should compare the proposed new period and conditions with the original basis, examine new evidence and unresolved findings, and record the resulting decision under the applicable authority arrangements. Repeatedly changing a due date without that comparison can turn a bounded exception into an unexamined normal condition.

If the arrangement is to become permanent, it needs the review, documentation, training and assurance appropriate to that permanent state. Temporary-change paperwork should not serve as an indefinite substitute. Equally, restoring the original arrangement may no longer be straightforward if other modifications have occurred in the meantime. That interaction should be identified before removal begins.

Define restoration by evidence, not by disappearance from a list

Restoration criteria should identify the intended configuration, removal of temporary components or instructions, correct interfaces and the functional evidence needed. A closed change entry does not prove that the original indication, protection or service has returned. The actual installed and operating state should agree with the drawings, instructions and maintenance information that people will use.

Some changes leave residual consequences, such as altered settings, temporary labels, stored configuration files or deferred tests. Those items should be reconciled rather than assumed to disappear when the main physical work is complete. The evidence should show what was restored, what remains different and whether any remaining difference has its own valid assessment.

Use the record to improve the system

IMO’s ISM Code overview describes a safety-management framework built around assessed risks and appropriate safeguards. A well-controlled temporary-change record can support that framework by making the actual configuration, assumptions and decisions visible. It does not itself establish statutory compliance or confer authority outside the company and ship’s applicable arrangements.

Repeated temporary solutions can reveal a persistent reliability, supply or design problem. Review their causes and combined burden rather than celebrate repeated administrative closure. The aim is to keep necessary deviations from becoming invisible: each arrangement remains technically understood, time bounded and connected to a demonstrated final state.

Sources

• Plant modification / Change procedures · UK HSE · Source check date: 2026-10-07
• 29 CFR1910.119: Process safety management · US OSHA · Source check date: 2026-10-07
• Organisational change · UK HSE · Source check date: 2026-10-07
• The International Safety Management Code · IMO · Source check date: 2026-10-07