The like-for-like swap is the failure mode
The MOC step skipped under schedule pressure isn't a footnote to the incident, it is the incident.
Every plant has the sentence. “It’s a like-for-like swap, we don’t need to run it through MOC.” Sometimes that’s true; a replacement in kind, by definition, doesn’t trigger Management of Change under 29 CFR 1910.119(l) (US, PSM-covered facilities). The problem isn’t the exception. It’s that “like-for-like” is a judgment call made at the exact moment the schedule is screaming, by the person who most wants it to be true.
The exception is where the work is
When you read US CSB investigation reports, a recurring pattern isn’t the absence of an MOC program, most sites had one. It’s a change classified as not-a-change that walked around the review that would have caught it. A slightly different alloy. A gasket rated for the wrong service. A “temporary” bypass that outlived the shift. Each looked like a swap; none was. Process-safety practice treats the determination of whether something is replacement-in-kind as itself safety-critical, deserving rigor rather than reflex. If the new component differs in metallurgy, rating, materials, or upset behaviour, it is not in kind, no matter how identical it looks on the shelf.
The tell is time. Nobody skips MOC when there’s slack. The shortcut appears precisely when the cost of stopping feels highest, which is also when the odds of a bad call are highest.
Four questions that settle it, and they take two minutes
The determination fails because it is usually made by eye, against a picture of the old part. Four questions turn it into something a person can be held to, and none of them requires an engineer to be on shift.
Is the material identical, not merely similar? Grade, alloy, elastomer compound, coating. A gasket that looks the same and is a different compound is a different part in the service it is about to see.
Is the rating identical? Pressure, temperature, voltage, area classification, chemical compatibility. Higher is not automatically safe either, because a component that fails later than the one designed to fail first moves where the system breaks.
Does it fit and behave the same? Same dimensions, same connection, same response time, same flow characteristic. A valve with a different trim meets the specification and closes on a different curve.
And the one people skip: does it behave the same in upset? The normal-operation case is rarely where the difference matters. It shows up on the relief case, the fire case, the loss-of-cooling case, the moment the part is doing the job it was actually installed for.
If any answer is “not exactly,” the change is not in kind and the exception does not apply.
Temporary is the word worth auditing
There is a second gap next to the first, and it sits inside the standard rather than around it.
1910.119(l)(2) requires the MOC procedure to address, before the change, the technical basis, the impact on safety and health, modifications to operating procedures, the authorization requirements, and the necessary time period for the change. That last element exists for exactly one reason: some changes are meant to be temporary.
In practice the time period gets written down and never read again. There is no tickler, no expiry, no one whose job is to walk back through last year’s temporary changes and ask which ones are still installed. A jumper fitted for a two-day outage becomes part of the plant, and because it went through MOC once, it now carries the appearance of having been reviewed for a permanent role it was never assessed for.
Before you buy
Pull your last 12 months of "replacement in kind" determinations. For each: who decided it was in kind, and could that decision be overruled by someone whose bonus doesn't depend on the schedule? If the classifier and the beneficiary of skipping MOC are the same person, you don't have a control, you have a rubber stamp.
What separation actually looks like
Compliance says your MOC program exists and has signatures. The question is what happens at the fork when someone says “it’s just a swap” and the clock is running.
The cheapest structural fix is to move the in-kind determination one step away from the person holding the schedule. Not a committee, and not a delay measured in days. One named role, reachable in minutes, whose call it is, and who is not the person accountable for the outage duration. That single separation converts an incentive into a decision.
Then run the expiry list. Every temporary change from the last twelve months, with its stated time period and its actual age beside it. It is a half-day exercise and it is the closest thing to a free finding in process safety, because the answers are already in your own records.