In Malaysian major hazard facilities, the Management of Change (MoC) process is a critical safety control. Its purpose is to ensure that any change to equipment, process, or design is reviewed for safety implications before it is implemented. Most MoC processes are built around changes that are obviously significant — new vessels, process re-routes, major equipment replacements. The failures that Bowtie analysis most often exposes are the ones produced by changes that were classified as minor.
The Minor Modification Problem in Malaysian CIMAH Facilities
A minor modification is typically defined as a change that doesn’t affect the process conditions, safety-critical systems, or hazard profile of the facility. In practice, this classification is made by engineers who are focused on the modification itself — its structural integrity, its compliance with design standards, its functional correctness.
What the minor modification approval process is rarely designed to ask is: does this change affect the physical coverage or effectiveness of a safety barrier that was already certified for this area? A cable tray installation in a panel room, a racking addition in a storage area, an equipment repositioning in a process bay — each of these can be classified, accurately, as a minor modification from an engineering and compliance perspective — while simultaneously altering the conditions under which an existing barrier was designed to function.
How Management of Change Gaps Show Up in Bowtie Analysis
Bowtie methodology applies two tests to every listed barrier: is it Specific — performing one defined, demonstrable action — and is it Independent — functioning without relying on another system or condition being correct first?
A fixed fire suppression system installed and certified for a given room layout passes both tests at the time of commissioning. It is specific (suppression nozzles discharging at defined pressure and flow rate) and independent (activated by heat sensors, not requiring human action). The commissioning documentation and subsequent monthly function tests confirm this.
When a physical modification changes the room layout — adding a cable tray that now sits between nozzles and a portion of the room — the barrier’s Specific characteristic is unchanged. It still discharges at the rated parameters. Its Effective characteristic is not. The water goes where it was always designed to go. The fire scenario has changed, and the coverage no longer matches the hazard.
The monthly function test does not catch this. The function test confirms that the system activates and water flows. It does not simulate a fire at the new cable tray location and check whether the nozzle coverage reaches it. The test was never designed to do that.
The Regulatory Position Under CIMAH 1996
For major hazard installations in Malaysia, the Control of Industrial Major Accident Hazards Regulations 1996 (CIMAH) require operators to demonstrate that safeguards remain effective against current process conditions. This is an ongoing obligation, not a one-time commissioning certification.
The DOSH Malaysia CIMAH framework anticipates exactly this scenario: a facility that was safe at commissioning, whose safety systems were verified and documented, but whose subsequent modifications created conditions the original safety case no longer accurately describes. The obligation to maintain safeguard effectiveness is what makes a CIMAH-compliant MoC process different from a general engineering change management process.
A modification that passes a general engineering review but is never assessed against the Bowtie’s barrier effectiveness criteria leaves the facility with a document that says a barrier is in place, while the barrier is operating in conditions its designers never evaluated.
Closing the Gap Between MoC and Bowtie Analysis
The structural fix is a connection between the MoC review process and the facility’s Bowtie diagrams. Before any modification is classified and approved, the review should include a step that checks: does this modification change the physical environment of any barrier listed in the Bowtie for this area?
This is not a lengthy additional review. For most minor modifications, the answer is clearly no — the change doesn’t intersect with any barrier’s coverage or activation conditions. For those that do intersect, the step triggers a barrier effectiveness review before the modification proceeds, rather than after an incident demonstrates the gap.
The Practical Test for Your Facility
For any current modification in progress at your facility, ask: has anyone compared the modification drawing or specification against the Bowtie diagrams for the affected area? Not to check whether a barrier was bypassed — but to check whether the modification changes the conditions under which a certified barrier was designed to function.
If that comparison is not part of your current MoC review process, you may be approving modifications that are technically sound and legally non-compliant with CIMAH’s ongoing safeguard effectiveness obligation.
Want to know how Bowtie methodology identifies barriers that are Specific but no longer Effective? Cikgu Barrier’s Barrier Management: Bowtie Analysis program teaches teams how to apply the Bowtie methodology rigorously — including barrier validation, Management of Change integration, and CIMAH compliance for major hazard facilities. Available in-house and as a public workshop across Malaysia.