Who should be able to declare a temporary control?

That's the site's decision, made in its own procedures — but two roles must never be confused. Authorising the defeat itself (deciding the plant may run with this protection out) belongs to the site's risk process and the people it names. Declaring it — putting the state on the record so every shift can see it — should be easy enough that it always happens. A register that's hard to write in becomes a register of what people got around to admitting.

How long can a temporary control run?

As long as its justification holds, and not a shift longer — which is why good registers carry an expected end and a review trigger rather than an open-ended 'until further notice'. 'Temporary' is a claim with an expiry. A control still live long after its stated basis has expired isn't a temporary control any more; it's an unassessed permanent change wearing a temporary label.

What about an emergency defeat at three in the morning?

The operational response always comes first — nobody should be filling in a register while the plant needs their hands. The rule that works is declare immediately after: the record catches up within the shift, stating what was done, why, and by whom, and the normal authorisation follows in daylight. What the rule must never become is a reason the register is quietly incomplete; an emergency explains a late entry, not a missing one.

Is a whiteboard register acceptable?

At small scale, with real discipline, honestly — yes, for visibility. Where whiteboards fail is everything after visibility: they hold no history, they can't show who authorised what, an eraser is silent, and 'show me every defeat in the last twelve months' has no answer. Judge any register — board, paper, software — against the properties it must hold, not the medium it lives on.

What's the difference between a temporary control and a temporary repair?

A temporary repair is a physical interim fix — a clamp, a wrap, a patch — with its own engineering integrity assessment and lifetime. A temporary control is the declared operating state and compensating measures around an abnormality. They often travel together: the clamp gets fitted, and a temporary control is declared to watch it until the permanent repair. The repair is hardware; the control is governance.

The Definitive Guide to Temporary Controls

What a temporary control is

A temporary control is a declared, time-bounded abnormal operating state, together with the compensating measures that must hold while it lasts. An isolation in place while parts are on order. A trip defeated for fault-finding. A relief path valved out for a test. A temporary operating restriction after a near-miss. The vocabulary varies by site and sector — override, inhibit, defeat, bypass, temporary MOC — but the thing itself is the same everywhere: the plant is running in a state its designers didn't intend as normal, on purpose, for a reason, for a while.

Three words in the definition carry the weight. Declared: the state exists on a record every shift can see, not in the memory of whoever arranged it. Time-bounded: it has an expected end, and someone owns getting there. Compensating: something — usually extra checks — stands in for the protection that's out. Remove any one of the three and what remains isn't a temporary control; it's a condition waiting to be discovered.

Why they exist — and why “never” is the wrong rule

It's tempting to treat every defeat as a failure of discipline. The opposite is closer to true: a plant that claims it never bypasses anything is either not running or not being honest. Fault-finding needs trips inhibited to trace the fault. Maintenance needs equipment isolated while the rest runs. Degraded equipment sometimes must limp to the outage because shutting down mid-campaign carries its own risks. The engineering judgement to run abnormal — assessed, compensated, time-boxed — is legitimate and sometimes the safest available choice.

So the discipline worth building is not “never defeat anything”. It is “defeat deliberately”: every abnormal state assessed, authorised, declared, watched, and deliberately returned to normal. The whole apparatus of temporary controls exists to keep “deliberate” true from the first hour to the last.

How they fail

Temporary controls have a characteristic failure signature, and it's worth naming each mode, because every one of them appears in incident reports with numbing regularity.

They outlive their risk assessment

The assessment justified two weeks; the parts took nine. Nobody reassessed, because nobody was counting. The state that was acceptable for a fortnight is now simply how the plant runs — and the original justification has quietly expired while the exposure hasn't.

The compensating measures fade

The extra checks agreed on day one are done diligently for a week, loosely for another, then not at all — because they lived in a handover conversation, and handovers compress. The defeat remains; the thing that made it tolerable doesn't.

They become invisible

The most dangerous state a temporary control can reach is normal. The tag on the panel that's been there so long nobody sees it. The inhibit that new starters assume is meant to be there. Weeks later, everyone remembers the job — not everyone remembers the bypass. Normalisation is not carelessness; it's what human perception does to anything that stops changing.

Restoration has no owner

Ending the state is everyone's eventual intention and nobody's actual job. The work finishes, the crew moves on, and putting things back — with verification that they really are back — waits for someone to notice. Some of the worst days in industry began with protection everyone believed had been restored.

The record can't answer

Then someone asks — an auditor, an investigator, a new plant manager — “what was defeated last March, who authorised it, and what was watching the plant meanwhile?” And the answer is an archaeology project: a shift-log line, a whiteboard long since wiped, an email thread with the one person who knew now working elsewhere.

The lifecycle that works

Sites that manage temporary controls well converge on the same shape, whatever they call it:

Declare.What is abnormal, why, since when, declared by whom, with an expected end. Declaration puts the state where every shift can see it — it's the difference between a managed condition and a surprise.
Assess and authorise.Through the site's own risk process — the judgement that the plant may run this way, made by the people the site's procedures name, recorded with the control.
Compensate.The measures that stand in for what's out — extra checks, restricted operations, a person watching — attached to the control itself, so they can't drift apart from it.
Stay visible.The control appears wherever the shift looks: the board, the handover, the count of what's abnormal right now. Visibility is the antidote to normalisation, and it has to be structural, not a matter of remembering.
Respond. A finding on a compensating check demands an answer from someone with the authority to give one — because a concern nobody closes is how fading starts.
End deliberately. Restoration is an authorised act with a name on it, verified — protection proven back, not assumed back. Clearance by lapse of memory is how controls die; clearance by decision is how they end.
Retain. The whole life — declaration, checks, findings, decisions, clearance — remains retrievable as one history, because the questions come months later.

What a register must actually do

Every site has something it calls the register. The test is not whether it exists but what it can do. A register doing its job holds these properties:

Single and complete. One place, covering every live control — not a whiteboard here, a spreadsheet tab there and two in the shift log. A register that might be missing entries answers no questions at all.
Live-countable.“How many controls are active right now?” answered at a glance, because the incoming shift manager needs it at handover, not after a search.
Honest about time. Expected ends visible, overruns conspicuous. The register should make an ageing control uncomfortable to look at.
Attributable throughout. Who declared, who authorised, who checked, who cleared — people, not just departments.
Tamper-evident.The history append-only: corrections visible as corrections, an erased whiteboard's opposite. The register's own trustworthiness is part of what it evidences.
Retrievable per control. The twelve-month question answered as one timeline per control, in minutes.

Medium-neutral, deliberately: a disciplined paper register at a small site can hold most of these properties, at growing cost in effort — the history and retrieval properties are where paper strains first. Judge whatever you use against the list, not against its packaging.

What a temporary control is not

Four adjacent things it must never be collapsed into:

Not a permit to work. The permit controls the high-risk work; the temporary control governs the abnormal state that may outlast the job. The permit closes when the crew leaves; the bypass they fitted doesn't.
Not management of change. MOC is the approval process that decides a change may happen. The temporary control is the operational life of the abnormal state after approval — watched, visible, ended. MOC without the operational half is a well-documented decision to take a risk nobody then manages.
Not a defect or work order. The work order gets the pump fixed; it says nothing about how the plant runs safely meanwhile. Sites that track the repair but not the running-degraded state have covered the easier half.
Not alarm shelving.Shelving is a short-horizon operator action inside the alarm system's own discipline. The moment a suppression is expected to persist beyond the immediate operational moment, it has become a temporary control and belongs on the register.

The pattern in all four: adjacent processes handle the event — the job, the approval, the repair, the moment. The temporary control handles the duration. Duration is where things get forgotten.

Monitoring while it's live

Compensating checks are the working heart of a temporary control, and they behave differently from routine rounds. They exist because ofthe control, so they should be bound to it — created when it's declared, falling due while it lives, ending when it ends. Binding matters for honesty at both ends of the life: while the control runs, its checks can't quietly stop without the gap showing against the control itself; and when it ends early, checks that were never needed should close as exactly that — “not required — control ended before due” — which is a different fact from done and a different fact from missed. A register that can't tell those three apart will eventually claim something untrue about one of them.

Every-shift cadence is the default for a reason: the compensating check is standing in for protection that used to work continuously. The longer the interval, the bolder the claim that nothing can develop unseen in between — and that claim belongs in the risk assessment, not in scheduling convenience.

The audit questions

Temporary controls attract the sharpest questions in any audit or investigation, because they're where the plant deliberately ran outside its design intent. Rehearse the evidence, not the answers:

“List every protective device defeated right now, who authorised each, and what's compensating.” — The speed of this answer is itself the finding.
“Show me every temporary control in the last twelve months, as one history each.”
“This control expected to end in June. It cleared in September. Who reassessed it in between?”
“Show me the compensating checks for this control — including any that didn't happen.”
“Who verified restoration — and how would your record show it if verification was skipped?”

Straight talk

This guide is operational practice, not legal advice, and it never overrides your site's own procedures. The authority to run abnormal belongs to your risk process and the people it names; the engineering judgement belongs to your engineers; and no register — paper, whiteboard or software, ours included — authorises a defeat, assesses its risk, or makes an abnormal state safe. What a good register does is narrower and still vital: it keeps the state declared, watched, honest and endable — and it can prove all four later.

Questions we actually get asked

Who should be able to declare a temporary control?: That's the site's decision, made in its own procedures — but two roles must never be confused. Authorising the defeat itself (deciding the plant may run with this protection out) belongs to the site's risk process and the people it names. Declaring it — putting the state on the record so every shift can see it — should be easy enough that it always happens. A register that's hard to write in becomes a register of what people got around to admitting.
How long can a temporary control run?: As long as its justification holds, and not a shift longer — which is why good registers carry an expected end and a review trigger rather than an open-ended 'until further notice'. 'Temporary' is a claim with an expiry. A control still live long after its stated basis has expired isn't a temporary control any more; it's an unassessed permanent change wearing a temporary label.
What about an emergency defeat at three in the morning?: The operational response always comes first — nobody should be filling in a register while the plant needs their hands. The rule that works is declare immediately after: the record catches up within the shift, stating what was done, why, and by whom, and the normal authorisation follows in daylight. What the rule must never become is a reason the register is quietly incomplete; an emergency explains a late entry, not a missing one.
Is a whiteboard register acceptable?: At small scale, with real discipline, honestly — yes, for visibility. Where whiteboards fail is everything after visibility: they hold no history, they can't show who authorised what, an eraser is silent, and 'show me every defeat in the last twelve months' has no answer. Judge any register — board, paper, software — against the properties it must hold, not the medium it lives on.
What's the difference between a temporary control and a temporary repair?: A temporary repair is a physical interim fix — a clamp, a wrap, a patch — with its own engineering integrity assessment and lifetime. A temporary control is the declared operating state and compensating measures around an abnormality. They often travel together: the clamp gets fitted, and a temporary control is declared to watch it until the permanent repair. The repair is hardware; the control is governance.