Digital Signature and Chain-of-Custody in NDT Reporting Software

Why a Signature Carries More Weight on an NDT Report

Most business documents get signed as a formality. An NDT examination report is different — the signature is the point where a certified individual takes personal, code-referenced responsibility for a technical finding that a client, an insurer, or a regulator may rely on for years. When a Level II technician signs a UT report stating a nozzle weld shows no rejectable indications, and a plant later returns that vessel to service on the strength of that finding, the signature is doing real legal and technical work, not just closing out a paperwork step. That weight is exactly why the mechanics behind a digital signature — not just whether one exists, but whether it can be trusted — deserve far more scrutiny than most shops give them when picking reporting software.

What "Signed and Dated" Actually Implies Under Code

ASME Section V and the codes that reference it consistently require examination records to be signed and dated by qualified personnel, with the implicit expectation that the signature attaches to a specific, complete, unaltered version of the report. That expectation is easy to satisfy with a wet-ink signature on a single paper original — there's only one physical document, and altering it after signature leaves visible evidence. It gets much harder to satisfy once reports exist as editable digital files, where a document can be changed after "signing" with no visible trace unless the software specifically prevents it.

The Pasted-Image Signature Problem

The most common digital signature shortcut — and the weakest one — is a scanned or drawn signature image pasted into a Word document or stamped onto a PDF. This approach has no inherent connection to the document's content; the same signature image file can be pasted onto any document at any time by anyone who has access to it, and nothing about the image itself proves it was applied by the actual certified individual, on the actual date claimed, to the actual final version of that specific report. If a client's auditor asks "can you demonstrate this report hasn't been edited since it was signed," a pasted-image signature has no good answer. This isn't a hypothetical audit question — document integrity checks are a routine part of API-referenced inspection audits and insurance-driven asset integrity reviews, and a shop that can't answer it convincingly creates real doubt about the reliability of its entire report archive, not just the one document being questioned.

What Genuine Digital Signature Integrity Requires

A Locked, Tamper-Evident Record

Once a report is signed, the underlying data should be locked from further edits, with any subsequent correction requiring a new, separately dated and signed revision rather than a silent change to the original. This mirrors a principle used across other regulated record-keeping industries — pharmaceutical manufacturing's approach to electronic records under FDA 21 CFR Part 11 is a well-known example of the same underlying idea, even though it's a different regulatory framework entirely: once a record is finalized and attributed to a specific person, it needs to stay that way, and any change needs its own trail.

A Real Audit Trail

Beyond locking the signed content, the system should log who created the report, who edited which fields and when, who reviewed it, and who signed it, with timestamps for each step. This turns "was this report altered after signing" from an unanswerable question into a verifiable one — the audit log either shows a post-signature edit or it doesn't, and that log itself needs to be tamper-resistant, not just the report content.

Identity Verification, Not Just a Checkbox

A digital signature that amounts to clicking a "Sign" button while logged into a shared account doesn't actually verify that the specific certified individual applied it. Stronger implementations tie the signature to an individual, authenticated user account — not a shared shop login — and ideally to a specific credential or certification record, so the signature carries the same individual accountability a wet-ink signature does.

Chain of Custody: Beyond the Signature Itself

Signature integrity is one piece of a larger chain-of-custody question that spans the entire life of an examination record, from the moment data is captured in the field to the moment a client receives the final report.

Radiographic Film vs. Digital RT Records

Traditional film radiography has a well-understood physical chain of custody — film is exposed, processed, and stored, with a physical object that can be checked out, tracked, and archived. Digital radiography and computed radiography replace that physical film with digital image files, which raises a different custody question: how does a shop prove a specific DICONDE-format RT image hasn't been altered, brightness-adjusted in a way that changes apparent indication severity, or swapped for a different exposure, between capture and final report? File-level checksums, locked original images alongside any annotated working copies, and a clear audit trail of who accessed and exported each image address this, but only if the reporting platform is built to support it rather than treating a digital RT image as just another attachment.

Photographic Evidence

Photos of indications, repair welds, or general condition documentation carry real evidentiary weight, particularly on disputed findings or insurance-related claims. A photo's value depends on being able to establish when and where it was taken and that it hasn't been altered — metadata capture (timestamp, and where available, device and location data) and locking the original alongside any annotated version preserves that chain, rather than allowing an edited image to silently replace the original in the record.

The Technician-to-Reviewer Handoff

Chain of custody also covers the internal workflow: a report a technician submits from the field, a Level II or III reviewer's technical review and any requested corrections, and the final signed version that goes to the client. Each handoff should be logged — not necessarily to create bureaucracy, but so that if a question arises later about how a finding was reached or who reviewed what, the answer exists in the record rather than in someone's memory of a job from eighteen months ago.

Where Shops Usually Discover the Gap the Hard Way

In practice, most shops don't sit down and deliberately evaluate their signature and custody practices — they discover the gap when a client's procurement or QA department sends a pre-qualification questionnaire asking specifically how the shop protects signed report integrity, or when a new client contract includes a clause requiring demonstrable data integrity controls for inspection records. At that point, the shop is answering under time pressure, often mid-bid, rather than having already built the answer into its normal workflow. Getting ahead of that question — being able to describe a locked-record, audit-logged signature process confidently and specifically during a bid qualification review — is itself a competitive advantage with larger owner-operator clients who increasingly build data integrity expectations directly into their vendor qualification criteria, not just their technical scope requirements.

Comparing Signature Approaches

• Pasted signature image: No link to document integrity, no audit trail, no individual authentication beyond whoever had access to the image file. Fails a serious audit question immediately.
• Basic e-signature tool bolted onto a PDF: Better than a pasted image, but often disconnected from the underlying report data — the signature secures a PDF snapshot, not the structured data behind it, and rarely integrates with personnel certification records.
• Platform-native digital signature with locked records and audit logging: Signature ties to an authenticated individual account, locks the specific report version at the moment of signing, and logs the full edit and review history — giving a complete, verifiable answer to any later audit question about integrity.

Why This Matters Years After the Job Is Closed Out

Report retention isn't just a filing exercise. A fitness-for-service reassessment under API 579-1/ASME FFS-1 years later depends on historical inspection records being trustworthy enough to base an engineering decision on. An insurance claim following an equipment failure may turn on whether the last inspection record accurately reflected conditions at the time. A legal dispute over responsibility for a failure may hinge on being able to prove exactly what a report said, who signed it, and when — not what a report currently says after however many undocumented edits happened since. A shop's report archive is, in effect, a long-term liability record as much as an operational one, and chain-of-custody integrity is what makes that record defensible rather than merely convenient.

A Realistic Scenario: A Finding Disputed Three Years Later

Consider a scenario a shop's Level III might actually face: a storage tank inspected under API 653 three years ago passed its floor UT survey with no reportable thickness below the minimum required. The tank later develops a leak, and the operator's engineering team, working with their insurer, wants to understand whether the original inspection data was accurate or whether something was missed. The shop needs to produce the original report, prove it reflects what was actually measured at the time, and show that nothing was altered between the field survey and the final signed document the client received. If the shop's archive is a folder of static PDFs with pasted signatures and no audit trail, the honest answer to "can you prove this wasn't changed" is no — not because anything actually was changed, but because the system was never built to demonstrate that either way. If the archive is built on a platform with locked, signed records and a full audit trail, the shop can produce a complete, timestamped account of exactly what was captured, by whom, and when it was reviewed and signed, turning a potentially damaging dispute into a straightforward records request. The difference between those two outcomes was decided years earlier, at the point the shop chose its reporting software, not at the point the dispute actually happened.

How This Connects to Personnel and Equipment Records

Signature integrity is strongest when it's not an isolated feature bolted onto the reporting module, but is directly connected to the same personnel certification and equipment calibration records that feed the rest of the report. A signature that's cryptographically sound but attached to a technician whose certification had actually lapsed the week before still leaves the shop exposed — the document integrity is fine, but the underlying qualification claim isn't. This is one of the strongest arguments for handling reporting, certification tracking, and calibration management within one connected NDT ERP system rather than as separate tools that each solve one piece of the trust problem while leaving the others unaddressed. A genuinely defensible record needs all three layers — document integrity, personnel qualification, and equipment calibration — to check out together, not just the one a shop happened to invest in first.

Questions Worth Asking Before Trusting a Vendor's Signature Feature

• Does signing lock the report's underlying data, or just generate a static PDF while the source record stays editable?
• Is there a full audit trail of edits, reviews, and signatures, with timestamps and individual user attribution?
• Does the signature tie to an authenticated individual account, or a shared login?
• How are digital RT images and photographic evidence protected from post-capture alteration?
• Can the shop produce a defensible answer, on demand, to "prove this report hasn't changed since it was signed"?

Building a Record That Holds Up

None of this is about distrusting technicians or reviewers — it's about building a system where trust doesn't have to rest entirely on everyone's good intentions, because the software itself makes tampering visible and unauthorized changes structurally difficult. NDT reporting software that gets signature integrity and chain of custody right protects the shop as much as it protects the client, since a defensible record is the strongest position a shop can be in if a finding is ever challenged years after the job closed. Shops unsure whether their current signature and archival practices would hold up under a serious audit are often better served getting an outside ASNT Level III consulting review of their documentation chain now, rather than finding out the gap exists during an actual dispute. It's a review that typically takes far less time than shops expect, and the findings tend to be concrete and fixable rather than requiring a wholesale process overhaul — a locked-record policy, an audit-logged signature workflow, and a clear archival retention practice cover most of the gap in the majority of shops that haven't looked closely at this before.

Atlantis NDT Products & Services

Atlantis NDT pairs field expertise with software: NDT inspection management software — Atlantis ERP, a digital twin platform for asset integrity, and NDT reporting software. Build your team with NDT training & certification (ASNT SNT-TC-1A) and ASNT certification pathways, or bring in ASNT Level III consulting. Affordable, accessible, fully customizable — book a free consultation.