Surviving a Class, Flag or Client Audit of Your Shipboard NDT
Maritime NDT audits are vertical, not documentary. A class society, flag administration or client auditor picks one completed job and traces it end to end: the contract, the job plan, the operator certificate valid on that date, the equipment verification record, the raw readings, the report and the signature. Level III audit support builds that chain before the auditor asks for it.
Most quality managers prepare for an audit by tidying the manual. Maritime auditors do not read manuals for long. Under the IACS procedural requirements for service suppliers, an approved firm is audited by sampling actual delivered work, and the sample is followed downward until it either holds or breaks. That is a fundamentally different exercise from a documentation review, and it is why firms with excellent procedures still collect findings. The break usually occurs at one of three joints: an operator whose certification lapsed partway through a contract, an instrument with no verification record for the day the readings were taken, or a report signed by somebody who was not aboard. None of those is a technical failure. All of them make competent work unprovable, which in an audit is the same outcome. The remedy is to run the sample on yourself first, on real jobs, with the same severity.
Source: IACS Unified Requirement Z17, Procedural Requirements for Service Suppliers; IACS Unified Requirements in the Z10 series covering hull surveys of oil tankers and bulk carriers; the IMO 2011 ESP Code, resolution A.1049(27), and SOLAS chapter XI-1; ISO 9712 and ASNT SNT-TC-1A for personnel certification; ISO 9001:2015 for the underlying management system.
| Auditor question | Evidence that answers it | Where it usually breaks | Owner of the fix |
|---|---|---|---|
| Was this job within your approved scope? | Approval certificate scope and the contract or work order | Scope creep into a method or service not covered by the approval | Quality manager |
| Was the operator qualified on that date? | Certificate with method, level, issue and expiry, plus the vision record | Certificate expired mid-contract; renewal dated after the job | Certifying Level III |
| Was the instrument fit on that day? | Calibration certificate plus the start and end verification on a reference step | No daily verification record; only an annual calibration certificate | Operating supervisor |
| Do the readings support the report? | Raw field record with locations, matched to the report table | Report figures that cannot be traced to any field sheet | Reporting Level II or III |
| Was the coating accounted for? | Instrument mode recorded, echo to echo where coated | Single echo readings on painted plate, overstating remaining thickness | Operator and technical authority |
| Who reviewed and signed? | Named reviewer, date, and evidence the reviewer holds the level required | Signature of a person not present and not qualified to review | Technical authority |
The audit that is coming is vertical, and your manual will not stop it
Firms preparing for a class society or client audit almost always over-invest in the quality manual and under-invest in the delivered record. Maritime audit practice under the IACS procedural requirements for service suppliers is built around sampling: the auditor selects work that has already been delivered and follows it downward until the evidence either holds or fails. The manual is checked for existence and consistency, then set aside. The job file decides the outcome.
This is a rational way to audit an inspection service, because the deliverable is a claim about a physical asset and the only defence of that claim is the record behind it. It also means that the usual preparation sequence is backwards. Rewriting procedures in the fortnight before an audit produces a document set nobody has worked to yet, which is itself visible: the auditor sees revision dates clustered a month before his visit and understands exactly what happened.
The productive preparation is to run the auditor's own method on yourself. Take three completed jobs at random, not the good ones, and demand every layer of evidence for each. Most firms find their first break inside twenty minutes. Doing that exercise with an external ASNT Level III consulting authority removes the internal reluctance to fail your own colleagues, which is the main reason self-audits find nothing.
What approval as a service supplier actually commits you to
The IACS unified requirement covering service suppliers sets out what a firm must maintain to remain approved for work such as thickness measurement on classed vessels. In outline it requires a documented management system, personnel qualified to a recognised scheme and further trained on the firm's own procedures, equipment that is calibrated and verified with records, controlled reporting, defined limits on subcontracting, and periodic verification by the society including audit of actual jobs.
Firms tend to read that list as a set of documents to produce once. It is better read as a set of records to generate continuously. Approval is not a certificate on a wall, it is a claim that every job delivered under it met the same conditions as the job the society examined at approval. The periodic verification exists precisely to test whether that claim held between visits, and the sample is drawn from the intervening period.
Subcontracting deserves particular attention because it is where approvals most often unravel. Where operators are supplied by another firm, the auditor will want to see how their qualification, training on your procedures and equipment control fall inside your system rather than someone else's. A firm that treats supplied operators as a procurement matter rather than a competence matter will fail that question, and the failure is structural rather than clerical.
What the auditor samples, in the order they sample it
The sequence is predictable. Scope first: was the work within the approval, and does the contract or work order show it. Then personnel: who did the work, at what level, under what scheme, with certification valid on the date of the job, and with the vision check current. Then equipment: what instrument, what probe, what reference block or step wedge, what calibration certificate, and crucially what verification was performed at the start and end of the measurement session.
Then the data. The auditor wants the raw field record, not the typed report, and he wants to place a specific reported figure back onto a specific location on a specific structural member. This is the point at which most systems break, because the field record was a notebook or a spreadsheet that nobody controlled, and the report was assembled from it by someone in an office. If the two cannot be reconciled, the report is an assertion.
Finally the report and its review: who signed, on what basis, and what qualification the reviewer holds. Where the deliverable feeds a survey, the auditor may also test whether the attending surveyor's requirements were reflected in what was measured. Firms that hold the whole chain in a controlled inspection data management system answer this sequence in minutes; firms holding it in email answer it in days, and the delay is itself noticed.
The findings that recur in hull thickness measurement
The first is location. A diminution figure means nothing without an unambiguous statement of where it was taken, keyed to a structural drawing and to the same convention used at the previous survey. Reports that identify a reading by frame number alone, without side, elevation or member, cannot be compared across survey cycles, which destroys the entire purpose of a thickness history. Auditors and surveyors both raise this, and it is the most consequential of the common findings.
The second is the coating question. Single echo measurement on a coated surface includes the paint film in the reading and overstates remaining metal. Echo to echo mode excludes it. Competent operators know this and switch mode; the finding is usually that the report does not state which mode was used, so a later reader cannot know whether an apparently comfortable margin is real. Recording instrument mode alongside each reading set is a small change with disproportionate audit value.
The third is the verification record. An annual calibration certificate for the gauge is necessary and insufficient. What the auditor wants is evidence that the instrument read correctly on a known reference at the start of the session and again at the end, so that any drift is bounded and the affected readings identifiable. Firms that verify but do not record are indistinguishable, on paper, from firms that do not verify.
Machinery, repairs and the surveys where NDT carries the decision
Hull thickness dominates the conversation, but the machinery side produces sharper technical questions. Tailshaft withdrawal surveys turn on magnetic particle examination of the shaft taper, the keyway and the fillet radii, where a missed crack is a total propulsion loss rather than a corrosion allowance argument. Rudder pintles, crane and lifting appliance components, and boiler pressure parts all carry method-specific examination requirements where the technique matters as much as the certification.
Repair welding is the other high-exposure area. A structural repair on a classed vessel is carried out to an approved procedure with defined examination, and the resulting NDT record becomes the evidence that the repair is acceptable. Where the repair happens at short notice in a yard far from home, the pressures on procedure control, operator qualification and record keeping are at their highest and the evidence chain is at its most fragile.
These are the jobs where independent data review earns its cost. Having a second qualified reader examine the magnetic particle record or the ultrasonic data before it is issued catches both the misread and the missing record, and it produces a dated review document the auditor can see. Where a client or a certifying body has already questioned a result, independent review of inspection reports is a cleaner answer than a defence written by the original crew.
What the Level III signs, and what the Level III must never sign
The technical authority in an NDT programme owns a defined set of documents: the written practice or scheme document setting out how personnel are trained, examined and certified; the NDT procedures and their qualification records; the technique sheets that apply those procedures to specific configurations; the certificates issued to personnel within the practice; and independent review reports on data. In an audit, the Level III answers technical questions on method capability, procedure basis, personnel competence and data interpretation.
The boundary is equally important. The Level III does not sign class or statutory certificates, does not sign survey reports, does not determine seaworthiness or fitness for service, and does not act as the attending surveyor or as the inspector of record for anyone else's regime. Atlantis supplies NDT technical authority into a maritime programme; it does not act as a classification society and does not deliver inspector certification programmes for other industries' regulatory schemes.
Keeping that line visible in the documents is itself evidence of a controlled system. Where a technical authority has been signing outside his remit, an auditor will widen the sample, because a system that is loose about who signs what is usually loose elsewhere too. Where personnel certification within the written practice is the weak point, the practical fix is a structured pipeline through NDT training and certification to ISO 9712 or SNT-TC-1A rather than case-by-case paperwork.
Gap review before, remediation after: they are not the same project
A gap review is voluntary, scoped by you, and produces internal actions you close on your own timetable. It costs a few days of a Level III's time, it disrupts nothing, and it leaves no external record. Its output is a list of breaks in the evidence chain, ranked by how likely each is to be sampled, with a fix for each that can be implemented in the field rather than only in the manual.
Remediation after a finding is a different animal entirely. A recorded non-conformity brings a required root cause analysis, a containment question about the work already delivered under the same defective practice, a corrective action plan with dates that are not yours to choose, and a verification step by the auditing body. If containment implies reviewing or repeating previous measurements, the cost lands on you and the schedule lands on your client, which is the part that damages the relationship.
There is also a reputational asymmetry that firms underestimate. Internal findings are invisible. External findings appear in audit history, and both clients and tender processes ask about them for years. The economics are straightforward: a gap review is bounded, private and entirely within your control, and remediation is none of those things. Where an audit is already scheduled, start the gap review now rather than after the opening meeting.
Building an evidence chain that survives a change of personnel
Every recurring finding in this sector is really a memory problem. The operator knew he verified the gauge. The supervisor knew which mode was used. The reviewer knew the readings were taken in his presence. None of it was written down in a form that outlives the people involved, and audits happen after those people have moved on. A system designed for the audit is simply a system that writes down what competent people already know.
In practice that means four things captured at the point of work rather than reconstructed later: the operator identity with certification status resolved automatically, the instrument identity with its verification checks timestamped, the reading with its location keyed to the same structural reference used last cycle, and the instrument mode. Everything else in the file can be assembled afterwards. Those four cannot, and those four are what the vertical sample tests.
Firms running this on paper can pass an audit, and many do, but they carry a permanent overhead in preparation time and a permanent risk in transcription. Moving the chain into a controlled system removes both, and it turns the thickness history into an asset rather than an archive, because the next cycle starts from comparable data instead of from a stack of scanned reports nobody can align.
Class, flag and the client audit are not asking the same question
The class society is testing whether the firm still meets the conditions of its approval, and its sample is drawn from work done on classed vessels. A flag administration, or a body acting on its behalf, is concerned with statutory compliance and with whether the survey regime was properly served. A commercial client audit, run by an owner, manager or charterer, is asking a narrower and more pointed question: can this firm produce evidence that stands up if something fails.
The three overlap heavily on evidence and diverge on emphasis. Class audits weigh approval scope, personnel and equipment control most heavily. Statutory work brings survey timing and reporting into focus. Client audits go straight to the data, because the client has usually been burned by a report that could not be reconciled with what a later inspection found. Preparing for the strictest of the three prepares you for all of them.
What none of them accepts is a system that works only when a particular individual is present. If your programme depends on one experienced supervisor holding it together, that is the finding waiting to be written, and it will be written in the language of documented control rather than of competence. Building the technical authority into documents and records, so that it persists independently of who is on shift, is the whole point of the exercise.
What is a vertical contract audit and why does it matter?
It is an audit that takes one completed job and follows it through every layer of the system rather than checking each procedure in isolation. The auditor asks for the work order, the plan, the personnel records, the equipment records, the raw data and the delivered report, then tests whether they agree with each other and with the procedure. It is unforgiving because it exposes the gaps between what the system says and what the crew did.
Why do coated hull readings cause so many findings?
Because a conventional single echo thickness measurement includes the coating in the measured path and overstates remaining steel, sometimes by half a millimetre or more on a heavily coated internal surface. Echo to echo mode ignores the coating layer. The finding is rarely that the wrong mode was used, it is that the report does not record which mode was used, so nobody downstream can tell whether a diminution figure is real or optimistic.
What does the Level III sign in a maritime NDT programme?
The written practice or certification scheme document, the NDT procedures and their qualification records, the technique sheets, the certification of personnel within that written practice, and independent data review reports. The Level III also acts as technical authority in the audit, answering questions on method capability, procedure basis and personnel qualification. Those signatures are technical and personal, and they are the ones an auditor traces when a report is challenged.
What does the Level III not sign?
Class or statutory certificates, survey reports, seaworthiness or fitness for service determinations, and anything reserved to the attending surveyor or the classification society. The Level III does not approve the firm, does not act as the surveyor, and does not certify the vessel. Keeping that boundary visible in the documentation is itself audit evidence, because a programme in which the technical authority signs outside his remit invites a much broader examination.
How early should a gap review happen before an audit?
Far enough ahead that a systemic fix can be implemented and then evidenced by real jobs, which in practice means eight to twelve weeks rather than two. A gap review that finds a records problem four weeks out leaves time to change the forms but not to accumulate a body of completed work showing the new discipline. Auditors sample delivered jobs, so the fix has to have been running long enough to appear in them.
Is a finding after an audit worse than a gap found before one?
Materially, yes. A gap you find is an internal action closed on your own timescale. A finding raised by an auditor becomes a recorded non-conformity with a root cause analysis, a containment step that may require reviewing or repeating prior work at your own cost, a corrective action plan with a deadline, and a verification visit. It also becomes disclosable history that clients and tender processes ask about for years afterwards.