Surviving a terminal audit: the NDT evidence chain behind API 653

Who audits a tank terminal, and against what

Terminals get audited from more directions than most facilities. A major customer audits before awarding or renewing a throughput agreement, and their checklist is usually derived from their own refinery mechanical integrity standard. A certification body audits the quality management system to ISO 9001, where clauses on documented information, competence and control of outputs bite directly on inspection records. A class society becomes involved where marine transfer is in scope. And where the terminal contains pipeline breakout tanks, 49 CFR 195.432 requires their physical integrity to be assessed to API 653, which puts a federal regulator behind the same evidence.

Underneath all of them sits SPCC. The rule at 40 CFR 112.8(c)(6) expects tank integrity testing on a regular schedule and whenever material repairs are made, combining visual inspection with a second technique, with comparison records maintained; 112.7(e) requires inspection records to be kept with the plan for three years; and 112.3(d) requires the plan itself to be certified by a licensed Professional Engineer. Terminals very often perform the technical work correctly and then fail to file the evidence where the rule expects to find it.

One point worth making explicitly because it changes the whole audit posture: many terminal tanks are outside OSHA process safety management entirely, because 29 CFR 1910.119 excludes flammable liquids stored in atmospheric tanks kept below their normal boiling point without chilling. Sites that assume PSM applies build a compliance programme aimed at the wrong standard, and sites that assume it does not apply without checking the exclusion against their actual inventory take the opposite risk. Atlantis is not a PSM auditor and does not perform 1910.119(o) compliance audits; the scope here is the NDT technical authority that every one of these audits reaches into.

How an auditor actually samples

No auditor reads an inspection programme end to end. They pick a small number of threads and pull. The threads are chosen for consequence, which in a terminal means the records that supported a decision: the thickness reading that justified a twenty-year internal interval, the floor scan that supported returning a tank to service, the repair that changed the tank's condition, and the technician whose signature appears on all three. Five or six chains, walked backwards, is a normal audit sample.

Walking backwards from a single number is more demanding than it sounds. That number has to connect to a condition monitoring location that can be found again on the shell; to the procedure at the revision in force on that date, not the current revision; to an instrument with a calibration certificate and a documented pre- and post-examination calibration check; to a technician certified in that method and level under the employer's written practice, with a near-vision examination within twelve months and a practical examination covering that technique; and to a written practice that invokes an edition of SNT-TC-1A consistent with the hour requirements the certificate was issued against.

When a link breaks, the auditor does not simply write one finding. They ask the extent-of-condition question, which is the expensive one: how many other records depend on the same broken link. A lapsed vision examination is a thirty-minute fix on the day it is found in a self-review. Found by an auditor, it puts every examination that technician performed since the expiry date into question, and on a busy terminal that can be several hundred reports. Building the written practice and procedure structure so that these links are inspectable in the first place is the difference between a two-hour audit thread and a two-month corrective action.

The evidence chain, link by link

The written practice is the root of the chain. It has to be a controlled document with a current revision, it has to state which edition of SNT-TC-1A or ANSI/ASNT CP-189 it invokes, it has to be approved by the Level III, and its training, experience, examination and recertification requirements have to match what the personnel files actually show. The most common structural failure is drift: the practice was updated to a newer edition of SNT-TC-1A at some point, but certificates continued to be issued under the old hour requirements, so the two documents contradict each other on the site's own letterhead.

Personnel files carry the next link. Documented training hours by method, documented experience hours, general, specific and practical examination results with the grading records retained, the certification itself with a valid date range, annual near-vision acuity examination, and evidence of the Level III's own qualification behind all of it. The practical examination is the link most often thin — a technician certified in ultrasonic testing whose practical examination was on a plate, signing corrosion mapping on a tank shell, is a gap an experienced auditor will find quickly. Keeping technicians qualified against the work they actually perform is why terminals run structured NDT training and certification to SNT-TC-1A and ISO 9712 rather than certifying against a generic syllabus.

The procedure and equipment links close the chain. Every examination must reference a procedure at a specific revision, and that revision must exist in the controlled document register with an issue date that precedes the examination. Calibration blocks must be identified and traceable, instrument calibration current, and the calibration check at the start and end of each examination sequence recorded as the procedure requires. Where any of these is verbal, assumed or reconstructed after the fact, the reading it supports has no provenance regardless of whether the reading itself is correct.

What the Level III signs, and what he does not

The Level III's signature belongs on a defined set of documents: the employer's written practice, NDT procedures and the records qualifying them, technique sheets, examination questions and grading records, personnel certifications issued within the written practice, and independent reviews or interpretations of NDT data. That is the boundary of the technical authority, and it is a real one. An auditor examining certification records expects to see a Level III who is themselves certified, whose certification is current, and who can demonstrate the basis on which each certification was issued.

What the Level III does not sign is equally definite. The API 653 inspection report, the suitability-for-service determination and the authorisation of repairs and alterations carry the certification of the API 653 Authorized Inspector — the inspector of record. Atlantis does not take that role at client terminals. The SPCC plan requires certification by a licensed Professional Engineer under 40 CFR 112.3(d), which is a separate professional obligation entirely. And process safety management compliance audits under 29 CFR 1910.119(o) are outside the scope of this service.

Keeping that boundary clean is not modesty; it is what makes the technical authority credible in an audit room. A consultant who signs everything is a consultant whose signatures mean nothing, and auditors notice. Where the terminal needs an independent technical opinion on data rather than a certification — a disputed indication, a contractor report whose acceptance basis looks wrong, a corrosion rate that does not match the tank's history — that is independent report validation, delivered as a reviewed opinion with its own evidence trail rather than as a countersignature on someone else's document.

Findings that recur at tank terminals

Condition monitoring locations that were never permanently marked. The readings exist, the corrosion rate has been calculated, the interval has been set — and nobody can put the transducer back in the same place, so the rate cannot be reproduced and the interval it supports cannot be defended. This is the single most consequential finding at terminal level because it undermines every downstream interval calculation at once.

Bottom examination claims without supporting structure. One hundred per cent floor coverage asserted where the sump surround, the annular lap, the area under heating coils and the critical zone were physically unreachable, with no coverage map showing the exclusions. Magnetic flux leakage indications reported and never proved up by ultrasonics. Procedures used without the demonstration qualification that API 653 Annex G expects. Any of the three turns a floor report into an unsupported assertion.

Subcontracted NDT is the third cluster. A terminal engages a contractor, the contractor certifies its technicians to its own written practice, and nobody at the terminal has ever read that practice, approved it, or kept the personnel files for the individuals who actually attended. When the auditor asks who took the readings on a specific date and the answer is the name of a company rather than a person, the chain has already broken. The fourth cluster is repairs: work performed under API 653 Section 9 with no qualified repair procedure on file and no record of the Authorized Inspector's involvement, and Section 12 examination after repair either not performed or not documented.

Gap review before the audit versus remediation after a finding

A pre-audit gap review is deliberately adversarial and deliberately narrow. It samples the way an auditor samples — a handful of high-consequence chains walked backwards to the written practice — rather than attempting to read every record. It is done quietly, before anyone external is watching, and what it finds is closed as ordinary document control: reissue a lapsed vision examination, retrieve and file a superseded procedure revision, mark and photograph the CMLs, obtain the subcontractor's written practice and review it, add the missing thermocouple map to a heat treatment file.

Remediation after a finding is a different animal. It is a formal corrective action with a defined shape: root cause analysis, extent of condition across every record that shares the broken link, correction of the immediate nonconformity, corrective action to prevent recurrence, verification that the action was effective, and a follow-up sample at the next audit that will deliberately target the same area. The technical fix at the centre is often identical to what a gap review would have done in an afternoon. Everything wrapped around it is not.

The asymmetry is worth quantifying in the terms a terminal manager cares about. A lapsed near-vision examination found internally costs an appointment. Found by an auditor, it raises the question of every examination that technician performed after the expiry date, which on a busy terminal may be several hundred reports across multiple tanks, and the defensible answer usually involves re-examination of a sample. The finding did not create the risk; it made the risk visible under conditions where nobody has the option of handling it quietly.

The audit day: representation on technical questions

Most audit findings at terminals are not caused by bad inspection. They are caused by a technical question being answered badly in the room. An auditor asks why a locally thinned area was accepted, why the internal interval was extended, why an indication was recorded as geometric, or why a technician certified at Level II interpreted results that appear to require Level III review. A confident, cited, correct answer closes the thread. An uncertain answer opens three more.

Level III audit representation means having someone present who can answer those questions on the record and cite the basis — the API 653 clause, the written practice paragraph, the procedure requirement, the ASME Section V requirement behind the technique. It also means knowing which questions are outside scope and saying so plainly. When an auditor asks a question that belongs to the API 653 Authorized Inspector or to the Professional Engineer who certified the SPCC plan, the correct answer identifies the right owner rather than improvising.

There is a discipline to how commitments are made during an audit as well. Agreeing to an action verbally, without scoping it, produces corrective actions that the terminal cannot deliver in the time promised and that turn into repeat findings at the next audit. Commitments should be written down at the time, scoped against extent of condition, and given owners and realistic dates. Getting that right on the day saves more work than any amount of preparation afterwards.

Building an evidence chain that survives the next audit as well

Passing one audit by assembling records in a rush teaches a programme nothing. The structural fix is to make each link inspectable in normal operation. That means the written practice, the procedure register, personnel certification with expiry dates, and equipment calibration all live in one place with dates that can be queried, rather than in four different filing systems maintained by three different people. It also means that when a technician's vision examination is due, something surfaces it before it expires rather than after.

On the data side, the fix is binding provenance to the reading. Each thickness measurement should carry its location identity, its coordinates on a mapped shell or floor, the date, the procedure revision, the instrument, and the technician certification reference, as attributes of the reading itself and not as a separate cover sheet. Corrosion rates then compute from records that can be audited to source, and interval calculations under API 653 Section 6 can be reproduced by anyone. Terminals doing this at scale use an inspection data management system rather than spreadsheets, because spreadsheets do not enforce provenance and nobody notices until an auditor asks.

Where a site also has PSM-covered process units alongside the tank farm, the mechanical integrity records for those units carry additional obligations and are better handled in a system built for them — mechanical integrity software — while the tank programme runs on API 653 evidence. The two overlap in personnel and procedures and diverge in almost everything else, and conflating them is a reliable way to produce records that satisfy neither. To scope a gap review against a specific terminal and audit date, start with a consultation.

Request a consultation