Deficiency tracking that survives a nuclear audit sample trace
In nuclear work a deficiency is not closed when the repair is done. It is closed when the record proves who found it, under which acceptance standard, with what qualification and calibration, what the operability call was, whether Part 21 evaluation applied, and what successive examinations it scheduled. Deficiency tracking for nuclear power is really evidence assembly under a clock.
The audit you are preparing for is usually a NUPIC joint supplier audit or an internal QA audit against 10 CFR 50 Appendix B and ASME NQA-1. Neither is a document review. Both are sample traces: the lead auditor picks four or five condition reports and follows each one backwards until something does not reconcile. The failure is almost never the examination. It is that the technician's ANSI/ASNT CP-189 certification lapsed eleven days before the shift, that the UT instrument's calibration standard has no traceability record, that the operability determination timestamp sits in a different system than the condition report, or that a flaw accepted by analysis under IWB-3600 never generated the successive examination IWB-2420 requires. A deficiency module for nuclear has to make those links structural rather than clerical, so the trace holds when someone pulls on it.
Source: Sources: 10 CFR 50 Appendix B, Criteria V, XV, XVI and XVII; 10 CFR Part 21, in particular 21.21; 10 CFR 50.55a; ASME Boiler and Pressure Vessel Code Section XI (IWA-2000, IWA-4000, IWB-2420, IWB-3600, Appendix VIII); ASME NQA-1 requirements for personnel qualification, control of nonconforming items, corrective action and quality assurance records; ANSI/ASNT CP-189; ASNT SNT-TC-1A; operability determination guidance in NRC Inspection Manual Part 9900; EPRI guidance on commercial grade dedication of items and services.
| Finding type | Clock that starts at discovery | Evidence a sample trace will demand | What closure creates |
|---|---|---|---|
| Degraded or nonconforming SSC found during inservice inspection | Immediate operability determination, then the prompt determination behind it | Timestamped operability status with an owner, the examination report, and the technician's CP-189 scope as at that date | An engineering evaluation and, where the flaw is accepted by analysis, a scheduled successive examination |
| Indication exceeding Section XI acceptance standards | Code evaluation under the code edition and addenda committed for that interval | Flaw characterization, the acceptance basis, and Authorized Nuclear Inservice Inspector review of the report | Either a repair or replacement activity under IWA-4000, or successive examinations under IWB-2420 |
| Nonconforming item received, stored or installed | Criterion XV disposition | Technical justification for any use-as-is disposition, approval signatures, and the commercial grade dedication record where the item was dedicated | A disposition record, plus a corrective action entry if the item screens as a condition adverse to quality |
| Possible defect or failure to comply in a basic component | The 10 CFR 21.21 evaluation clock, running from discovery of the deviation | The applicability decision, notification of the responsible officer, the evaluation, and the written report | Either NRC notification on the Part 21 schedule, or a documented, attributable determination that Part 21 does not apply |
| Repeat low-significance failure on the same component class | Adverse trend review under Criterion XVI | Grouping by component class, damage mechanism and cause code across trains and units | A cause evaluation, extent of condition and extent of cause, and a scheduled effectiveness review |
| Examination performed by personnel whose qualification had lapsed | Immediate decision on re-examination | Certification history with dates, the annual vision examination, and the Appendix VIII demonstration scope actually held | Re-examination, and a review of every deficiency that the invalid examination was used to close |
What an audit sample trace actually does to a deficiency record
An auditor arriving to assess your corrective action program against 10 CFR 50 Appendix B rarely reads your procedure and stops there. They read it to learn what you promised, then pick a handful of condition reports and walk each one backwards: the report itself, the screening decision, the significance classification, the operability call, the examination that supported the technical conclusion, the technician who performed it, the procedure revision in force that day, the instrument and its calibration, the acceptance standard applied, the review and approval signatures, and finally the record that says the work is done. Anywhere that chain has a gap, the trace stops and a finding is written against the program rather than against the component.
This is why the module you buy is not really a task list. Its job is to hold the chain intact and to refuse to let anyone break a link by accident. A system where the condition report references an examination through a free-text sentence, such as "UT performed by contractor, no relevant indications", has already lost the trace. The auditor needs the examination record itself and everything hanging off it, reachable from the condition report without anyone leaving the room to find a binder.
Practically, the deficiency object has to carry hard references rather than descriptions: a link to the examination record, to the personnel qualification in force on the examination date, to the calibration certificate active at that timestamp, and to the revision of the procedure that was current then, not the revision that is current now. Latest-version linking is the single most common defect in general-purpose maintenance systems pressed into nuclear service, and it is invisible until the day someone asks which revision applied.
The four clocks running on one nuclear finding
The first clock is operability. When a degraded or nonconforming condition is discovered on a structure, system or component described in the licensing basis, an immediate operability determination follows, with a documented prompt determination behind it, consistent with the operability guidance in NRC Inspection Manual Part 9900. This clock runs in hours, is owned by operations, and is legally distinct from the engineering evaluation of the flaw. If the deficiency record cannot hold an operability status with its own timestamp and its own owner, that determination ends up in a shift log and the trace breaks at the most sensitive point.
The second is Part 21. If the condition involves a basic component and may indicate a defect or a failure to comply, 10 CFR 21.21 imposes its own arithmetic: inform a responsible officer within five working days of obtaining information that reasonably indicates a reportable defect, notify the Commission within two days of that officer being informed, submit a written report within thirty days, and complete the deviation evaluation within sixty days of discovery. None of these are your corrective action due dates and none should be derived from them.
The third and fourth run together. Criterion XVI requires prompt identification and correction, and for significant conditions adverse to quality it requires the cause to be determined and action taken to preclude repetition, so the significance classification drives whether an apparent cause evaluation or a full root cause evaluation is due and when the effectiveness review follows. Separately, ASME Section XI runs a code schedule of its own, in which a flaw accepted by analysis creates successive examination obligations in later inspection periods. That fourth obligation is created at the moment of closure, which is precisely why it is the one most often lost.
Personnel qualification is part of the finding, not a side file
In general industrial work an expired certification is an embarrassment. In nuclear work it invalidates the examination and, with it, the closure of every deficiency that examination supported. NQA-1 invokes ANSI/ASNT CP-189 for nondestructive examination personnel rather than treating SNT-TC-1A as sufficient, and CP-189 is a standard rather than a recommended practice: education, experience and examination requirements are prescriptive, and the employer cannot quietly write easier ones into a written practice and call it tailoring.
Ultrasonic examination of piping welds carries a second layer. ASME Section XI Appendix VIII requires performance demonstration of the whole examination system, meaning procedure, equipment and personnel together, for the specific examination category involved, administered in the United States through the industry performance demonstration program. A technician is therefore never simply UT Level II. They are qualified for a defined set of configurations, materials and flaw types, and deploying them outside that envelope produces an examination that an auditor will discount entirely, along with the deficiency closure resting on it.
The consequence for the module is concrete. Qualification has to be stored as a dated, scoped record covering method, level, technique, examination category, expiry, the annual vision examination, and near-vision and color contrast where the method demands it. The system then has to validate every examination against the qualification as it stood on the examination date. Warning someone that a certification expires next month is a convenience. Blocking the closure of a deficiency whose supporting examination was performed eleven days after expiry is the control that keeps an audit clean.
Nonconformance and corrective action are different objects
Appendix B separates Criterion XV, the control of nonconforming items, from Criterion XVI, corrective action, and NQA-1 preserves the same separation. Sites blur the two in software constantly, then discover during an audit that a use-as-is disposition was recorded without the technical justification and approval that Criterion XV expects, or that a repeated hardware failure was dispositioned nine times as a nonconformance and never once screened as a condition adverse to quality.
A deficiency module built for nuclear work should force the screening decision to be explicit and attributable. Every raised item is classified; the classification determines whether it is dispositioned as a nonconforming item, entered into the corrective action program, or both; and the classification is itself a record with an owner and a date rather than a dropdown someone changed last Tuesday. Where site significance levels drive cause analysis, the analysis type, the extent of condition and the extent of cause each become deliverables with their own due dates rather than paragraphs buried inside a single closure note.
Extent of condition deserves particular attention, because it is where most audit findings on adverse trends originate. If a weld is found undersized on one train, the record must show what was asked about the other train, the other unit, and the same welder's other work, and it must show the answer rather than the intention. Systems that model extent of condition as a checkbox produce closure packages that look complete on a dashboard and read as evasive to anyone who opens them.
Repairs and replacements close differently from maintenance
When a deficiency is resolved by a repair or replacement activity on a Section XI component, closure is not a maintenance completion. IWA-4000 governs the activity, the work is performed under the owner's repair and replacement plan, and the owner's report is reviewed and signed by the Authorized Nuclear Inservice Inspector. The deficiency record has to reach that document, and it has to reach the code edition and addenda in force under the site's 10 CFR 50.55a commitment for that inspection interval, not the edition that happens to be current when someone opens the file.
The same applies to any code case or relief request relied upon. If a weld overlay, a mechanical clamp or an alternative examination was accepted under a code case, the case number and its approved status belong on the deficiency itself, because that is the first thing an auditor asks when a repair does not match the base code requirement. Storing that provenance as an attachment named scan001.pdf is how a well-reasoned engineering decision becomes an unexplainable one two years later, when the engineer who made it has moved on.
For an NDT service provider supplying a utility, this is where audits concentrate. A NUPIC audit team will ask how your examination reports feed the client's repair and replacement documentation, how you controlled which procedure revision was used, and how a finding raised by your technician on night shift reached the client's corrective action program without passing through anyone's personal inbox. That handover, rather than the examination itself, is the usual weak point, and it is the one a shared deficiency record is genuinely good at fixing.
Decide early whether the system itself is a quality application
Ask this question before the procurement, because the answer changes it. If the system is the record of record for safety-related quality assurance records, it falls inside NQA-1's requirements for records and, where the software performs a quality-affecting function, its software quality requirements as well. Most utilities avoid that outcome by designating a controlled document as the record of record and using the workflow tool as a non-safety management aid. That is a legitimate architecture, but it has to be a stated, documented decision rather than something that happened because nobody asked.
If you take the non-safety route, the module still has to behave itself. Records referenced from it must remain legible, identifiable and retrievable for the retention period, which for lifetime records means longer than the likely lifespan of any vendor. Export has to produce something a records management group will accept without the application present: flat files, readable PDFs, and a manifest that maps identifiers to files. Ask for a real export sample during evaluation and open it somewhere the vendor's software is not installed.
If instead the software will be dedicated or procured as safety-related, the acceptance path involves identifying critical characteristics and verifying them through an accepted dedication method, which for a configurable business application is slow and expensive. Almost nobody should do this for deficiency tracking. The point is not the conclusion, which is usually the same everywhere; the point is being able to show an auditor the reasoning that produced it.
What your aging profile tells an auditor before you say anything
Auditors read backlog the way a physician reads a chart. A corrective action program with a stable, gently aging population of low-significance items and a clean tail of high-significance ones looks healthy. A program in which everything closes exactly on its due date is suspicious, because it usually means due dates are being extended and the extensions are not visible. A program with a large pending-closure bucket suggests the work is finished and the evidence is missing, which is the worst of both positions.
The module should therefore preserve the original due date alongside every extension, record who approved each extension and on what technical basis, and make the count of extensions a first-class field rather than a line buried in comment history. It should also age items from discovery rather than from data entry, because the gap between the moment a technician saw something and the moment it entered the system is itself a metric that a competent auditor will eventually ask to see.
Finally, it should support the trend that Criterion XVI implies, which is recurrence. If the same component class, damage mechanism or cause code keeps appearing at low significance, the program is supposed to notice before an inspector does. A deficiency system that cannot group by mechanism and component class will let a slow-moving adverse trend hide comfortably inside a healthy-looking closure rate for years.
How to evaluate a vendor before you sign anything
Do not run a feature demonstration. Run a trace. Hand the vendor a fabricated condition report and require them to show, inside their system, the examination that supports it, the technician's qualification as it stood on the examination date, the calibration record active at that timestamp, the procedure revision in force, the operability status with its own owner, the significance classification, the cause analysis deliverable, and the successive examination that closure created. Time the exercise. If it takes more than a few minutes on screen with a friendly dataset, it will take days during an audit with a real one.
Then try to break it. Ask them to close a deficiency using an examination performed by a technician whose certification expired the day before. Ask them to record a Section XI acceptance without capturing which code edition applied. Ask them to extend a due date without stating a reason. Every one of those attempts should either fail outright or leave an indelible mark that someone will have to explain. A system that permits all three quietly is a system that will permit all three at two in the morning during an outage, which is when it matters.
Finally, ask what happens on the day you leave. Request a complete export of one unit's deficiency history with attachments and a manifest, and actually read it. Nuclear records outlive vendors, contracts and sometimes the plant's original owner. If a supplier cannot hand you a self-describing archive that opens without their product, then the retention obligation you carry is being underwritten by their continued commercial existence, and no auditor has ever accepted that as a control.
Does deficiency tracking software replace our corrective action program?
No. The corrective action program is defined by your quality assurance program description and site procedures, and software only carries it. What software changes is whether the links a trace depends on are structural or clerical. A tool that stores classifications, cause deliverables, extensions and supporting examinations as connected records makes an existing program auditable. One that stores the same information as free text makes a sound program look weaker than it actually is.
How should Part 21 obligations be modeled separately from corrective action due dates?
As an independent clock with its own owner and its own trigger. The evaluation under 10 CFR 21.21 runs from discovery of the deviation, not from entry into the corrective action program, and the notification steps run from the moment a responsible officer is informed. Deriving one from the other has caused real reporting misses. Give every deficiency an explicit, attributable Part 21 applicability decision, recorded even when the answer is that Part 21 does not apply.
Why does closing a flaw sometimes create future work?
Because of analytical evaluation. When an indication that exceeds the acceptance standards is accepted by analysis under IWB-3600 rather than repaired, ASME Section XI obliges successive examinations of that flaw in subsequent inspection periods under IWB-2420. Closure therefore creates a scheduled obligation rather than ending one. If that obligation lives only in the inservice inspection plan and not on the deficiency record, the two drift apart, and the mismatch is exactly what an ISI audit is designed to surface.
Why do nuclear programs invoke CP-189 rather than SNT-TC-1A?
Because SNT-TC-1A is a recommended practice that an employer tailors through its own written practice, while ANSI/ASNT CP-189 is a standard with prescriptive minimum requirements the employer cannot reduce. Nuclear quality programs need a floor that does not move between suppliers. For a service provider, that means your written practice and certification records must be built against CP-189 from the beginning, not retrofitted in the weeks before a utility audits you.
How long do these records have to remain retrievable?
Long enough that vendor survival becomes a design constraint rather than a commercial detail. Appendix B Criterion XVII and NQA-1 require records to be legible, identifiable and retrievable for defined retention periods, and lifetime records at a plant with an extended license can outlast several generations of software. Insist on a self-describing export, meaning readable files plus a manifest that maps identifiers to documents, and test restoring it on a machine with none of the vendor's software installed.
What does Atlantis actually provide against these requirements?
Inspection management and reporting software for tracking findings, examinations, qualifications and closure evidence; ASNT Level III consulting on written practices and procedures; NDT training to ASNT SNT-TC-1A and ISO 9712 across UT, RT, MT, PT, ET, VT, PAUT and TOFD; digital twin and 3D laser scanning work; and independent report validation. Certification of personnel under a nuclear quality program remains the employer's responsibility under its own written practice. Demo or consultation on request via info@atlantisndt.com.
Built for any business that runs on operations
Most companies do not fail at their craft. They lose time, margin and goodwill in the gaps between the tools they use to run the place — a quoting spreadsheet that does not talk to the job sheet, a job sheet that does not reach accounts, and a compliance folder nobody can search when a client asks. Atlantis closes those gaps by putting the whole operation on one platform, so information is entered once and everything downstream stays in step.
What you can run on it
- Sales and CRM — leads, quotes, follow-ups and the pipeline that tells you what next month looks like.
- Projects and job costing — plan the work, track the hours and materials against it, and see the margin while the job is still live rather than at final account.
- Field and service teams — dispatch, schedules, mobile capture that works with no signal, and sign-off from site.
- Inventory and purchasing — stock, suppliers, reorder points and goods receipt, joined to the jobs that consume them.
- People — records, qualifications and licences with renewal reminders, timesheets, leave and payroll.
- Quality and documents — procedures and forms under revision control, with the audit trail an inspection or accreditation body actually asks for.
- Accounts — invoicing, expenses, multi-currency and the reporting your accountant stops chasing you for.
Affordable, accessible, fully customizable — and we mean each word
Affordable because the whole suite is included rather than sold to you a module at a time, and because implementation is done by people who have run operations rather than by a chain of subcontractors. Accessible because it runs in a browser and on a phone, works for a small team on day one, and does not need a specialist on staff to keep it alive. Fully customizable because your process is the thing that makes you competitive — the software should bend to it, not the other way round.
Industries we configure for
Service businesses and contractors, manufacturing and fabrication, trading and distribution, laboratories and testing houses, engineering consultancies, construction and facilities, and asset owners across energy, marine, aerospace and infrastructure. Inspection and testing is where we started, and it remains the sector we go deepest in — but the platform underneath is general-purpose, and most of what it does has nothing to do with inspection at all.
What happens when you get in touch
A short conversation, not a sales sequence. We ask how the business runs today and where it hurts, show you the platform doing that work, and send a written quote shaped to your region, your team size and the scope you actually need. No obligation, nothing to install first, and no pressure to decide on the call. Reach out and tell us what you are trying to fix.
Related: business management platform · inspection management software · choosing the right category of software · modules · by industry · asset integrity platform. Book a free consultation.