Standardising deficiency tracking across an offshore portfolio

The roll-up fails before the data does

The request that sends people looking is nearly always the same. Someone at group level asks how many open high-severity findings the portfolio is carrying. Seven installations return seven numbers, the numbers are added, and the total is quietly meaningless, because high was defined seven times by seven different people over twenty years and nobody wrote the definitions down.

The reflex is to call it a data quality problem and commission a cleanup. It usually is not. Each site's data is internally consistent, defensible and understood by the people who produced it. What is missing sits above the data: a shared statement of what a class means in consequence terms, and a mechanism that keeps the local meaning and the fleet meaning attached to the same record instead of forcing a choice between them.

That is why the first hour of this work is not software configuration. It is deciding, in writing, that a fleet class is defined by consequence and by the presence or absence of a critical element, not by how soon somebody wants the job done. Everything else in the module follows from that sentence.

Severity means something different on every installation

A typical portfolio inherits at least three vocabularies. A fixed platform commissioned in the 1990s still runs Cat A through D from its original commissioning punch list. A floating production unit uses the shipyard's snag categories, which were designed to close out construction defects and have no concept of in-service degradation at all. An acquired asset arrives with P1 to P4 from the seller's CMMS, where P1 was defined by a maintenance planner rather than an integrity engineer.

Those three scales do not disagree at the extremes. Everyone agrees that a live hydrocarbon leak is the top class. They disagree in the middle, which is where almost all the population sits: wall loss with margin remaining, a cracked support, a failed coating over a splash-zone weld, a gas detector out of calibration. One scale sorts the middle by how soon the job can be done, another by how bad it would be if nothing were done, and the two orderings are not the same list.

The way through is aliasing rather than replacement. The entry form keeps the local words; the database stores one fleet value. Historic records are mapped through the same table, with a named owner per site signing off the mapping, so that when the numbers change on the first roll-up after go-live, everyone can see exactly which mapping decision moved them.

Due dates must be computed, not typed

A free-text due date field turns the register into a negotiation. Offshore, the negotiation has a specific shape: the supervisor knows there is no walk-to-work vessel until the second quarter, so the date typed is in the second quarter, and the overdue report never shows the eight-month exposure that actually exists. The metric has absorbed the problem it was built to expose.

Computed dates fix this by separating two facts that a typed date fuses together. The required date comes from the fleet class and, for engineering-limited findings, from the remaining-life date in the fitness-for-service case. The achievable date comes from the campaign plan. When they diverge, the gap is visible, and the gap is the thing worth reporting to a duty holder. An extension is then a first-class event with an approver, a reason and the original date retained, rather than an edit that leaves no trace.

There is a companion trap worth designing against. On sites where the clock is the only metric, findings get closed and immediately re-raised under a new number, which resets ageing to zero. The register should carry lineage, so a re-raise inherits the original raised date and the fleet ageing chart tells the truth even when local behaviour does not.

Safety and environmental critical elements need their own clock

Offshore is one of the few sectors where the regulatory framework itself names a subset of equipment and attaches a written performance standard to it. Under a SEMS programme built to API RP 75, and under the safety case regimes that govern other basins, the elements whose failure would cause or fail to prevent a major accident are identified in advance, and their required performance is documented before anything goes wrong.

That changes what a deficiency record has to know. When a finding lands on a tag inside that set, the acceptable response is not a manager's judgement of urgency; it is whatever the performance standard says, and if the element cannot meet it, the operation runs on a documented deviation with compensating measures and a time limit. A register that cannot tell the two populations apart forces someone to make that call from memory, at the worst possible moment.

Most generic systems will let you tick a critical box on the finding. That is not the same thing. The criticality belongs to the tag, it is inherited by every finding raised against that tag, and it should drive the workflow automatically, including who is notified, which approvals are required to defer, and whether a deviation record is mandatory rather than optional.

Temporary repairs are the register's largest hidden liability

Offshore carries more engineered temporary repairs than any other sector, for a simple reason: replacing a spool means a shutdown, a lift and often a vessel, while fitting a clamp or a composite wrap means a rope-access team and a permit. Done properly, under ASME PCC-2 and supported by an API 579 assessment, these are legitimate engineering, not a shortcut. Done in a register that has no place to put them, they become invisible debt.

The failure mode is precise. The finding is marked closed when the wrap goes on, because the leak stopped and the immediate risk went away. The open count improves, the ageing chart improves, and the fact that forty-one wraps across the portfolio reach the end of their engineered life within eighteen months exists nowhere except in the heads of three corrosion engineers, one of whom is about to retire.

Model the repair as its own object. Install date, engineered design life, expiry, the assessment that justified it, the re-inspection interval, and a link back to the underlying finding which stays open in a state of its own. The fleet report then answers a question no spreadsheet was answering: which contained defects expire inside the next year, and which of those need marine support to resolve permanently.

Bed space, weather and vessels decide when a finding closes

Onshore, execution capacity is roughly elastic; you can add a crew. Offshore it is hard-capped by persons on board and by the flight schedule that feeds them. A finding that needs two technicians for three days is not competing for budget, it is competing for bunks against a drilling campaign, a shutdown crew and a class survey. That is why days-open, taken alone, is an unfair measure of an offshore integrity team.

The register should therefore carry an execution constraint on every finding: rope access, scaffold, diver or ROV, crane lift, hot work, isolation or full shutdown. Once that attribute exists, the backlog sorts itself into campaign scopes without anyone building a spreadsheet, and the annual planning conversation changes from arguing about priority to sizing the spreads needed to clear a defined population.

It also makes the portfolio comparison honest. A platform whose backlog is dominated by shutdown-only items and a platform whose backlog is rope-access work are not performing differently; they are constrained differently. Reporting them against the same ageing target guarantees that one team spends every review defending arithmetic instead of discussing risk.

Normalise by coverage, or the least-inspected asset wins

Any ranking built on raw open-finding counts rewards not looking. The installation that completed sixty per cent of its examination plan raises fewer findings than the one that completed all of it, and appears at the top of the league table for it. Over two or three reporting cycles, that incentive is strong enough to change behaviour without anyone deciding to change behaviour.

The correction is to publish coverage beside condition. Findings per examination completed, findings per CML read, plan adherence as a percentage, and raise rate by discipline. When a site's raise rate falls while its coverage holds, that is a signal worth investigating, and it is invisible in absolute counts.

A related distortion appears in ageing. Mean age across the fleet is dragged around by a handful of very old records, and can be improved simply by closing the oldest items whatever their risk. Report the age distribution and the count of findings older than their required date by class, rather than a single average anyone can move by cherry-picking.

Offline capture and the conflicting-edit problem

Bandwidth offshore is rationed and prioritised, and during a shutdown it is prioritised away from inspection. Any module that assumes a live connection to save a record will be worked around within a week, usually by writing on paper and typing it up onshore, which quietly reintroduces every date and attribution error the system was bought to remove.

The requirement is full offline creation and editing, including records another person raised, with attachments captured at full resolution and queued separately for resumable upload. Reconciliation must be field-level. Last-writer-wins on the whole record means a thickness reading taken at height is silently replaced by an onshore edit to a description field, and nobody will ever find out.

This is easy to test and hard to fake. In the demo, put the tablet into airplane mode, edit a finding on it, edit the same finding from a desktop, then reconnect. Ask to see both versions, the merged result and the audit entry. A system that cannot show you all three is going to lose data on a platform.

How to evaluate the module before you commit

Bring your own mess. Take one real finding from each installation, in each site's own words, and ask to see them entered on their local forms and then counted correctly in a single fleet report. Ask what happens when you change one mapping decision, and whether the historic numbers move with it.

Then push on the three things that separate a register from a filing cabinet. Ask to see a due date that cannot be typed. Ask to see a temporary repair with an expiry that keeps its parent finding open. Ask to see a finding closed with evidence, and then ask how the closure would be demonstrated to an auditor three years later, after the inspector who closed it has left and the contractor has changed.

Atlantis configures this module from a working NDT and integrity practice rather than from a generic workflow template, and the fleet severity rubric is built with your inspection leads rather than delivered to them. Atlantis NDT is affordable, accessible and fully customisable; a walkthrough against your own data is available on request through info@atlantisndt.com.

Request a consultation