Building an inspection schedule that survives the auditor's sample

What the auditor actually pulls

Auditors do not read inspection programs end to end. They take a sample and follow it. A typical sequence in a mill: pick three assets from the register, ask for the current inspection status of each, then for the last examination performed on one of them, then for the procedure used, then for the qualification of the person who performed it on that date, then for the calibration record of the instrument, then for what was done about the finding. Six questions, perhaps twenty minutes, and the answer to the sixth question determines whether the audit expands.

The reason this method works is that consistency is the thing being tested. A mill that can answer all six questions on the first sample in under five minutes will usually be asked for one more sample and then moved on from. A mill that produces four of the six and promises the rest by tomorrow will be asked for five more samples, because the auditor has now learned that the record is assembled on demand rather than maintained. The expansion of scope, not the initial gap, is what turns a good audit into a bad one.

This is why audit preparation done as a project two months out is the wrong shape of solution. What is being tested is whether the links were made at the time, and links cannot be made retroactively without either falsifying a record or admitting they were absent. The only real preparation is a system that binds the chain at the moment work is assigned and released, so that the record is complete before anyone knows an audit is coming.

The recovery boiler sets the outage, and the outage sets everything else

The recovery boiler dominates a kraft mill's inspection calendar for a reason that has nothing to do with its size. It contains a bed of molten smelt, and water reaching that smelt produces a physical explosion powerful enough to destroy the furnace. That single hazard shapes the industry's whole approach, expressed through the recommended good practices of the Black Liquor Recovery Boiler Advisory Committee, which cover leak detection, the emergency shutdown procedure triggered by indications of water entering the furnace, and the inspection of pressure parts that establishes confidence between outages.

The inspection scope that follows is concentrated and demanding. Lower furnace and floor tubes, particularly composite tubes with a corrosion-resistant clad layer, are examined for cracking and for thinning; the areas around primary air ports and smelt spouts receive particular attention; superheater and generating bank tubes, headers and the economizer each have their own mechanisms. Access requires the boiler cold, washed and scaffolded, and the work has a hard front end and a hard back end because the mill cannot make pulp while the boiler is down.

Because the recovery boiler outage is the mill's largest window, the temptation is to attach every other asset's inspection to it. That is often the right call commercially and the wrong call procedurally, because it means a slip in the boiler outage moves the digester, the evaporators and the lime kiln with it. The schedule needs to represent that dependency explicitly — assets bound to a window, with each one's own interval evaluated against the moved date and flagged individually if it now exceeds its limit — rather than letting an entire year's scope drift as a block.

Interval drift: the arithmetic that writes the finding

Here is the most common defect in a mill inspection schedule, and it is arithmetic rather than negligence. The interval says twelve months. The last inspection was completed on the fourteenth of May. The planner sets the next due date twelve months from completion, which is the following fourteenth of May, and the outage actually starts on the first of June. Repeat that for five years. Each individual gap looks like a modest, explicable slip. The elapsed time between the first inspection and the sixth is now sixty-eight months against a stated sixty, and there is no document anywhere authorizing the extension.

The correct behavior is to recompute the next due date from the previous due date, not from the completion date, and to treat any completion after the due date as a deviation requiring a recorded justification and approval. That single rule change converts an invisible drift into five visible, individually approved extensions — which is a defensible position. The mills that get findings here are almost never the ones that ran late; they are the ones that ran late without generating a record that they had decided to.

A related trap is the informal grace period. Many mills operate a tacit allowance of a few weeks around an interval, applied by whoever is planning, and never written into the program document. In an audit, an undocumented grace period is worse than no grace period, because the auditor cannot distinguish a considered engineering practice from an accident. If a tolerance exists, define it in the program document, configure it in the system as a named allowance with a limit, and report every use of it. Then it is a control rather than a habit.

Where process safety management quietly enters a mill

Mills tend to think of themselves as outside the process safety world that refineries inhabit, and for most of the fiber line that is true. It stops being true around chemical preparation. Chlorine dioxide generation, and the storage and handling of associated chemicals, can place parts of a mill within the scope of OSHA's process safety management standard where listed highly hazardous chemicals are present above their threshold quantities. Once that applies, the covered equipment falls under the mechanical integrity requirements and the inspection program supporting it becomes a regulated program, not a discretionary one.

The mechanical integrity provisions are specific in a way that matters for scheduling software. Inspections and tests must be performed on covered process equipment, following recognized and generally accepted good engineering practice, at a frequency consistent with manufacturers' recommendations and good engineering practice or more frequently if determined necessary by prior operating experience. Each inspection and test is documented with the date, the name of the person who performed it, the identification of the equipment, a description of the inspection or test, and the results. And equipment deficiencies outside acceptable limits must be corrected before further use or in a safe and timely manner with necessary means taken to assure safe operation.

Read that documentation requirement against how mills typically store inspection reports — as PDFs in folders named after the outage — and the mismatch is obvious. The regulation asks for a per-equipment, per-examination record naming a person. A folder of outage reports can eventually produce that, but only by manual reconstruction, and only if the report itself happens to contain all five elements. Structuring the record correctly at capture time costs nothing extra. Reconstructing it during a compliance audit costs weeks.

Binding procedure, certification and calibration at the moment of assignment

The technical core of an auditable schedule is a single design decision: the controls are resolved and frozen when the work is assigned, not looked up when the report is written. When a work order is released for a thickness survey on the recovery boiler floor, the system resolves and stores the procedure revision then in force, the assigned technician's certification status and expiry for that method and technique, and the calibration validity of the specific instrument by serial number. Those values are written onto the task and never updated afterward, because they are a statement about a moment in time.

This produces two behaviors that a folder-based system cannot. First, assignment can be refused. If the technician's certification expires before the planned examination date, or the instrument's calibration lapses mid-outage, the system says so at planning time when it is cheap to fix, rather than at audit time when it is not. Second, the record answers the auditor's question directly, because the question is always about the state of things on the examination date, and the system holds exactly that rather than today's state.

Certification detail matters more in a mill than people expect, because most mills use a mix of employee inspectors and contracted NDT technicians. Under ASNT SNT-TC-1A, certification is issued by the employer under the employer's own written practice, so a contractor's Level II is certified by the contractor and the record must name the certifying employer to be meaningful. Method alone is not enough either: phased array and TOFD examinations require qualification against the procedure and configuration. Store the written practice reference, the method, the technique, the level, the issue and expiry dates, and the vision examination date, and the certification question stops being an audit risk.

Digesters, evaporators and the assets between the boilers

Recovery boiler scope is well defined by industry practice; the assets around it are where scheduling programs get thin. Continuous and batch digesters are the clearest example. Carbon steel digesters operating in hot caustic liquor are susceptible to cracking in the heat-affected zones of welds and to general and localized thinning, which is why inspection practice centers on thorough surface preparation followed by visual and wet fluorescent magnetic particle examination of weld seams, supported by thickness measurement of the shell and of any clad or overlaid surfaces. That scope has a long preparation front end — emptying, washing, ventilating, staging — that dwarfs the examination itself.

Black liquor evaporators, concentrators, tanks and the liquor and condensate lines connecting them make up the population that most often lacks an owner. They fail by thinning, by caustic cracking, by erosion at changes of direction, and by the slow degradation of supports and nozzles that nobody has on a list. The lime kiln adds shell condition, ovality and tire and roller wear on a rotating-equipment logic entirely unlike a pressure vessel's. When an auditor asks how the mill decided which of these assets to inspect and how often, the answer must reference a documented basis, and for many mills it currently references custom.

The remedy is unglamorous: build the asset register first, assign every item an interval with a stated basis and an owner, and accept that some intervals will initially be justified by manufacturer recommendation or engineering judgement rather than by a code requirement. That is a legitimate basis provided it is written down. What is not defensible is an asset that appears in no plan at all, which is the finding that most often follows the question about the liquor lines.

Evaluating a scheduling module for auditability

Run the audit against the demo. Ask the vendor to pick an asset, show you its current status and the basis for it, then drill from the last completed examination to the procedure revision used, the technician's certification as of that date, the instrument calibration as of that date, the readings, the acceptance criteria applied, the disposition and any repair documentation, and finally the recomputed next due date with its rule. If that takes more than two minutes or requires opening a second system, it will fail an audit for the same reason.

Then test the three specific failure modes described above. Ask to see the system refuse an assignment to a technician whose certification expires before the planned date, and confirm the override requires a named approver. Ask how the next due date is derived and confirm it comes from the previous due date rather than the completion date. Ask for the report of every deviation, extension and grace period used in the last twelve months, and confirm it exists as a standard report rather than a query someone would have to write.

Atlantis configures inspection scheduling on an Odoo ERP foundation built for inspection organizations and asset owners, with interval rules and bases, outage windows and dependencies, certification and calibration binding at assignment, CML-level thickness history, and deviation reporting as standard structures. It is affordable, accessible and fully customizable, and the fastest way to evaluate it is to hand us three of your own assets and let us build the audit chain in front of you. Contact info@atlantisndt.com to arrange that session.

Request a consultation