The remaining-life record an NDT service provider can hand to an auditor

What the auditor is actually testing

An audit of a remaining-life deliverable is almost never a technical dispute about API arithmetic. The rules are short and unambiguous, and competent auditors assume you can divide. What they test is whether the number in front of them can be traced backwards to physical evidence, and whether the same inputs would produce the same number if someone else ran it. That is a records question wearing an engineering costume.

The specific mechanism is a vertical trace. An auditor picks one line item from a report you issued — one circuit, one shell course, one nozzle — and walks it down. Where did this thickness come from? Who took it? Under which procedure, at which revision? On which instrument, verified when, against which block? What corrosion rate did that produce, over what baseline? Against what minimum thickness? And therefore why is the next inspection due on this date? A trace that survives all seven questions passes. A trace that dies at question four fails regardless of how correct the arithmetic was.

Providers usually fail at the joins rather than at any single record. The certifications exist, in the training folder. The calibration records exist, in the equipment binder. The readings exist, in the field sheets. Nothing links them to the specific number under examination, so reconstructing the trace becomes a multi-day archaeology exercise performed in front of the auditor. That reconstruction is the finding, even when it eventually succeeds.

You compute it, someone else owns it — and impartiality is in scope

A service provider occupies an awkward position in the integrity chain. The owner-user's authorised inspector makes the determination under API 510, 570 or 653. The provider supplies the measurements and, increasingly, the calculation as a contracted engineering service. That arrangement is entirely normal and entirely auditable, but only if the record states clearly which party did what.

Where this becomes sharp is under ISO/IEC 17020. An accredited inspection body is assessed on impartiality, and the independence type it holds constrains what it can do for a client whose asset it also inspects. A provider that measures, calculates, recommends the interval and then wins the follow-up inspection work is describing a conflict that has to be actively managed and documented, not one that can be ignored because it is common. Laboratories operating under ISO/IEC 17025 face an equivalent question about the boundary between test results and interpretation.

The practical consequence for software is that the record must carry roles, not just users. Who measured, who calculated, who reviewed, who approved, who is the client's accepting authority, and whether any of those are the same person. An engine that stores a single 'created by' field cannot answer an impartiality question at all, which means the answer gets assembled by hand and asserted verbally.

The corrosion rate is where the audit goes

Every interval rule in the API codes reduces to a corrosion rate and a minimum thickness, so the corrosion rate is where a competent auditor spends their time. The first question is short-term versus long-term. API practice is to evaluate both and to be deliberate about which governs, because they diverge for real reasons: a process change, a chemical injection upset, a new dew point. A provider reporting one rate with no evidence the other was considered has skipped the step the code cares about.

The second question is measurement uncertainty, and it is the one that catches most providers off guard. A gauge that displays to 0.001 inch may be specified to an accuracy several times that. Two surveys four years apart on a slowly corroding circuit can produce a difference entirely inside the instrument's own band. Divide that difference by four and you have a corrosion rate that is arithmetically impeccable and physically meaningless. The honest system flags it: this rate rests on a difference smaller than the stated accuracy of the instrument that produced it.

The third question is repeatability of the location itself. A condition monitoring location is only a trend if the probe lands in the same place each time. Move fifteen millimetres onto a weld cap, a grind mark or a different pipe schedule and the trend records wall loss that never occurred. This is why CML definition — photograph, dimension from a datum, surface preparation — belongs in the record next to the reading and not in a technician's memory.

Minimum thickness: the input most often wrong

If corrosion rate is where auditors look, minimum thickness is where the errors actually are. There is no single t-min. There is a pressure design minimum from the construction code, a structural minimum that can govern on large-diameter thin-wall piping regardless of pressure, and an owner-user specified value that may be more conservative than either. Choosing among them is an engineering decision that has to have an owner and a date. In most spreadsheets it is a constant typed once and copied down a column.

The second recurring error is the baseline. Corrosion rate needs a starting thickness, and using nominal wall as that baseline fabricates loss that never happened. Seamless pipe is manufactured to a wall tolerance that permits it to be meaningfully thinner than nominal from the mill. Plate can be thicker. Subtracting today's measured wall from a nominal value therefore produces a rate composed partly of manufacturing tolerance. The correct baseline is the first measured thickness, and the record has to be able to say which one it used.

Temperature is the third. Ultrasonic velocity in steel falls as temperature rises, so an uncorrected reading taken on hot service reads thin. Take a baseline cold and a follow-up hot and you manufacture a corrosion rate out of thermodynamics. Capturing surface temperature with every reading, and applying and recording a correction, costs a field second and closes an entire category of audit finding.

The evidence chain behind one date

Assemble the chain deliberately and it is short. A next-due date rests on a remaining life. A remaining life rests on a current thickness, a corrosion rate and a minimum thickness. Each thickness rests on a reading. Each reading rests on a technician, a procedure, an instrument, a calibration block, a couplant, a temperature and a location definition. Each technician rests on a certification under the applicable scheme — SNT-TC-1A or CP-189 in a written practice, ISO 9712 under a certification body, NAS 410 in aerospace — plus current vision examination and, where the written practice requires it, a documented annual evaluation by the employer.

In a compliant system these are foreign keys. In a spreadsheet they are conventions, which means they are only as good as the person who maintains them. The difference shows up the first time a technician's certification lapses mid-campaign. In a linked system, every reading taken after the lapse date is flagged automatically and the exposure is a report you run in a minute. In a workbook, nobody notices until an auditor cross-references the training folder against the field sheets, and then the exposure is however many reports were issued in the interim.

There is a second-order benefit worth naming. Once the chain exists, the corrective action after a finding is bounded. You can state exactly which deliverables are affected, notify exactly those clients, and re-issue. Without the chain, the only honest answer to 'which reports are affected?' is 'we will have to check all of them', which is what turns a minor finding into a major one.

Different audits ask different questions of the same record

A client audit is commercial and specific. The client's integrity engineer wants to know that the data feeding their mechanical integrity programme is sound, and they will usually pick items they already suspect. Expect questions about CML repeatability, about outliers you kept and outliers you discarded, and about whether your rate calculations match the ones their own system produces from your data.

An accreditation assessment under ISO/IEC 17020 or 17025 is systemic. The assessor cares less about any individual number and more about whether the management system controls the process: impartiality arrangements, personnel authorisation, procedure control, equipment records, review before issue, and the handling of nonconforming work. They will still trace one number end to end, but as a test of the system rather than of the number.

A process safety audit under 29 CFR 1910.119 arrives through the client and reaches you as a contractor. The mechanical integrity provisions require inspection and testing at frequencies following recognised and generally accepted good engineering practice, with results documented, and deficiencies corrected before further use or with a documented basis for safe continued operation. As the contractor supplying that documentation, you are expected to produce records that satisfy the operator's obligation, not merely your own. Aerospace work under NAS 410 and Nadcap adds a fourth and much more prescriptive personnel and process audit on top.

The eight weeks before an audit, and how to evaluate the engine

If an audit is scheduled, the highest-value preparation is not rewriting procedures. It is running the vertical trace yourself on a random sample before someone else does. Pick ten line items across different clients, methods and technicians, and walk each one down to physical evidence. Time it. Whatever breaks is what the auditor will find, and you now have weeks rather than minutes to fix it. Providers who do this routinely stop being surprised in audits, which is most of the benefit.

The second preparation is a lapse sweep: every certification, vision examination, annual evaluation, procedure revision and instrument verification against the date range of every report issued in the audit period. This is a query in a system and a week of manual cross-referencing in a folder structure, which is a reasonable way to decide whether the system is worth having.

Evaluate an interval engine on exactly these two capabilities. Ask a vendor to demonstrate a vertical trace from a due date down to a technician certification in under a minute. Ask them to show a report listing every deliverable affected by a hypothetical expired certification. Ask what happens when a corrosion rate rests on a difference inside instrument accuracy — silence is the wrong answer. Ask whether short-term and long-term rates are both retained. Ask who can override a derived date and whether the override survives forever on the record. To see this run against your own reports and audit history, request a working session at info@atlantisndt.com.

Request a consultation