Proving why the next inspection date is the date it is

What the auditor is actually testing

Utilities preparing for a sanitary survey, an ISO 55001 surveillance visit or a client audit under a contract operations agreement often prepare the wrong thing. Effort goes into making the schedule look complete: no overdue items, every asset with a future date, a clean report. The auditor spends very little time on that. What they do is pick three or four assets, more or less at random, and follow one thread from the asset back to the authority that governs it and forward to the evidence that the last inspection happened as the record claims.

The thread breaks in predictable places. The date exists but nobody can name the rule that produced it. The rule is named but the version cited was superseded two revisions ago. The inspection happened but the report is in a shared drive filed by contractor and month, so retrieving it for this specific asset takes ten minutes of clicking while the auditor watches. Or the date was extended and the justification lives in an email from someone who has since left.

None of those are failures of inspection. They are failures of record structure, and they read to an auditor as a control that is not really operating. A utility can be inspecting diligently and still take a finding, because the standard being audited is whether the management system produces traceable, repeatable decisions — not whether the assets happen to be in good condition. That is the specific gap an interval engine is bought to close.

In a water plant, the interval rarely comes from a corrosion rate

The mental model imported from oil and gas is that a next inspection date is derived: measure thickness, compute a rate, subtract the minimum, divide, cap it against the code. In water and wastewater that model applies to a minority of assets. Most dates are set by a rule that simply states an interval — a state drinking water regulation for reservoir interior inspection, a state boiler law for a registered vessel, a five-year cycle for the risk and resilience assessment and emergency response plan required under America's Water Infrastructure Act, a permit condition, an insurer's requirement, or the utility's own asset management plan.

This is not a lesser form of interval management; it is a different one, and it has its own failure mode. When an interval is a number in a regulation rather than the output of a calculation, the risk is that nobody can say which regulation, in which version, and whether it still says what the schedule assumes. Rules change. A state health department revises a reservoir inspection frequency, or a permit is reissued with a new condition, and the schedule carries on producing dates from a rule that no longer exists.

So the engine's core function shifts. Instead of holding readings and computing, it must hold a rule object per asset: the citing authority, the clause or permit condition, its effective date, the interval it imposes, and the review date at which someone confirms it is current. Assets that genuinely are rate-driven — the steel that does corrode, the piping the utility has chosen to manage under API 570 — sit alongside as a second derivation path. Both produce dates; only one produces arithmetic.

The jurisdictional vessel is not an API 510 vessel

Every water and wastewater plant of any size has pressure vessels: plant and instrument air receivers, hydropneumatic tanks on booster systems, hot water storage, sometimes autoclaves or small boilers. These are registered with a state jurisdiction, carry a National Board number, and are inspected on the schedule that state's boiler and pressure vessel law sets, by a commissioned inspector working to NBIC NB-23 Part 2. Their construction code is ASME Section VIII Division 1. API 510 does not govern them unless the owner-user has deliberately adopted it, and even then the statutory interval binds.

This matters because the intuitive software behaviour is wrong here. An engine that sees a Section VIII vessel and applies an API 510 style derivation — half remaining life, capped at ten years internal and five years external — will produce a date that looks entirely professional and may be years later than the state permits. The certificate lapses, the vessel is operating without a current inspection, and the finding is not a technicality. It is the plainest kind of non-compliance an auditor can write.

The engine therefore needs a concept of a binding statutory interval that sits above any calculation, is attached to the specific vessel and jurisdiction, and cannot be extended by a remaining-life result. Where the utility also wants condition-based insight — thickness trending on a receiver with a known condensate corrosion problem, for instance — the calculated interval should be visible as advisory alongside the statutory one, never in place of it.

For steel water tanks, coating condition is the driver

A welded carbon steel potable reservoir designed to AWWA D100, coated to AWWA D102 with a system certified to NSF/ANSI/CAN 61, and cathodically protected, will show very little general shell loss over decades. Deriving a remaining life from a shell corrosion rate on such a tank yields a number in the hundreds of years, which is arithmetically fine and operationally useless. What actually deteriorates is the coating system, and when it fails the consequence is simultaneous: accelerating localised corrosion, and a water quality issue from coating disbondment and tuberculation in a potable asset.

That means the interval driver is a graded condition observation rather than a rate. Interior condition is captured on a washout inspection or by remote operated vehicle without taking the tank out of service, and reported as a rust grade under ASTM D610 or a visual comparison to SSPC-VIS 2, along with disbondment, holidays, blistering and the condition of the anodes. Those observations do not divide into anything. They map onto an interval band through a rule the utility has to write down and defend.

The engine's requirement follows: it must accept a condition index as a first-class interval input, hold the grading standard used, and let the utility define and version the mapping from condition band to interval. An auditor will accept an interval keyed to a documented condition grading rule without difficulty. What they will not accept is a shorter interval applied because someone was uneasy about the tank, with nothing recorded about why.

Assets where a remaining life is the wrong answer entirely

Most utilities moved from chlorine gas to bulk sodium hypochlorite, in part to get below the OSHA threshold quantity and out of process safety management coverage. The trade is a chemical that attacks what stores it. Bulk hypochlorite tanks are HDPE, crosslinked polyethylene or FRP; the associated valves, fittings and small-bore pipework are often stainless steel that suffers pitting and crevice attack in hypochlorite service. Neither has a corrosion rate in the sense the interval formula assumes. Polymer tanks are assessed against manufacturer service life with visual and, where appropriate, acoustic emission or ultrasonic techniques suited to the material.

Wastewater adds mechanisms further from the model still. In a digester or a force main, hydrogen sulphide in the vapour space is oxidised to sulphuric acid on wetted surfaces above the liquid line, attacking concrete crowns and steel covers in a band that fixed thickness locations on the shell will never see. Condition assessment here is about where you look and with what technique, and the interval is a judgement about mechanism progression, not a division.

The important software behaviour is negative rather than positive. The engine must be capable of holding an asset for which no rate exists and no thickness-derived date will be produced, with an explicit statement of the assessment method that applies instead. Systems that insist every asset yield a computed date encourage someone to enter a plausible nominal thickness for a plastic tank so the record looks complete. That fabricated input then propagates into a date that has the appearance of engineering and none of the substance, which is the single worst outcome an audit can uncover.

The evidentiary chain the record has to carry

Reduced to its bones, what an auditor traces is a chain with seven links: the asset and what it is made of; the authority that governs its inspection, cited specifically; the rule or calculation that authority implies; the inputs that rule consumed; the resulting date; the person who accepted that date and when; and the evidence that the last inspection was performed as recorded. Any link that requires a person to remember something is a broken link, because the person is not in the room and eventually not in the job.

Two links fail more than the rest. Authority citation fails because it lives in the head of whoever built the schedule. Acceptance fails because the schedule was populated in bulk during implementation and nobody signed for anything. Both are cheap to fix at build time and expensive to reconstruct under audit pressure, which is why the moment of buying a system is exactly the right moment to insist on them.

The eighth item, not part of the chain but the first thing asked about, is the override. Intervals get extended for real reasons: a tank that cannot be taken out of service in a drought year, an outage deferred by a capital project. An extension is defensible when the record shows who authorised it, on what technical basis, for how long, and what compensating measure was put in place. It is indefensible when the date simply moved. An engine that permits a date to be edited without capturing those four things will produce audit findings no amount of diligence downstream can undo.

How to evaluate before the audit, not during it

Run a mock trace. Choose four assets that span the site's authority types: a potable reservoir, a jurisdictional pressure vessel, a hypochlorite tank and one piping circuit the utility manages under adopted API 570 practice. For each, ask the system to produce, unaided, the governing authority with citation, the rule applied, the inputs, the date, the acceptor and the last evidence file. Time it. If any of the four takes more than a few minutes, the same asset will take longer with an auditor watching.

Then probe the negative cases, which is where systems separate. Ask what happens if someone attempts to set a jurisdictional vessel's next date beyond the statutory interval. Ask what a hypochlorite tank returns when no thickness data exists. Ask the system to show every asset whose governing rule has not been reviewed since a stated date — rule staleness is invisible until it is a finding. Ask for the list of every date that has been overridden in the last two years, with justifications attached.

Finally, look at how evidence attaches. Reports filed by contractor and month are a filing system; reports attached to the asset, with the inspection event they belong to, are a record. The difference costs nothing at implementation and everything at audit. For a walkthrough against your own asset register and permit conditions, request a consultation at info@atlantisndt.com.

Request a consultation