The audit does not test your readings — it tests what they join to

What an auditor actually asks for

Teams preparing for an audit usually rehearse the wrong thing. They tidy reports, re-print trend charts and confirm that remaining lives look sensible. The auditor, whether from ABSA reviewing an owner-user inspection organization's quality management system, a client's integrity assurance group, or a certifying body, does something quite different. They pick a small number of items almost at random and pull on each until something comes apart.

The pull goes like this. Take one piece of equipment. Show me its current remaining life. Show me the reading that produced it. Show me who took that reading and what certified them for that method on that day. Show me the instrument and its verification for that day. Show me the procedure they worked to and its revision at that time. Show me the inspection plan and which locations it called for. Show me the ones you did not do and what you decided about them. Each step is a join, and a record fails at whichever join it cannot make.

This is why an audit is not really a test of inspection quality. It is a test of whether your record was built as evidence or as reporting. A team can do excellent ultrasonic work and still fail, because the excellence lived in individuals and field notebooks rather than in a structure that survives their absence. Conversely a record with modest data quality but complete, honest attribution and a well-maintained exclusions register audits far better than most people expect.

The exclusions register is the first thing they open

In oil sands operations, the gap between the inspection plan and the executed campaign is wide and it is not a sign of poor performance. Lines run hot and cannot be gauged in service. Scaffold gets reallocated when a critical path job slips. Insulation removal is refused because the circuit is in service and the cladding will not go back on before weather. A CML sits under a pipe support shoe, which is both the place you most want to measure and the place you cannot reach. Produced water and sludge-handling equipment can carry naturally occurring radioactive material, and gaining access needs a radiation work permit that was not in the plan.

Every one of those is a defensible reason. None of them is defensible when it exists only as a memory. The exclusions register turns a gap into a managed decision: a coded reason, the person who accepted it, the date, the compensating measure if any, and the trigger that will lift it, usually the next outage. An auditor reading that register sees an organisation that knows where its blind spots are. An auditor finding blank cells sees an organisation that does not.

The register also has to be alive rather than archival. If a CML has carried the same exclusion for four consecutive outages, that pattern should surface in a report, because at that point the exclusion has quietly become a permanent decision that nobody ever formally made. This is one of the highest-value reports a thickness history can produce and one that no spreadsheet has ever produced spontaneously.

Rotating a slurry spool rewrites the geometry of your history

Oil sands hydrotransport moves a slurry of bitumen, sand, clay and water at velocities chosen to keep solids in suspension, and the quartz in that slurry is harder than the pipe. Wear is not corrosion; it is mechanical removal, concentrated at the invert of horizontal runs, at the outer radius of bends and downstream of any flow disturbance. Rates are quoted in millimetres per month on the worst spools, and the operating response is to rotate the spool on a schedule so fresh wall moves into the wear path.

That practice is entirely sensible and completely destructive to naive trending. Thickness histories are keyed to a location, usually a clock position on a station along the spool. After a rotation, the point labelled six o'clock is metal that used to be at nine or twelve, with its own quite different history. Compare the new reading to the old one at the same label and you get a large apparent thickness gain or a nonsense loss, and the corrosion rate that comes out of it never happened.

So the record has to treat the physical component and the measurement location as distinct things, with a rotation event that re-maps between them. Then the history can be read two ways: what has happened to this piece of metal, and what has happened at this position in the flow. Both matter. The first tells you when the spool is due for replacement; the second tells you where wear is being generated so the piping design can be changed. An auditor asking about a spool that shows a thickness increase will accept a rotation log immediately and will not accept anything else.

Erosion is not corrosion, and annualising hides it

The default arithmetic in most inspection systems assumes a roughly steady electrochemical process: loss accumulates gradually, an annual rate is meaningful, and remaining life is thickness margin divided by that rate. Erosive wear does not behave that way. It is proportional to throughput, particle loading and velocity, all of which change with ore quality, production rate and process upsets. A month of high sand content can remove what a normal quarter would.

Two consequences follow for the record. First, the reading interval on erosion-controlled circuits has to be short enough that the interval itself is not longer than the remaining life it is meant to protect, which sometimes means monthly or per-outage measurement rather than annual. Second, the history has to keep enough resolution to see rate changes. A system that stores an annualised rate rounded to two decimal places, or that averages across a circuit, will report a steady picture right up until a spool fails.

Storing throughput or operating hours alongside the readings converts a calendar rate into a rate per unit of production, which is both physically better founded and far more useful for planning. When the plant runs ninety days at elevated rate, the integrity engineer can predict the wear rather than discover it. That capability is not exotic, but it depends entirely on the reading history being granular, complete and joined to operating data instead of collapsed into a single trend line.

The upgrader is a different plant with different traps

Bitumen upgrading brings mechanisms that the mine and extraction side never sees. Naphthenic acid corrosion in hot crude and vacuum service is a function of total acid number, temperature, velocity and sulphur content, and it attacks in a smooth, gouged pattern that appears exactly where turbulence is highest. Sulfidation follows temperature and chromium content, so the material of construction determines the rate as much as the process does. Hydroprocessing units bring high temperature hydrogen attack, managed through API RP 941 and its Nelson curve relationships.

The trap that catches records rather than metallurgists is the low-silicon carbon steel problem described in API RP 939-C. Carbon steel with low silicon content sulfidises considerably faster than otherwise identical steel with normal silicon, and the difference is invisible from outside the pipe. A spool replaced during an outage with material from a different heat can thin at several times the rate of the run it sits in, and the thickness history will show a single anomalous CML that looks like a bad reading. Unless the record carries material identity and heat traceability against the component, nobody connects the dots until there is a leak.

Hot service also changes the reading itself. Ultrasonic velocity in steel falls as temperature rises, so an uncompensated reading on a line at three hundred degrees reads thicker than the metal actually is. The common field correction of roughly one percent of indicated thickness per hundred degrees Fahrenheit above ambient is an approximation that should be verified against a heated reference block for the alloy and the instrument in use. What matters for the record is that surface temperature at the time of measurement and the compensation applied are both stored, because a later engineer cannot otherwise tell whether the correction was made once, twice or not at all.

Certification and calibration are joins, not attachments

Most organisations hold their personnel certifications and their instrument calibration certificates, often carefully, in a document management system or a shared folder. That is storage, not integration. The audit question is never whether you possess a certificate; it is whether you can demonstrate that this particular reading was taken by someone qualified and with equipment verified, on that particular date. A folder of PDFs cannot answer that without a person spending an afternoon on it, and an auditor sampling ten readings will not wait.

Building it as a join is straightforward once the reading carries a technician identity and an instrument identity. The system then holds certification records with validity windows and calibration or verification records with dates and reference standards, and the answer becomes a lookup. It also becomes preventive rather than forensic: a reading captured with an instrument whose verification has lapsed, or by a technician whose vision check expired last month, can be flagged at the moment of capture instead of discovered in an audit two years later.

The same structure supports the awkward conversation that follows a lapse. If a technician's certification was found to have expired for six weeks, the immediate question is which readings fall in that window and what their consequence is. With the join in place that is a query returning a list. Without it, the honest answer is that you do not know, and the auditor's finding will be scoped to everything rather than to the six weeks it should have covered.

Turnaround data from four contractors and one written practice

An oil sands turnaround compresses an enormous amount of inspection into a few weeks. Multiple service companies mobilise, each with its own written practice, its own certification scheme, its own instruments and its own data formats. Readings arrive by the thousand, often as spreadsheets emailed at the end of a shift, and the integrity team's job during the outage is to make repair decisions faster than the data can be properly assimilated.

The audit exposure created here is specific and predictable. Which written practice governed each contractor's personnel: theirs, or the owner's? Did the owner review and accept it, and is that acceptance dated and stored? Were procedures approved by a Level III, and which revision was in force during the outage? When a contractor's technician recorded a reading against a CML that did not exist in the owner's register, what happened to it? These questions are almost never asked during the outage and almost always asked afterwards.

The practical remedy is to make the ingestion path the same for everybody and to make it refuse ambiguity at the edge. Contractors submit structured data with technician, certification reference, instrument serial, procedure reference and CML identity, and readings that cannot be matched to a known CML are held in a queue rather than dropped or force-fitted. The queue is uncomfortable to look at during a turnaround, which is precisely its value: it converts a silent data loss into a visible, assignable task while the crew is still on site.

Testing the record before the auditor does

The most useful preparation for an audit is to run one on yourself with the same method the auditor will use, and to do it on your least favourite unit rather than your best. Pick five pieces of equipment across different services: a hydrotransport spool, a SAGD steam line, an upgrader hot circuit, a produced water vessel and a storage tank. For each, start from the published remaining life and walk the chain of joins backwards until you either reach a mill certificate or hit a wall.

Record where each walk stops, because the stopping points are the audit findings you have not received yet. Typical stops are a corrosion rate with no retrievable inputs, a reading with an inspector's initials and no certification link, an instrument identified only as the shop unit, a CML that appears in the plan but has no readings and no exclusion, and a value that was changed after issue with no author. None of these are unusual and none are catastrophic; all of them are fixable if you find them yourself.

Then fix them additively. Do not delete the questionable history, mark it. A reading whose attribution is unknown at source is a legitimate historical record and should be labelled as such rather than removed or invented. An organisation that can show an auditor a quantified picture of its own data quality, with a dated remediation plan and evidence of progress, is in a much stronger position than one presenting a record that looks immaculate until the third question. Auditors are far more comfortable with known and managed weaknesses than with surprises.

Request a consultation