What an Inspector Actually Asks About Your Thickness Data

The audit does not test your metal, it tests your record

An inspector arriving to look at mechanical integrity in a pharmaceutical facility has no way to verify a wall thickness. They cannot climb the WFI loop with a gauge. What they can do, and reliably will, is take a value from a report and walk it backwards. Show me where this came from. Show me the raw reading. Show me the calibration certificate for that instrument covering that date. Show me the training record of the person who took it. Show me the three points that were dropped from this survey and who approved dropping them.

This is a fundamentally different examination from the one a thickness programme is usually built to survive. The engineering question is whether the equipment is fit for continued service; the audit question is whether the evidence supporting that conclusion holds together. A programme can be technically excellent and fail the audit, because the technical excellence lived in an engineer's judgement rather than in a record another person can follow.

It also means the observations that hurt are structural, not numerical. A finding that a wall is thinner than expected is a maintenance issue with an obvious remedy. A finding that values in the report cannot be traced to source data, or that records were altered without an audit trail, is a data integrity observation, and data integrity observations escalate. They call into question every other record generated by the same process, which is why they consume disproportionate remediation effort and why they are the thing to design against.

ALCOA plus, applied to a wall thickness value

The data integrity principles are usually taught with batch records in mind, but they map cleanly onto ultrasonic thickness data, and the mapping exposes where most programmes fail. Attributable requires that the technician be a controlled identity linked to a credential, not two initials in a column. Legible is nearly free in an electronic system but is routinely lost when the only true record is a photograph of a handwritten field sheet. Contemporaneous is where most programmes actually break: a crew measures across three days and someone types the sheet the following week, which makes the electronic record a transcription of unknown fidelity.

Original is the principle with the sharpest teeth. Modern thickness gauges store readings internally, many with the A-scan waveform. That stored file is the original data. Downloading it, transcribing the numbers into a system and then wiping the gauge to free memory destroys the original and leaves you with a copy whose accuracy nobody can now confirm. Retaining the gauge file, linked to the readings it produced, is inexpensive and is the difference between an original record and a secondary one.

Accurate is more demanding than it sounds, because it constrains how you may report as well as how you must measure. The complete, consistent, enduring and available additions cover the rest: rejected readings must be retained rather than deleted, system time must come from a synchronised source so that timestamps across systems agree, and the record must remain readable for the full retention period, which for many products means well beyond the life of whatever software you buy this year.

Rouging, passivation and the loss that is not corrosion

High-purity water and pure steam systems in 316L develop rouge — iron oxide deposits that range from a light orange film on distribution loops, through in-situ forms associated with chloride attack and incipient pitting, to the black magnetite typical of high-temperature pure steam service. Rouge is a surface phenomenon and is not, in itself, wall loss. The problem it creates for a thickness programme is that its formation and removal both alter the surface the ultrasonic pulse encounters, and the removal step can take a small amount of base metal with it.

Derouging with citric, phosphoric or oxalic chemistry followed by repassivation, typically to an ASTM A967 method, is a planned maintenance activity on a multi-year cycle. If the asset record does not carry the derouging date, a thickness series spanning it will show a step down that a trend routine will happily convert into a corrosion rate. Then someone has to explain to an inspector why a WFI loop appears to be corroding when the material and service say it should not be. The explanation is correct and the record does not support it, which is the worst possible position.

The remedy is structural rather than analytical. Chemical cleaning, passivation, derouging, mechanical polishing and section replacement are all events that reset or perturb a thickness series, and each needs to exist in the record as a dated event on the asset, visible on the same timeline as the readings. When the trend shows a step, the reason should be adjacent to it, not in a separate maintenance system that the reviewer has to know to go and look at.

Precision you cannot support is itself a finding

Consider a hygienic tube with a nominal wall around sixty-five thousandths of an inch, measured on a gauge with a displayed resolution of one thousandth and a realistic measurement uncertainty rather larger than that once surface condition, couplant and probe placement are included. Two surveys two years apart differ by one displayed increment. Divide by the interval and you have a corrosion rate of five ten-thousandths of an inch per year, from which a remaining life of many decades follows. The arithmetic is flawless and the result is meaningless, because the difference is entirely within the measurement uncertainty.

Reporting that figure to three significant figures is not merely sloppy. Under the accuracy principle it is an assertion of precision the measurement cannot support, and an inspector who understands measurement will treat it as such. The correct output in that situation is a statement that no loss is detectable at the current measurement resolution over the interval, together with the detection threshold. That is a more defensible statement and, usefully, a more honest one for the engineer relying on it.

This has a direct software implication that most systems ignore. The instrument's uncertainty should be a property of the instrument record, the survey should carry the resulting detection threshold, and the trend routine should decline to report a rate whose magnitude falls below that threshold. A system that always produces a number, regardless of whether the data supports one, is generating findings on your behalf. Ask a vendor to show you what their software does with two readings that differ by a single increment.

Certification and calibration lapses reach backwards

Two failures recur in this industry and both are retrospective. The first is a gauge that is found out of calibration at its next scheduled check. Under any reasonable quality system, that triggers an impact assessment covering every measurement made with that instrument since the last successful calibration. The second is a technician whose certification under the site or contractor written practice had lapsed — an annual vision examination missed, a recertification interval exceeded — which calls into question readings taken during the lapse.

In both cases the remediation is bounded by one capability: can you enumerate the affected readings quickly and completely. The query is simple to state and hard to run against a folder of reports. Every reading taken with instrument serial number X between two dates. Every reading taken by a named individual between two dates. Every calculation, report and disposition decision that consumed those readings. If those relationships exist as data, the assessment is an afternoon. If they exist only in the header of a PDF, it is a manual review of hundreds of documents while an inspector waits.

This is the reason instrument and technician should be foreign keys rather than text. A calibration certificate should be a record with a validity range, and entering a reading whose date falls outside that range should be blocked or flagged at the point of entry, not discovered a year later. Similarly, a technician's qualification should carry method-level scope and expiry dates, so that a UT reading taken by someone certified only in PT is caught immediately rather than surviving into a report.

Exclusions need an approver, not a checkbox

Every survey produces readings that should not be used. A probe could not couple to a surface. A location was inaccessible because of an adjacent line. A value was clearly a mode error, reading half the true wall on a doubled echo. A point was measured on a section replaced since the previous survey. Handling these correctly is straightforward in principle and is where audit findings cluster in practice, because the natural instinct is to leave the cell blank and move on.

A blank is unrecoverable information. Six months later nobody can tell whether the location was inaccessible, whether the technician ran out of time, or whether the reading was taken and lost. Under the completeness principle, the reading and its fate both belong in the record. So the exclusion needs three components: the reading itself where one was taken, a reason drawn from a list the site controls rather than free text, and an approver with a date. Free text defeats the purpose, because a controlled list is what lets you later ask how many exclusions across the site cite inaccessibility and therefore whether you have a scaffolding problem rather than a corrosion one.

The approver requirement is the part organisations resist and the part that matters most under scrutiny. An exclusion is a judgement that a piece of evidence will not inform a fitness-for-service conclusion. Under a risk-based quality framework, that judgement has an owner. Making the owner explicit costs one field and converts an ambiguous gap into a documented decision, which is precisely the transformation an inspector is looking for.

Validation, and what to demand from a vendor before the inspection

A thickness management system that supports GMP decisions is a computerised system in the regulatory sense and needs to be qualified accordingly. The proportionate approach under GAMP is to classify the system by risk and configuration, then produce specifications, a traceability matrix and executed installation, operational and performance qualification evidence. What varies is depth, not existence. A configured commercial product does not need the validation burden of bespoke software, but it does need a supplier assessment, a documented configuration and evidence that the configuration behaves as specified.

There are two questions to ask a vendor that separate serious candidates quickly. First, can an administrator disable or delete the audit trail? The only acceptable answer is no, for anyone, including the vendor's own support staff, and it should be demonstrable rather than asserted. Second, how does the release process interact with a validated state? A hosted product that updates continuously can silently invalidate your qualification; there must be a controlled release channel, advance notice of changes, and a description of what changed at a level of detail that lets you scope regression testing.

Then plan the sequence around your actual deadline. If an inspection is months away, the highest-value work is not migrating a decade of history — it is establishing the controls on data created from today, closing the instrument and personnel linkages, and producing a documented, approved position on the legacy record that states plainly what it is, what it can support and what it cannot. An honest characterisation of legacy limitations, approved by quality, is far stronger ground than a retrospective clean-up that makes old data look better than it was. Atlantis scopes this sequence against your inspection date during a consultation, and provides a quote once the system boundary and validation depth are agreed; general enquiries go to info@atlantisndt.com.

Request a consultation