The Audit Pulls One CML and Follows It All the Way Through

What an audit is actually looking for

An audit of a mechanical integrity programme does not read the whole dataset. It samples. Someone picks a handful of condition monitoring locations — usually on equipment with a live damage mechanism, a recent repair, an extended interval or an open recommendation — and follows each one from end to end. The number in the inspection data management system, back to the field data sheet it came from, to the instrument that produced it and that instrument's verification status on the day, to the technician and their qualification on the day, and then forward into the corrosion rate, the remaining life, the next inspection date and the signature that accepted it.

That path has roughly eight hops. A programme fails an audit not because a number is wrong but because one hop cannot be completed. The most common breaks are dull ones: the field sheet is a scan of paper with no legible instrument identifier; the reading is dated to the report rather than the day it was taken; the technician's certification lapsed two months before the campaign; the trend has a five-year gap with no explanation; the remaining life in the system does not reproduce from the readings stored beside it.

This is why the audit-preparation problem is not a reporting problem. Nobody fails because they could not produce a chart. They fail because the evidence chain was assembled from four systems and a shared drive under time pressure, and one link in the sample did not survive being pulled. Preparation means the chain being intact continuously, so the sample can be taken cold.

The five elements OSHA names, and what they really demand

OSHA 29 CFR 1910.119(j)(4) requires that inspections and tests on process equipment follow recognised and generally accepted good engineering practice, be performed at the frequency that practice indicates, and be documented with the date, the name of the person who performed the work, the serial number or other identifier of the equipment on which it was performed, a description of the inspection or test, and the results. Read casually, that sounds like five fields. Read as an auditor reads it, each one is a small trap.

"The date" means the date the inspection was performed, which is not the date the report was issued and not the date it was approved. A system that carries only one date will systematically misstate intervals, and because remaining-life arithmetic divides by elapsed time, it will also misstate corrosion rates. "The name of the person" means an identifiable individual whose qualification on that date can be established, not a contractor company or a crew number. "The identifier of the equipment" in a thickness context has to reach below the vessel or line tag to the component and the CML, because that is the level at which refining damage mechanisms act.

"A description of the inspection or test" is where most records are thinnest. Recording "UT thickness" describes almost nothing that matters. What matters is the technique, probe type and frequency, whether the reading was taken bare-metal or through coating, single-echo or echo-to-echo, the couplant, the surface preparation, the metal temperature and whether a correction was applied. And "the results" means all of them — the whole grid, not the minimum carried forward, and including the readings that were excluded.

Excluded readings are evidence, not noise

Technicians exclude readings for good reasons every day. The point landed on a weld cap or the heat-affected zone. There was a repad, a doubler, a wear pad or a clamp beneath the probe. Internal scale or a deposit gave a reading nobody trusts. The coating was not removed and the mode was wrong for a through-coat measurement. The surface was too rough after grit blasting. The back wall echo dropped out on a heavily pitted internal surface. Every one of those is a legitimate exclusion, and every one of them is also a piece of information about the component.

What turns a legitimate exclusion into an audit finding is silence. If the reading simply never enters the system, the trend for that CML shows a gap. Nobody in the room during the audit was necessarily there when it happened; the technician may have left the industry. There is no way to distinguish a considered exclusion from a missed location or a lost sheet, and the auditor's default assumption when a record is missing is not generous.

So the module has to make exclusion a first-class action rather than an absence. The reading is captured with its value, then marked excluded against a coded reason from a governed list, with the person who excluded it and the person who approved the exclusion. The trend suppresses it and the audit trail keeps it. A cluster of exclusions coded "back wall echo lost — internal pitting" on one circuit is a genuine engineering signal about internal condition, and it is a signal that only exists if the excluded readings were kept.

Negative rates, short-term versus long-term, and the arithmetic that hides

Sooner or later a CML produces a reading thicker than the one before it. Corrosion has not reversed. The probe was a few millimetres off the last point, or the surface preparation differed, or the previous reading was taken through scale, or the instrument was in a different mode, or the two readings were taken by people with different habits. It is measurement variance meeting a real physical gradient, and it is entirely normal.

The danger is what a naive calculation does with it. A rate computed from two readings can come out negative or effectively zero, which extends remaining life towards infinity and pushes the next inspection date out. If the system computes and applies that automatically, an interval has just been extended by an artefact. Code practice under API 510 and API 570 addresses this by requiring both a long-term rate, from the original or earliest reliable baseline, and a short-term rate from recent readings, with the governing rate being the one that yields the shorter remaining life. The record has to show that comparison happened and which rate governed, not just the answer.

There is a second, quieter version of the same trap. When a component is repaired, re-rated or a section replaced, the baseline changes, but the CML often keeps its identity and the old readings stay in the same series. A rate computed across the repair mixes two different pieces of steel. The history module needs to close a reading series at a repair or replacement with a reference to the repair record, and open a new one, so that no calculation can silently span the discontinuity.

Why one CML rarely speaks for a whole component in refining

Refining damage mechanisms, catalogued in API RP 571, are overwhelmingly local. High-temperature sulfidation rates in carbon steel depend on silicon content, and silicon can vary substantially between individual components of the same nominal material specification, which is precisely how a single low-silicon elbow or spool can thin far faster than everything around it. Naphthenic acid corrosion follows acid number, temperature and velocity, concentrating at elbows, tees and downstream of restrictions. Ammonium bisulfide erosion-corrosion in hydroprocessing effluent concentrates where velocity and salt concentration peak. Corrosion under insulation, addressed in API RP 583, attacks where water enters and sits, often nowhere near where anyone would place a grid on a drawing.

The consequence for a thickness history is that a reading is inseparable from the exact component it came from, and inference across components is a hypothesis rather than data. The U.S. Chemical Safety Board's investigation of the 2012 Chevron Richmond crude unit fire examined this directly: sulfidation thinning of a piping component in a line where thickness measurement had not been carried out on a component-by-component basis, in a system where readings on some components were relied upon to represent others. The mechanism was known, the code framework existed, and the record still did not describe the component that failed.

So the history module must hold the component, its material as recorded in the process safety information required by 1910.119(d), and any known variance in that material, alongside every reading. When an auditor asks what evidence exists for a specific component, the honest answers are a reading, or no reading. A system that cannot distinguish those two states, because it rolls readings up to the line, cannot support that answer at all.

The calculation has to reproduce five years from now

A remaining-life number in an inspection system is the output of a chain of choices: which readings were used and why, what minimum thickness applies and whether it is governed by pressure design or by structural considerations, how corrosion allowance was treated, which rate governed, what interval rule was applied, and what date came out. Under API 510, on-stream and internal inspection intervals are commonly set by the lesser of half the remaining life or a code-stated cap; API 570 sets its own intervals by piping class with a comparable half-life provision. The rule applied is part of the record, not a background assumption.

The reproducibility test is simple to run and uncomfortable to fail. Take one CML, open its stored calculation, and try to arrive at the same next-inspection date from the stored inputs alone, without asking anyone. If a spreadsheet on someone's drive was involved, if a judgment about which readings to use is undocumented, if the minimum thickness came from a calculation nobody stored, the number is an assertion. It may well be a correct assertion made by a competent inspector — but it is not evidence, and an audit is a search for evidence.

This is also where credible systems separate approval from calculation. The engineer who computed the remaining life and the inspector who approved the next date are frequently different people with different accountabilities. Recording both, with dates, and locking the inputs at approval so that a later data correction creates a new revision rather than silently changing an approved result, is what allows the programme to say what it knew and when it knew it.

Revisions, retention, and the reading that changed after the fact

Data does get corrected. A transcription error is found, a CML was mislabelled, a technician's readings for one shift were entered against the wrong line. Correction is legitimate and necessary. What is not legitimate is correction that leaves no trace, because a system in which an approved number can quietly become a different number has no evidentiary value at all, and an auditor who discovers it will reasonably discount everything else in it.

The workable pattern is append-only with visible supersession. The original value stays, marked superseded, with the corrected value, the reason, the person and the date. If the correction changes a corrosion rate or a next-inspection date that had already been approved, the downstream calculation is versioned too and the change is surfaced for re-approval rather than applied silently. That is more machinery than a spreadsheet has, and it is the entire reason a spreadsheet cannot carry a mechanical integrity record for a covered process.

Retention rounds it out. Thickness history is a long-lived record — the useful baseline may be older than most of the people in the room, and equipment changes hands. Records need to survive personnel turnover, contractor changes, system migrations and ownership changes, with attachments such as scanned field sheets and instrument certificates retained alongside the structured data rather than in a separate archive that gets orphaned at the next migration. Atlantis NDT configures the thickness history module around the damage mechanisms, class structure and audit expectations of the specific units in scope; a walkthrough with your own sample CMLs can be arranged at info@atlantisndt.com.

Request a consultation