OSHA PSM mechanical integrity: the audit-ready trail

An OSHA compliance officer does not ask whether your vessels are safe. The officer asks for the inspection record of a specific vessel, then for the procedure it was inspected under, then for the qualification of the person who signed it, then for what happened to the deficiency noted on page three. Each answer has to come from a record, produced quickly, and the records have to agree with each other. Mechanical integrity under 29 CFR 1910.119(j) is an engineering discipline, but the citation is almost always about documentation. This paper sets out what the rule requires, where programs usually fail the paper test, and what an audit-ready trail looks like.

What does 1910.119(j) actually require?

The mechanical integrity paragraph of the Process Safety Management standard has six parts, and each generates records.

• Application. The element applies to pressure vessels and storage tanks, piping systems and their components, relief and vent systems and devices, emergency shutdown systems, controls (monitoring devices, sensors, alarms, interlocks), and pumps.
• Written procedures. The employer must establish and implement written procedures to maintain the ongoing integrity of process equipment.
• Training. Maintenance personnel must be trained in an overview of the process and its hazards and in the procedures applicable to their tasks.
• Inspection and testing. Inspections and tests must be performed on process equipment; procedures must follow recognized and generally accepted good engineering practices (RAGAGEP); frequency must be consistent with manufacturer recommendations and good engineering practice, and more frequent if operating experience indicates; and each inspection and test must be documented with the date, the name of the person who performed it, the serial number or other identifier of the equipment, a description of the inspection or test, and the results.
• Equipment deficiencies. Deficiencies outside acceptable limits defined by the process safety information must be corrected before further use, or in a safe and timely manner when necessary means are taken to assure safe operation.
• Quality assurance. New equipment must be fabricated to the design specification, installation checks must confirm it was installed properly and consistent with the design and the manufacturer's instructions, and maintenance materials, spare parts and equipment must be suitable for the application.

Read as a records standard, the paragraph asks for five things per piece of covered equipment: identity, the governing procedure, a schedule with a basis, the record of each execution, and the disposition of anything found out of limits.

Which equipment is covered, and how do you prove the list is complete?

The first question an auditor asks is for the covered equipment list, and the second is how you know it is complete. A program that cannot connect its mechanical integrity list to the process safety information (PSI) and the P&IDs has a gap before any inspection is examined.

Completeness is a hierarchy problem. Equipment sits in a unit, in a facility, in a site. Relief devices sit on vessels. Instruments sit in loops. A flat spreadsheet of tag numbers cannot show that every vessel in a covered process has its relief device accounted for, or that a piping circuit crosses a unit boundary. Programs that manage the list well share a few habits:

• The equipment register is derived from the PSI, not maintained separately from it.
• Every item carries its design code and the RAGAGEP that governs its inspection.
• Relief devices are children of the equipment they protect, so an orphaned device is visible.
• Additions and removals go through management of change (paragraph (l)), so the list changes only with a record of why.

The consequence of an incomplete list is not theoretical. Equipment that is not on the list is not scheduled, is not inspected, and becomes the finding.

What counts as RAGAGEP for inspection and testing?

OSHA does not publish inspection intervals. It defers to RAGAGEP, and it expects the employer to say which practice governs each equipment type and to follow it. The usual mapping in a refinery or chemical plant:

• Pressure vessels: API 510, with ASME Section VIII for design basis and the NBIC where jurisdictions require it.
• Piping: API 570, with API 574 for inspection practices and ASME B31.3 for design.
• Atmospheric storage tanks: API 653.
• Relief devices: API 576 for inspection, API 520 and API 521 for the design basis, with intervals informed by API 510 and the NBIC.
• Instrumented protective systems: manufacturer recommendations and the functional safety standards the site has adopted.
• Rotating equipment: manufacturer recommendations and site practice.

Two points matter for the record. First, the written procedure should name the practice and the edition; a procedure that says "inspect per API" is not a procedure. Second, where the site departs from the practice (a longer interval based on a documented risk-based inspection assessment, for example), the departure must be documented with the engineering basis, because the practice itself permits that only when the analysis exists. Existing equipment designed to codes no longer in general use is addressed in the PSI paragraph: the employer must determine and document that it is designed, maintained, inspected, tested and operating in a safe manner.

What does a compliant inspection record look like?

The five required fields are the floor. A record that would survive an auditor's follow-up questions carries more:

1. Equipment identifier, matching the register and the P&ID, with its hierarchy (site, unit, parent equipment).
2. Date of the inspection or test, and the date the record was completed if different.
3. Person, by name, with a link to the qualification that made them competent (API 510 or 570 inspector certification, NDT certification level, or site authorization), valid on that date.
4. Description of the inspection: the procedure followed, the extent (external, internal, on-stream, thickness at named CMLs), the technique and the instrument.
5. Results: readings, observations, photographs, and a clear statement of acceptable or not acceptable against the criteria in the PSI.
6. Calculated outputs where relevant: corrosion rate, remaining life, and the resulting next inspection date, with the formula and inputs visible.
7. Signatures: the inspector, and where the practice requires it, the authorized inspector's review.

The failure pattern is a record that exists but cannot be tied to the other records. An inspection signed by someone whose certification lapsed the previous year. A thickness reading with no CML identity. A next due date with no visible calculation. Each is a real finding from real audits, and each is a linkage failure rather than an engineering one.

How should deficiencies be handled and documented?

Paragraph (j)(5) is short and frequently cited. A deficiency outside acceptable limits must be corrected before further use, or, when the equipment continues in service, the employer must take and document the means necessary to assure safe operation. In practice that means the record for a deficiency must show:

• What was found, with the reading and the limit it violated.
• The decision: repair before return to service, or continued operation with interim measures.
• The interim measures, if any: reduced operating pressure, increased monitoring frequency, a temporary repair with its own inspection schedule, a fitness-for-service assessment.
• Who approved continued operation and on what engineering basis.
• Closure: the permanent repair, its inspection, and the return of the equipment to its normal schedule.

The operating word is "timely." An open deficiency with no dated plan is the auditor's easiest finding. A deficiency workflow with states (open, evaluated, interim measures in place, repaired, closed) and a visible owner turns a vague obligation into a queue that a supervisor can review every week.

Compliance audits under paragraph (o), required at least every three years, must certify that the program is being followed and must be retained (the two most recent). Deficiency records are what those audits sample.

Why does the audit trail itself need to be verifiable?

Every PSM element depends on records, and an inspector examining records will ask whether they could have been altered. A signed PDF answers that partially. An electronic system answers it fully only when it can show, for every record, who created and changed it, when, from where, and can prove that the log itself has not been edited.

The properties that matter:

• Completeness. Every create, read, update, delete, export and login is logged, not only the changes someone chose to track.
• Attribution. Each event carries the actor, the tenant, the request, the network address and the device.
• Tamper evidence. Events are hash-chained, each carrying the hash of the previous event, so removing or editing one breaks the chain from that point forward.
• Verification. An auditor can run a routine that recomputes the chain and reports whether it is intact, rather than trusting a screenshot.
• Retention. Audit events are never automatically deleted.

Combined with signatures that freeze a record and an amendment path that creates a new version rather than overwriting, this is what "audit-ready" means: the evidence can be produced on demand, and its integrity can be demonstrated rather than asserted.

How intelliSPEC handles it

intelliSPEC keeps the covered equipment register as a graph of asset nodes with roles (company, site, facility, asset, component, weld), so a relief device is a child of the vessel it protects and a piping circuit can span units. intelliCOMPLY carries the compliance program; intelliINTEGRITY holds the calculations that produce the acceptance decisions, including tMin routed by equipment type to ASME B31.3, ASME Section VIII Division 1 or API 653 with the design code and formula shown, corrosion rates, remaining life, and API 510 and API 570 intervals capped at half the remaining life. Calculation results are provisional until an engineer verifies them, and the product never auto-derates equipment.

Inspector qualifications, skills and training live as crew records, so the person on an inspection record can be checked against a qualification valid on that date. Deficiency handling uses workflow transitions (submit, approve, reject, hold, resume, reopen, owner sign-off and others). Completed records pin the form configuration they were executed with, so a 2026 record renders in the same form in a 2031 audit.

Every event carries actor, tenant, request id, IP address and user agent on a per-tenant hash-chained audit trail with a verify routine for auditors, and audit events are never auto-deleted. Access is governed by roles with two segregation-of-duties rules today, and permission changes invalidate stale tokens. Controls are mapped to the SOC 2 Trust Services Criteria; there is no SOC 2 report or ISO 27001 certificate, and the Trust Center says exactly what exists. For refinery and chemical programs, see oil and gas and chemical.