Your mechanical integrity program can pass an audit and still miss the corroded line
A fully compliant MI program fails where the paperwork does not look: in which equipment made the inspection list, and on what basis the interval was set. Completion rate is not coverage.
Mechanical integrity is the part of process safety that looks most like it is under control. There is an equipment register. There are written procedures. There are inspection records with dates, names, and results. An auditor can sample twenty of them, find twenty complete, and write the program up as compliant. That audit is real, and it is measuring the wrong thing. It measures whether the inspections you scheduled were performed. It does not measure whether the inspections you scheduled were the right ones.
That gap is where loss of containment lives.
What the standard actually asks for
In the United States, mechanical integrity sits in paragraph (j) of the federal Process Safety Management standard, 29 CFR 1910.119. Read it closely and it is less of a checklist than most programs treat it as.
Paragraph (j)(4)(ii) requires that inspection and testing procedures “follow recognized and generally accepted good engineering practices,” the phrase OSHA shortens to RAGAGEP. Paragraph (j)(4)(iii) sets the interval: the frequency of inspections and tests “shall be consistent with applicable manufacturers’ recommendations and good engineering practices, and more frequently if determined to be necessary by prior operating experience.” Paragraph (j)(5) then requires that equipment deficiencies outside acceptable limits be corrected before further use, or in a safe and timely manner when other means assure safe operation.
Two things in that language do a lot of work, and neither is a document. The first is the phrase “more frequently if determined to be necessary by prior operating experience.” The standard assumes intervals move when the process tells you something. The second is RAGAGEP itself, which OSHA has explained in enforcement guidance is not a fixed list but the published industry practice applicable to that equipment, from bodies such as API, ASME, and NFPA. OSHA’s own interpretation on RAGAGEP in PSM enforcement is worth reading directly, because it makes clear that selecting a practice and then not following its provisions is itself the problem.
The three failure modes that survive a clean audit
Coverage. The register was built once, often at commissioning or at the last major turnaround, and it captures the equipment someone thought to include. Small-bore piping, dead legs, injection points, insulated lines, and temporary connections that quietly became permanent are the classic omissions. Nothing on the list is overdue, because the line that is thinning is not on the list. The completion metric reads 100 percent and is telling the truth about a subset.
Interval basis. Many programs set intervals once, from a manufacturer’s recommendation or a default in the maintenance system, and then never revisit them. A risk-based interval is only risk-based if the risk input is current. If the crude slate changed, if a unit is running wetter or hotter, if sulphur content moved, if a corrosion inhibitor program lapsed, then the damage mechanism changed and the interval that was defensible three years ago is now an assumption. The standard’s “prior operating experience” clause is precisely the mechanism for catching this, and it is the clause most often left dormant.
Deficiency closure. Inspections find things. The measured wall thickness comes back at the low end. The finding is logged, a work order is raised, and the work order ages behind production priorities under a temporary justification that was never re-examined. Paragraph (j)(5) does allow continued operation when necessary means are taken to assure safe operation, but that is a deliberate engineering decision with a basis, not a queue position.
What separates a real program from a documented one
The honest test is not “are we current.” It is “would we know.” A mechanical integrity program is working when a change in the process reliably produces a change in the inspection plan, and when someone can point to the last time an interval was shortened because of what an inspection actually found. Programs that have never shortened an interval are usually not stable. They are usually not looking.
Field check
Pull your mechanical integrity register and your last two years of inspection results side by side, then ask, for one unit: which equipment items are exposed to a damage mechanism that is not currently on the inspection plan, and when was the last time an interval was shortened because of a finding rather than lengthened because of a schedule? Trace the interval basis for five items to a named practice and a current process condition, not to a legacy default. Check whether small-bore piping, dead legs, injection points, and corrosion under insulation appear on the register at all. Then pull every open deficiency past its committed date and ask what documented basis allows continued operation. If any answer is "we have always inspected it that way," the interval is a habit, not a control.
Compliance here is genuinely necessary. It is also satisfiable by a program that inspects the wrong equipment on the wrong schedule with complete records. The paperwork is not the weak point. The scope decision behind it is.