Hold, Witness, Review: How to Actually Set the Intervention Levels on an ITP

The line that gets marked wrong

Somewhere in the middle of a signed Inspection and Test Plan there is a column three characters wide. H, W or R. It is the smallest column on the page and it carries the most weight, because it does not describe what gets inspected. It describes who can stop you, and when.

Mark one line wrong — write "notify and proceed" where the contract meant "stop and wait for written release" — and you have manufactured a non-conformance report that recurs across large equipment packages. Not a weld defect. Not a material mix-up. A misread letter in a column.

In the old world that mistake was survivable. The inspector was physically in the shop, the QC manager walked over, and it got sorted out standing next to the vessel. That world is closing. Inspection plans are digitising: a hold point is triggered, the designated inspection party gets an instant notification, approves or rejects remotely, and field data writes straight back into the ITP ledger. Classification societies have gone the same way — DNV has passed 15,000 completed remote inspections, and RINA has run the first classification survey conducted over a live video stream.

That is a good direction. It also removes the corridor conversation that used to paper over a badly written ITP. When witnessing is remote and asynchronous, an ambiguous intervention level does not get resolved by walking across the shop floor. It becomes two parties in two time zones reading the same line differently, and once a node has passed there is very often no way back.

This is written from the receiving end of the ITP rather than the drafting end. Our works is inspected as a matter of routine by owners' third-party inspectors, ASME Authorised Inspectors, classification society surveyors and statutory bodies in the markets we export to.

What an ITP actually is

An Inspection and Test Plan is a quality control document agreed and signed by both buyer and manufacturer before fabrication starts. Line by line, from incoming raw material through to final shipment, it sets out which manufacturing activities must be verified, by what method, against what acceptance criteria, who is responsible, and what record is retained.

Put plainly, the ITP takes something abstract — quality — and breaks it into discrete actions that can be checked, signed and traced.

This is why the effective inspectors are never the ones who arrive looking for something to complain about. A third-party inspector walks into the shop holding a document both sides already signed, and works down it. The plan is the contract; everything else is interpretation.

Hold, Witness, Review: three letters, three different powers

The distinction is not strict, medium and relaxed. It is a difference in authority over whether fabrication may continue.

Level	Term	Can fabrication continue?	Notification	Consequence of absence
H	Hold Point	No. Work stops until the authorised party releases it	Written notification in advance	Proceeding without release is a major non-conformance
W	Witness Point	Yes, conditionally. The party must be notified and given the opportunity to attend; if they do not attend within the agreed notice period, work may proceed	Agreed notice period, e.g. 24 or 48 hours	Notified and absent means the manufacturer may release
R	Review Point	Yes. No interruption; records reviewed afterwards	No attendance required	A non-conforming record is handled retrospectively

Confusing Hold and Witness is the classic source of NCRs on large contracts. The mechanism always sounds reasonable: "we notified the inspector, so we carried on." That statement is completely correct for a Witness Point. It is fatal on a Hold Point. On a Hold, notification is irrelevant — you can notify a hundred times, and without the written release nothing gets welded and nothing gets pressurised.

The test, when staring at a line and unable to decide: can fabrication legally continue if the inspector does not turn up? If no, it is a Hold. If yes, it is a Witness. That question resolves almost every ambiguous line.

Who actually witnesses: five categories

"The inspector" is not one person. On a typical export pressure vessel project the same equipment can face several categories of witnessing party, each with authority over a different stretch of the process, and each with their own intervention level on the same row.

1. The ASME Authorised Inspector (AI). Where the equipment carries an ASME U-Stamp, an AI is commissioned by an Authorised Inspection Agency and is responsible for the code-mandated hold points: design drawing review, material identification, welding, final hydrostatic test. The hydrostatic test requires the AI to be present — a hard, code-mandated Hold. It is not negotiable and it is not remotable.

2. The owner's or EPC's third-party inspector (TPI). An inspection company appointed by the buyer, working down the countersigned ITP row by row. Owners such as Air Products, or EPCs such as GS Engineering & Construction, run high intervention density and tight nodes. This is where remote and digital witnessing is expanding fastest.

3. Statutory and regional safety authorities. Whichever market the equipment enters, that market's statutory inspection regime applies. Korea commonly brings in KGS; Malaysia brings in DOSH; the North American system involves National Board registration. These are market-access bodies belonging to the project and destination market, not to any manufacturer's own credential list, and they should never be presented as such.

4. Classification societies. Marine and offshore equipment is witnessed by class — CCS, DNV, BV, LR, NK. This is also where remote survey has advanced furthest.

5. The manufacturer's own inspection (first party). At every node we inspect first and record first. This is not a witnessing category in the contractual sense; it is the foundation the other four stand on. If the first-party record is weak, every downstream witness is inspecting fog.

One consequence buyers routinely underestimate: every additional witnessing party multiplies notification and coordination cost. The ITP sign-off meeting is the moment to negotiate which parties must attend which nodes and which nodes can be jointly witnessed, rather than letting every party stake a claim on every row. A plan where four parties each hold four nodes is not four times safer than one where the critical eight nodes are cleanly allocated. It is four times slower.

A reading habit worth building: read the intervention level per party, not per row. The same hydrostatic test can be a Hold for the ASME AI and a Review for a buyer who only audits documents. Scanning the row and registering that there is inspection here will miss the one entry that actually stops the schedule.

Four rules for setting the points

The craft of setting intervention levels is finding the balance between missing a critical node and setting so many nodes that the schedule collapses.

Rule 1 — Irreversible operations get a Hold. Anything that cannot be undone, or where undoing it is prohibitively expensive: post-weld heat treatment, final hydrostatic test, closure of a coating system. The logic is not severity but visibility. Once past these nodes, the thing you would want to inspect is no longer visible.

Rule 2 — If it is traceable afterwards, a Review is enough. Where a complete and independently re-checkable record exists — mill certificates, radiographic film and reports, dimensional records — set a Review. Site witnessing hours spent watching someone read paper are hours you will want back at hydrotest.

Rule 3 — Scale density to risk and value. Special materials such as duplex, titanium tubes and nickel alloys, high design pressure, hazardous media: tighten the density. Low-risk commodity items: consolidate points. A uniform intervention density across a mixed package is a sign that nobody thought about it.

Rule 4 — Write the notice period into the ITP. Every Witness Point must state, in writing, the notification period — "48 hours' written notice", not "reasonable notice". The notice period is the precondition for the entire notified-but-absent mechanism. A Witness Point with no stated notice period is not a Witness Point; it is a scheduled argument. When the node passes and the inspector was not there, "we notified you" and "you never told us" become two equally arguable positions, and the party who wrote the vaguer clause loses.

A node checklist to hold your own ITP against

These are the nodes that appear most often on pressure vessel and heat exchanger ITPs, with their typical intervention levels.

Stage	Typical node	Common level
Raw material	Mill certificate verification (EN 10204 3.1 / 3.2)	R / W
Raw material	Material identification transfer (hard stamp / marking)	W
Welding	WPS / PQR review, welder qualification verification	R / H
Welding	Fit-up and critical weld witnessing	W
NDE	RT / UT / MT / PT and report review	W / R
Forming	Head forming, shell rolling dimensional check	R
Heat treatment	Post-weld heat treatment chart release	H
Pressure test	Hydrostatic / pneumatic test	H (ASME requires the AI present)
Dimensional	Final dimensional inspection	W / R
Surface	Surface preparation before coating; coating closure	H / W
Nameplate	Nameplate stamping including code marks	H
Acceptance	Factory acceptance test	W / H

What remote witnessing changes, and what it does not

Remote and digital witnessing genuinely removes cost from the schedule, but it redistributes where the risk sits rather than removing it.

What it improves. Mobilisation disappears for the nodes it suits, notice periods shorten because attendance no longer requires travel, and the ledger is written as the work happens rather than reconstructed afterwards. For a package with many small units, being able to clear several nodes in one session is a real schedule gain.

What it does not change. The ASME hydrostatic test still requires the AI physically present. Anything where the inspector needs to handle the part, view a surface at an angle, or verify a measurement independently, is weakened by a camera.

What it makes more important. Three things. The evidence quality of the first-party record, because a remote witness is largely reviewing your documentation in real time. The precision of the ITP wording, because there is no corridor to resolve ambiguity in. And the notice mechanism, because asynchronous parties in different time zones need an unambiguous clock.

The practical implication for a manufacturer is not that remote witnessing is easier. It is that the ITP has to be written to survive without a conversation.