A CSA N299 audit checks that a supplier to a Canadian nuclear plant has a written quality program for the category the purchaser specified, and that the shop follows it. The auditor reads your procedures, then samples completed work to see whether the records prove the procedures were followed. This checklist follows the same order. It doesn’t reproduce the standard, so check every answer against the edition of CSA N299 named on your purchase order.
Confirm the scope before you start. The purchaser sets the N299 category (N299.1, N299.2, N299.3 or N299.4), the edition, and the scope of supply. N299.1 has the most requirements and N299.4 the fewest, so some questions below go further than a lower category needs. Mark anything outside your scope as not applicable and write down why.
How N299.1, N299.2, N299.3 and N299.4 differ
Each part of the standard says, in clause 1.1.2, what its quality program is “aimed primarily at”. Put the four sentences side by side and you can see what each audit covers. CSA’s wording is quoted from the current editions (2019, reaffirmed 2025); the reading under each is ours.
“preventing nonconforming conditions by controlling design, production, and verification processes, and by developing corrective actions” CSA N299.1:19, 1.1.2
The only category whose scope says preventing. Expect every element on this checklist to apply, including design control if you do design.
“controlling design, production, and verification processes, and developing corrective actions” CSA N299.2:19, 1.1.2
The same processes as N299.1, design included, without the word preventing. Expect most elements on this checklist to apply.
“controlling production and verification processes, and corrective actions” CSA N299.3:19, 1.1.2
Design drops out of the scope. The audit is about how you make and check the item and how you deal with nonconformances. If your order includes design work, ask the purchaser how they want it covered.
“sorting nonconforming items from conforming items; and achieving the requirements and then demonstrating that they have been met” CSA N299.4:19, 1.1.2
The narrowest scope. Expect the auditor to focus on inspection and test, calibrated equipment, how you hold nonconforming items, and the records that show requirements were met.
The 2019 editions replaced the 2016 editions. They added requirements on dedication and new guidance on counterfeit, fraudulent and suspect items, risk evaluation and records. If your purchase order names a 2016 edition, ask the purchaser which one the audit will use.
Before the audit
If you only have time for one of these, do the job trace. Following one real order from purchase order to shipment turns up the same gaps an auditor will find, in roughly the order they will find them.
The checklist, element by element
Management and organization
The auditor checks that senior management has approved the quality program, that the quality manager can stop work, and that people know who is responsible for what.
Questions to answer
Records to have ready
- Signed quality policy
- Current organization chart
- Role descriptions or responsibility matrix
- Minutes and actions from the last management review
Common finding
An organization chart that is out of date, or a quality manager who also reports to the production manager with no written authority to stop work.
Quality program and procedures
The auditor checks that the quality manual and procedures cover the N299 category the purchaser specified, and that people follow them.
Questions to answer
Records to have ready
- Quality manual
- Requirements cross-reference (category and edition to procedure)
- Procedure index with current revisions
Common finding
Procedures copied from a template that describe steps the shop does not actually perform.
Training and qualification of personnel
The auditor checks that everyone doing work that affects quality is trained for it, that inspectors and special-process operators hold current qualifications, and that you can prove both.
Questions to answer
Records to have ready
- Training matrix
- Individual training records
- Inspector and NDE certifications with expiry dates
- Welder and welding-operator qualification records with continuity logs
Common finding
A welder or inspector whose qualification lapsed before the date on the traveler they signed.
Document control
The auditor checks that procedures, drawings, and specifications are reviewed and approved before use, and that only the current revision is at the point of work.
Questions to answer
Records to have ready
- Document master list
- Approval records for a sample of documents
- Change history for a recently revised procedure or drawing
Common finding
An obsolete drawing revision in use on the shop floor, or a marked-up drawing with no approval.
Design control
Applies when design is in your scope of supply
If the purchaser has placed design in your scope, the auditor checks how design inputs are captured, how design outputs are verified, and how changes are approved.
Questions to answer
Records to have ready
- Design input records
- Design verification records (reviews, calculations, tests)
- Design change records and approvals
Common finding
A design change made on the shop floor without going back through verification.
Procurement document control and sub-suppliers
The auditor checks that your purchase orders pass the purchaser’s technical and quality requirements down to your own suppliers, and that you only buy from suppliers you have evaluated.
Questions to answer
Records to have ready
- Approved supplier list with scope of approval
- Supplier evaluation and audit records
- A sample of purchase orders showing flow-down clauses
- Supplier performance records
Common finding
A purchase order to a sub-supplier that leaves out the nuclear quality requirements the purchaser placed on you.
Control of purchased items and services
The auditor checks how you verify that what arrives matches what you ordered before it is used.
Questions to answer
Records to have ready
- Receiving inspection records
- Certificates of conformance and material test reports
- Commercial-grade dedication plans and records, if used
Common finding
A certificate of conformance that is missing, incomplete, or does not match the heat or lot received.
Identification and traceability
The auditor checks that each item can be traced back to its material, records, and inspection results.
Questions to answer
Records to have ready
- Traveler or routing for a sample job
- Heat and lot number records
- Material marking procedure
Common finding
Material cut from bar stock with the heat number left on the offcut and not transferred to the part.
Process and production control
The auditor checks that work is done to approved instructions, and that special processes like welding, heat treatment, and NDE are done with qualified procedures and qualified people.
Questions to answer
Records to have ready
- Travelers and work instructions for a sample job
- Welding procedure specifications and procedure qualification records
- Special-process procedures and their qualification records
- Process charts or logs
Common finding
Traveler steps signed in a block at the end of the job, or a weld made to a procedure that was not qualified for that material.
Inspection and test control
The auditor checks that inspections and tests are planned, done at the right points by qualified people, and recorded with clear acceptance criteria.
Questions to answer
Records to have ready
- Inspection and test plans
- Inspection reports and test records
- Hold point release records
- Notification records for purchaser witness points
Common finding
Work that went past a purchaser hold point before it was released.
Inspection, measuring and test equipment (IMTE)
The auditor checks that every gauge and instrument used for acceptance is calibrated, traceable to national standards, and within its due date when used.
Questions to answer
Records to have ready
- IMTE register with due dates
- Calibration certificates
- Out-of-tolerance evaluations
Common finding
A gauge found out of calibration with no review of the parts it accepted since the last calibration.
Handling, storage, packaging and shipping
The auditor checks that items are protected from damage, contamination, and deterioration from receipt to delivery.
Questions to answer
Records to have ready
- Handling and storage procedures
- Shelf-life log
- Packaging and shipping records
Common finding
Shelf-life material such as coatings, sealants, or weld consumables used past its expiry date, or shipped without the shelf-life data the purchaser asked for.
Nonconforming items
The auditor checks how you identify, segregate, and decide what to do with items that do not meet requirements.
Questions to answer
Records to have ready
- NCR log
- A sample of closed NCRs with dispositions and approvals
- Purchaser approval of dispositions, where required
- Hold tags and segregation area
Common finding
A use-as-is disposition that was not sent to the purchaser for approval.
Corrective action
The auditor checks that you find the cause of problems, fix it, and confirm the fix worked.
Questions to answer
Records to have ready
- Corrective action log
- Cause analysis records
- Effectiveness checks
- NCR or finding trend report
Common finding
Corrective actions closed on the date of the fix, with no check that the problem stopped happening.
Quality records
The auditor checks that the records proving the work was done right are complete, legible, retrievable, and kept for the required time.
Questions to answer
Records to have ready
- Records retention schedule
- A complete record package for a past order
- Storage and backup arrangements
Common finding
A record package that cannot be put together for an order shipped a year ago.
Internal audits and management review
The auditor checks that you audit your own quality program on a schedule, with people who are independent of the work, and that findings get closed.
Questions to answer
Records to have ready
- Internal audit schedule
- Audit reports and checklists
- Auditor qualification records
- Finding closure records
Common finding
An internal audit schedule that skipped elements, or an auditor who audited their own work.
Counterfeit, fraudulent and suspect items (CFSI)
The auditor checks how you prevent counterfeit and fraudulent items from entering your supply, and what you do if you find one.
Questions to answer
Records to have ready
- CFSI procedure
- CFSI training records
- Purchase orders with CFSI flow-down
- Records of any suspect items reported
Common finding
No CFSI requirement in purchase orders to distributors, or receiving inspectors with no CFSI training.
What goes wrong when items arrive
The audit is not the last time anyone checks these records. The purchaser checks them again every time you ship. Bruce Power reviewed the items it receives with an error, which it calls OSDD items (over, short, discrepant or damaged). Its contracting standards page says these are “most commonly attributed to three types of information: Certificate of Conformance Received; Material Identification; and Shelf Life Data.” All three come from elements on this checklist: control of purchased items, identification and traceability, and handling and storage. Check them on every shipment as well as before the audit.
Questions about N299 audits
What is the difference between N299.1, N299.2, N299.3 and N299.4?
Clause 1.1.2 of each 2019 edition (reaffirmed 2025) says what its quality program is aimed primarily at. N299.1: “preventing nonconforming conditions by controlling design, production, and verification processes, and by developing corrective actions”. N299.2: “controlling design, production, and verification processes, and developing corrective actions”. N299.3: “controlling production and verification processes, and corrective actions”. N299.4: “sorting nonconforming items from conforming items; and achieving the requirements and then demonstrating that they have been met”. Design is in the scope of N299.1 and N299.2 but not N299.3 or N299.4, and N299.4 has the narrowest scope.
What does a CSA N299 audit check?
A CSA N299 audit checks that a supplier has a documented quality program covering the N299 category the purchaser specified, and that the program is followed in practice. Auditors review management responsibility, training, document control, design control where design is in scope, procurement and sub-supplier control, identification and traceability, process control, inspection and test, calibration of inspection, measuring and test equipment, handling and storage, nonconforming items, corrective action, quality records, internal audits, and counterfeit, fraudulent and suspect items.
Who performs CSA N299 audits?
The purchaser usually decides. Canadian utilities and prime contractors run their own supplier audits and qualification assessments before awarding safety-related work, and continue oversight through surveillance and periodic audits. Third-party certification can form part of the evidence, but it does not automatically replace purchaser qualification.
Which CSA N299 category applies to my work?
The purchaser specifies the category (N299.1, N299.2, N299.3 or N299.4) and the edition in the purchase order or procurement specification, based on the safety significance of the item or service. N299.1 is the most demanding and N299.4 the least. Confirm the category, edition and scope with the purchaser before preparing for the audit.
Does ISO 9001 certification meet CSA N299?
No. An ISO 9001 system is a useful starting point for document control, purchasing, inspection and corrective action, but CSA N299 has nuclear-specific requirements that ISO 9001 does not cover. Compare your system against the specified N299 category and edition and close the gaps before the audit.
What records should I have ready for an N299 audit?
Have your quality manual and procedure index, organization chart, training matrix and qualification records, document master list, approved supplier list and sample purchase orders, travelers and inspection records for a completed job, the calibration register and certificates, the NCR and corrective action logs, internal audit reports, and management review minutes ready to show.
How do I prepare for a CSA N299 audit?
Confirm the category, edition and scope with the purchaser. Work through each element of this checklist against your own procedures. Pick a completed job and trace it from purchase order to shipment, checking that every record is there and signed. Raise corrective actions for anything missing and close them before the audit date.
Find your gaps before the auditor does. The free readiness assessment scores your quality program against CSA N299, NQA-1 or ISO 19443 and lists the gaps by element. In Forged, each record on this checklist is filed against the job it belongs to, so the record package for an order is in one place when the purchaser asks for it.
References
- CSA Group. CSA N299.1:19 (R2025), Quality assurance program requirements for the supply of items and services for nuclear power plants, Category 1. Toronto, Ontario: CSA Group, 2019, reaffirmed 2025.
- CSA Group. CSA N299.2:19 (R2025), Quality assurance program requirements for the supply of items and services for nuclear power plants, Category 2. Toronto, Ontario: CSA Group, 2019, reaffirmed 2025.
- CSA Group. CSA N299.3:19 (R2025), Quality assurance program requirements for the supply of items and services for nuclear power plants, Category 3. Toronto, Ontario: CSA Group, 2019, reaffirmed 2025.
- CSA Group. CSA N299.4:19 (R2025), Quality assurance program requirements for the supply of items and services for nuclear power plants, Category 4. Toronto, Ontario: CSA Group, 2019, reaffirmed 2025.
- Bruce Power. Contracting Standards. Accessed 4 October 2026.
- Ontario Power Generation. Key information for suppliers. Accessed 4 October 2026.
Forged Operations builds quality management software for nuclear suppliers and operators. Score your program against CSA N299 for free at forgedops.com/assessment, or email [email protected].
This checklist is a preparation aid. It does not reproduce or replace CSA N299. Check each item against the edition and category named in your purchase order. Latest version: forgedops.com/csa-n299-audit-checklist/