ISM Code audits: DOC, SMC and what auditors look for

Where the ISM Code applies

The ISM Code was adopted by resolution A.741(18) and made mandatory by SOLAS chapter IX: from 1 July 1998 for passenger ships, oil and chemical tankers, gas carriers, bulk carriers and cargo high-speed craft of 500 gross tonnage and upwards, and from 1 July 2002 for other cargo ships and mobile offshore drilling units of 500 gross tonnage and upwards, on international voyages. It has been amended five times: MSC.104(73), MSC.179(79), MSC.195(80), MSC.273(85) and MSC.353(92), the last in force on 1 January 2015.⁸

The parts of the SMS an auditor walks through

Section 10 is where survey and service work meets the SMS. The company must have procedures to keep the ship in line with the rules, hold inspections at appropriate intervals, report non-conformities with their causes, take corrective action and keep records. It must also identify equipment and technical systems “the sudden operational failure of which may result in hazardous situations” (critical equipment, such as the emergency generator, steering gear or fire pumps) and include their regular testing in routine maintenance.

The certification cycle

The annual DOC audit must check the statutory and class records of at least one ship of each type covered by the DOC. Renewal completed within three months before expiry keeps the old expiry date as the start of the new five years. If a new SMC cannot be placed on board in time after a successful renewal, the existing one may be endorsed for up to five months; if the ship is not at the port of verification when the SMC expires, the Administration may extend it by up to three months.³

How an audit is run

The 2023 Guidelines on implementation of the ISM Code by Administrations, resolution A.1188(33), describe the steps:

1. Application by the company to the Administration or its RO, which nominates the lead auditor.
2. Document review of the safety management manual. If the system is not adequate, the audit is delayed until it is corrected.
3. Preparation: the auditor reviews flag records, PSC reports and class and accident reports, and sends an audit plan.
4. Opening meeting, then collection of objective evidence through interviews, document examination and observation of work.
5. Grading of findings as observations, non-conformities or major non-conformities, against the specific provisions of the Code.
6. Closing meeting with senior management, then a written audit report to the company, which should give the ship a copy of the shipboard audit report.
7. Corrective action by the company, normally within three months, with follow-up audits as agreed.

Grading findings

Failing to take adequate corrective action, including measures to prevent recurrence, may itself be treated as a major non-conformity.

Internal audits

The company must carry out internal safety audits on board and ashore at intervals not exceeding 12 months. In exceptional circumstances this interval may be exceeded by not more than three months. Auditors should be independent of the area audited where the size and nature of the company allow. The results feed the management review.

Remote audits

A.1188(33) allows remote methods only under strict conditions. In extraordinary circumstances beyond the parties’ control (disaster, war, pandemic, strike), and after a case-by-case assessment by the flag, a remote audit may support postponement or follow-up, but it should lead to no more than an interim certificate or one valid only until a physical audit is possible, and in any case not more than six months. In normal times remote methods may be used for some SMS activities, but initial, intermediate, renewal and additional audits on board should not be fully replaced by remote audit.

ISM at port State control

PSCOs do not audit the SMS. They inspect the ship. Appendix 8 of the Procedures for Port State Control tells them how to link technical or operational deficiencies to the ISM Code:

• deficiencies that do not show an SMS failure: no ISM deficiency is recorded;
• at least one non-detainable deficiency that shows an SMS failure: a non-detainable ISM deficiency, with corrective action within three months;
• deficiencies that together warrant detention, or a detainable deficiency showing a serious SMS failure: a detainable ISM deficiency, and an audit by the Administration or RO before release.

The 2025 revision of the Procedures, resolution A.1206(34), moved the ISM detention item into the main detention guidelines, as flags such as Panama have pointed out.¹⁰

What is coming

In June 2025 the Maritime Safety Committee (MSC 110) agreed a comprehensive revision of the IMO guidelines on implementing the ISM Code, for Administrations and companies, over three years to 2028, also addressing the prevention of violence and harassment on board.¹¹ At III 12 in July 2026 a correspondence group was set up to prepare draft amendments for III 13 in summer 2027.⁹ Check the latest IMO meeting summaries before assuming any change to the Code text itself.