The ISM Code in Practice: Safety Management System, DPA and ISM Audits

Every company that operates a passenger ship, or a cargo ship of 500 GT and above, on international voyages works under the ISM Code. It is the reason ships carry manuals, checklists and drill records, and the reason a named person ashore can be reached at any hour.

On paper, the Code is short. It sets objectives and functional requirements rather than detailed rules, and leaves each company to build its own safety management system (SMS) around its ships, trades and people.

This guide explains what the ISM Code requires in practice: how certification works, what an SMS must contain, the role of the designated person ashore, what happens during an ISM audit and why weak systems end up in port state control detention reports. It is written for DPAs, marine and technical superintendents, masters and compliance managers.

The ISM Code does not ask companies to write manuals. It asks them to prove, every day and on every ship, that what the manuals say is what actually happens. Most ISM failures live in the gap between the two.

What the ISM Code Is and Why It Exists

The International Management Code for the Safe Operation of Ships and for Pollution Prevention, known as the ISM Code, was adopted by the IMO through resolution A.741(18) in 1993. It was made mandatory through SOLAS Chapter IX, "Management for the Safe Operation of Ships".

The Code grew out of serious accidents in which investigators found that the root causes lay not only on the bridge or in the engine room, but in the way ships were managed from ashore. The capsizing of the ro-ro passenger ferry Herald of Free Enterprise is the case most often cited.

The response was to shift attention from equipment and certificates to management. The Code defines who is responsible for safety, how ship and shore communicate, how problems are reported and how a company checks that its own system works.

Its objectives are stated plainly: safety at sea, the prevention of human injury or loss of life, and the avoidance of damage to the environment and to property. Every other provision of the Code serves those goals.

The Code was amended several times between 2000 and 2013, and the latest amendments entered into force on 1 January 2015. Its logic has not changed: a short set of requirements that each company must translate into a working system of its own.

Who the ISM Code Applies To and How Certification Works

Ships and companies covered

The ISM Code was introduced in two phases, and the dates still define its scope today:

• From 1 July 1998. Passenger ships, including high-speed passenger craft, and oil tankers, chemical tankers, gas carriers, bulk carriers and cargo high-speed craft of 500 GT and above.
• From 1 July 2002. Other cargo ships and mobile offshore drilling units of 500 GT and above.
• The Company. The organisation that has assumed responsibility for operating the ship, which may be the owner, a ship manager or a bareboat charterer.

Document of Compliance and Safety Management Certificate

ISM certification works on two levels. The company proves that its shore organisation meets the Code, and each ship proves that the system is implemented on board. Certificates are issued by the flag Administration or by a recognised organisation acting on its behalf.

The Document of Compliance (DOC) is issued to the company for the ship types it operates. It is valid for five years, subject to annual verification of the shore-based system, and a copy is kept on board each ship it covers.

The Safety Management Certificate (SMC) is issued to the individual ship. It is also valid for five years, with an intermediate verification between the second and third anniversary dates. The SMC depends on the company holding a valid DOC for that ship type.

Interim certification

New situations need a way in. An interim DOC, valid for up to 12 months, allows a new company, or a company adding a new ship type, to start operating while its system beds in. An interim SMC, valid for up to six months, covers new ships on delivery, a change of flag or a change of managing company.

Interim certificates are a starting point, not an exemption. The full audit that follows looks for objective evidence that the system has actually been working, so records need to start on the first day.

The Safety Management System: What It Must Contain

The SMS is the company's own structured and documented system. The Code provides no template, but section 1.4 lists the functional requirements that every safety management system must meet:

• Safety and environmental policy. A written policy on safety and environmental protection, known and applied at every level ashore and afloat.
• Instructions and procedures. Rules for safe operation and environmental protection in line with international and flag state legislation.
• Authority and communication. Defined levels of authority and lines of communication between shore and shipboard personnel, and within each group.
• Reporting. Procedures for reporting accidents and non-conformities with the provisions of the Code.
• Emergency preparedness. Procedures to prepare for and respond to emergency situations.
• Audits and reviews. Procedures for internal audits and management reviews of the system.

The Code also expects the company to assess the risks to its ships, personnel and the environment, and to put appropriate safeguards in place. A good SMS is therefore built around the operations each ship really performs, not copied from another fleet.

The operational sections of the Code

After the policy, the company's responsibilities and the designated person ashore, the Code sets out the areas that the SMS must cover in daily operation:

1. Section 5: the master's responsibility and authority.
2. Section 6: resources and personnel, including qualifications, familiarisation and training.
3. Section 7: shipboard operations, with plans, procedures and instructions for key tasks.
4. Section 8: emergency preparedness, drills and exercises.
5. Section 9: reports and analysis of non-conformities, accidents and hazardous occurrences.
6. Section 10: maintenance of the ship and equipment.
7. Section 11: documentation and document control.
8. Section 12: company verification, review and evaluation.

Section 6 is where crew management and safety management overlap most. Qualified, certificated and medically fit seafarers, proper familiarisation and records that prove both are core ISM evidence, as we explain in our article on crew management and MLC 2006 compliance.

The Designated Person Ashore: The Link Between Ship and Boardroom

Section 4 of the ISM Code requires every company to appoint one or more designated persons ashore. The DPA exists to ensure the safe operation of each ship and to provide a link between the company and those on board.

Two features define the role. The DPA must have direct access to the highest level of management, and is responsible for monitoring the safety and pollution-prevention aspects of each ship's operation, including that adequate resources and shore-based support are provided.

In practice, the DPA is the person a master can turn to when a safety concern is not being resolved through normal line management. That independence matters: a DPA who reports only to the manager whose decisions are being questioned cannot perform the role as intended.

Day to day, the DPA typically follows up incident and non-conformity reports, checks that corrective actions are closed, supports internal audits, prepares input for the management review and takes part in the company's emergency response.

None of this works without timely and reliable information from the fleet. A DPA who learns about a near miss three weeks later, from an email attachment, is monitoring history rather than safety.

In smaller companies the DPA often combines the role with quality, security or compliance duties. That is common and acceptable, but the monitoring function must not become an afterthought squeezed between other responsibilities. IMO has published guidance on the qualifications, training and experience expected of the role.

The Master's Overriding Authority

Section 5 makes the master responsible for implementing the safety and environmental policy on board, motivating the crew to observe it, issuing clear orders and instructions, verifying that requirements are followed, and periodically reviewing the SMS and reporting its deficiencies to shore management.

The Code goes further. The company must state clearly in the SMS that the master has the overriding authority and responsibility to make decisions with respect to safety and pollution prevention, and to request the company's assistance as necessary.

This principle is tested when commercial pressure meets operational risk: a tight schedule, deteriorating weather at the berth, a cargo operation that does not look right. A master who delays departure on safety grounds must be able to do so without first defending the decision against a charter party.

Auditors and inspectors look for evidence that this authority is real. Master's reviews that say "no comments" year after year, or deficiencies reported to the office and never answered, suggest a system that exists mainly on paper.

Maintenance, Drills and Non-Conformities in Daily Operations

Much of the ISM Code is lived out in three routines: maintaining the ship, practising for emergencies and learning from what goes wrong. These are also the areas where auditors and port state inspectors find most of their gaps.

Maintenance of the ship and equipment

Section 10 requires the company to keep the ship maintained in line with the relevant rules and regulations and any additional company requirements. Inspections are held at appropriate intervals, non-conformities are reported with their possible cause, corrective action is taken and records are kept.

The Code also asks the company to identify equipment and technical systems whose sudden failure could create hazardous situations, and to promote their reliability. That includes regular testing of stand-by arrangements and equipment that is not in continuous use.

Maintenance deferred to the next docking has to be visible and justified, not silently postponed. Our guide to dry docking commercial ships shows how maintenance history drives the docking specification, and condition-based approaches are covered in predictive maintenance ROI in merchant shipping.

Emergency preparedness and drills

Section 8 requires the company to identify potential emergency situations on board, establish procedures to respond to them and run a programme of drills and exercises. The shore organisation must be able to respond at any time to hazards, accidents and emergencies involving its ships.

A drill that is recorded but not really carried out is one of the clearest signs of a weak system. Inspectors may ask for a drill to be performed in front of them, and the crew's confidence with equipment and duties says more than any logbook entry.

Reporting non-conformities, accidents and near misses

Section 9 requires procedures for reporting non-conformities, accidents and hazardous occurrences to the company, followed by investigation, analysis and corrective action that improves safety and pollution prevention.

Near misses are where this section proves its value. A fleet that reports many near misses is usually not less safe than one that reports none. It is more likely to have a culture in which people speak up, and a system that turns small warnings into changes before an accident happens.

ISM Audits: Internal Audits, External Verification and Management Review

The ISM Code relies on verification at several levels. Knowing how they differ helps a company prepare for each ISM audit without duplicating effort or treating the external audit as the only one that counts.

• Internal audits. Section 12 requires the company to carry out internal safety audits on board and ashore, to verify that safety and pollution-prevention activities comply with the SMS. Auditors should be independent of the area audited, unless the size of the company makes this impracticable.
• External verification. The flag Administration, or a recognised organisation on its behalf, carries out the initial, annual, intermediate and renewal verifications of the DOC and SMC.
• Management review. The company periodically evaluates the effectiveness of the SMS and revises it where needed, using audit results, master's reviews, reports and incident analysis.
• Corrective action. Findings from every level are brought to the attention of the personnel responsible, and management takes timely action to resolve them.

External auditors grade their findings. A non-conformity is a situation where objective evidence shows that a requirement of the Code or of the SMS has not been fulfilled.

A major non-conformity is an identifiable deviation that poses a serious threat to personnel, ship safety or the environment, or a lack of effective and systematic implementation of a requirement. It needs immediate corrective action and can stand in the way of issuing or maintaining certificates.

A good internal audit programme should find these issues before an external auditor does. An internal audit that produces no findings for years is rarely a sign of perfection. More often it means the audit is checking documents rather than practice.

Port State Control and ISM Detentions: The Signs of a Paper SMS

Port state control regimes such as the Paris MoU, the Tokyo MoU and the US Coast Guard examine ISM implementation as part of their inspections. Individual deficiencies in equipment or documents often lead to a deeper question: is the safety management system actually working?

When failures are serious or repeated, inspectors can record an ISM deficiency, and that deficiency can be detainable. It can also prompt an expanded look at the SMS and, depending on the regime, involvement of the flag or its recognised organisation before the ship is cleared to sail.

The patterns behind ISM-related findings are well known. Together they describe what the industry calls a paper SMS: a system that looks complete in the office and on the bookshelf, but is not followed on board.

• Procedures not followed. Checklists signed in advance, or work on deck that differs from what the manual describes.
• Drills not recorded or not realistic. Records that do not match the drill schedule, or crews unable to launch a boat or use fire-fighting equipment when asked.
• Near misses unreported. Empty reporting logs on ships with obvious hazards, suggesting that reporting is discouraged or simply ignored.
• Overdue maintenance. Lapsed jobs on critical equipment with no documented reason or risk assessment for the deferral.
• Crew unfamiliar with the system. Seafarers who cannot explain their emergency duties, find key procedures or say who the DPA is.

None of these problems is caused by a missing manual. They come from a gap between documentation and daily practice, and they tend to appear together.

From a Paper SMS to a Living Safety Management System

Closing that gap is mostly a question of information. When procedures, drill records, maintenance jobs and non-conformity reports sit in separate binders, spreadsheets and email threads, nobody ashore has a current picture of how the system is really performing.

Section 11 does not require paper. Documents must be controlled, valid versions must be available at all relevant locations, and changes must be reviewed and approved. A digital system with one source of truth for the whole fleet meets that requirement more easily than binders updated by courier.

The benefits go beyond document control. When drills, maintenance and reports are recorded in one place, the DPA sees overdue actions across the fleet, the internal auditor can sample evidence before boarding, and the management review rests on data instead of anecdotes.

We look at this approach in more depth in our article on fleet management software for maritime compliance. Digital records bring their own risks, though: IMO expects cyber risks to be addressed in the safety management system, a topic we cover in why shipping has become a ransomware target.

Different fleets feel the pressure in different places. On passenger ships, which have been under the Code from the start, drills, passenger safety and fast shore response carry the highest stakes. This is the context of our Ferry module and our page for ro-pax operators.

For tankers, ISM evidence also feeds commercial vetting. Inspectors assess how the safety management system works in practice, which is why we treat both subjects together in our guide to SIRE 2.0 inspections.

Frequently Asked Questions

What is the ISM Code in simple terms?

The ISM Code is the IMO standard for the safe management and operation of ships and for pollution prevention. It requires each company to run a documented safety management system, appoint a designated person ashore and show through audits that the system is implemented ashore and on every ship.

What is the difference between a DOC and an SMC?

The Document of Compliance is issued to the company and shows that its shore organisation meets the ISM Code for specific ship types. The Safety Management Certificate is issued to each ship and shows that the system is implemented on board. Both are valid for five years, subject to periodic verification.

What does a designated person ashore do?

The DPA monitors the safety and pollution-prevention aspects of each ship's operation, makes sure adequate resources and shore support are provided, and acts as the link between ship and company. The role requires direct access to the highest level of management.

How often is an ISM audit carried out?

External verification follows the certificates: an annual verification for the DOC and an intermediate verification between the second and third anniversary for the SMC, with renewal every five years. Internal audits on board and ashore are run by the company itself, at the intervals set by its SMS.

Can ISM deficiencies lead to a port state control detention?

Yes. Port state control can record ISM deficiencies when inspection findings show that the safety management system is not effectively implemented. Serious or repeated failures can be detainable and lead to a closer examination of the SMS before the ship is allowed to sail.

SupaMaritime brings ISM compliance tracking, drill schedules, audit preparation, certificates, planned maintenance and crew records into one system shared by ships and office. To see how it supports safety management, explore the Merchant module and its full feature list, our pages for tanker operators and bulk carrier operators, and the Ferry module for passenger shipping.