Maritime law, rules and watchkeeping · Level P3 · 5 parts · about 17 min
Safety management on board: the ISM Code
5 short parts: The ISM Code · SMS elements · Reports · Audits & review · Risk assessment. Each part explains the idea, then gives the points to remember, the common mistakes, a worked case and a practice question; the Academy unit adds all 31 check questions.
1 · The ISM Code
The ISM Code: why it exists and what it asks of the company
On ships covered by SOLAS IX, the company and crew work through a documented safety management system (SMS).
Why the Code exists
The ISM Code is the International Safety Management Code. It followed accidents such as the 1987 Herald of Free Enterprise capsize, which exposed failings ashore and on board. SOLAS chapter IX makes it mandatory for covered ships on international voyages: passenger ships of any size, and cargo ships and mobile offshore drilling units of 500 gross tonnage (GT) or more. Government-operated ships used for non-commercial purposes are excluded; national rules may extend coverage.
The company
The Code places the duty on the company: the shipowner, or a manager or bareboat charterer who has taken over the operation of the ship and agreed to take on all the duties of the Code. The company must set up and run a safety management system (SMS). This is the documented way the company and its crews keep people, ships and the environment safe.
Objectives
The Code aims to ensure safety at sea, prevent injury and loss of life, and avoid damage to the environment and to property. The company must provide safe practices and a safe working environment. It must assess all identified risks to its ships, people and the environment, and set safeguards. It must keep improving the safety management skills of its people ashore and on board, including preparation for emergencies.
Six functional requirements
Every SMS must contain: a safety and environmental-protection policy; instructions and procedures that meet international and flag-state rules; defined levels of authority and lines of communication ashore and on board; procedures to report accidents and non-conformities; procedures to prepare for and respond to emergencies; and procedures for internal audits and management reviews.
Rules and guidance
The SMS must make sure you comply with mandatory rules. It must also take into account the codes, guidelines and standards recommended by the IMO, the flag, classification societies and industry bodies. The office holds a Document of Compliance (DOC) and each ship a Safety Management Certificate (SMC); how the flag audits and issues them is in Ship business.
Status in 2026
The Code was last amended with effect from 1 January 2015, and that text is what you apply today. In July 2026 the IMO sub-committee III 12 began a full revision of the guidelines for implementing the Code, resolution A.1188(33), with digital systems and less paperwork among its aims. The target is 2028. Nothing from that work is in force yet.
Key figures
- Legal basis
- SOLAS chapter IX; ISM Code adopted by resolution A.741(18)
- Mandatory since
- 1 July 1998 (first ship types); 1 July 2002 (other ships)
- Ships covered
- International voyages: passenger ships; cargo ships/MODUs ≥500 GT
- Last Code amendment
- MSC.353(92), in force 1 January 2015
- Revision of guidelines
- Started at III 12 (July 2026); target 2028; not in force
Remember
- The ISM Code is made mandatory by SOLAS chapter IX.
- The company is answerable: owner, manager or bareboat charterer who took over the duties.
- Every SMS has six functional requirements, from policy to audits and reviews.
- The company must assess all identified risks and set safeguards.
- The 2026 revision work on the ISM guidelines is not in force; apply the current Code.
Common mistakes
Wrong: The ISM Code is the crew's job; the office only signs the cheques.
Right: The Code makes the company answerable. It must provide resources, shore support and a working SMS.
Wrong: A new ISM Code was adopted in 2026.
Right: Work on revising the implementation guidelines began in July 2026, with a 2028 target. The Code in force is unchanged since 2015.
Worked case
A new manager takes over your bulk carrier and accepts all ISM duties. A colleague says safety procedures are now solely the master's responsibility. Is that right?
Show the answer
No. The manager is now the ISM company. It must run a documented SMS, define responsibilities, provide resources and shore support, assess identified risks and set safeguards. The master and crew put that system into practice on board.
Practice question
Which SOLAS chapter makes the ISM Code mandatory?
- Chapter V, safety of navigation at sea
- Chapter IX, safe operation of ships
- Chapter XI-2, maritime security
- Chapter II-2, fire protection
Show the answer
Answer: B. SOLAS chapter IX, Management for the Safe Operation of Ships, makes the ISM Code mandatory.
2 · SMS elements
The SMS element by element: policy, people, operations and the DPA
The Code's sections build the SMS: policy, responsibilities, the DPA, the master, people, operations, emergencies, maintenance and documents.
Policy and responsibilities
The company writes a safety and environmental-protection policy and makes sure everyone ashore and on board knows and follows it. It defines and documents the responsibility, authority and relationships of everyone who manages, does or checks work that affects safety. It must give enough resources and shore support to make the system work.
The DPA
The designated person ashore (DPA) is a person, or people, ashore with direct access to the highest level of management. The DPA links the ship and the company. The DPA monitors the safety and pollution-prevention side of each ship and makes sure resources and shore support arrive. Anyone on board may contact the DPA directly, for example about a safety concern not resolved on board.
The master
The company defines the master's responsibility: putting the policy into practice, motivating the crew, giving orders and instructions in a clear, simple way, checking that requirements are followed, and periodically reviewing the SMS and reporting its weaknesses to the company. The SMS must state the master's overriding authority: to make decisions on safety and pollution prevention and to ask the company for help.
People and operations
The master must be qualified and fully familiar with the SMS. Each ship must be manned with qualified, certificated and medically fit seafarers. New and transferred staff get a familiarisation before duty, and drills and training needs are identified. The SMS holds plans, instructions and checklists for key shipboard operations, such as cargo work, bunkering and passage planning, with tasks given to qualified people.
Emergencies, maintenance, documents
The SMS identifies likely emergencies, sets procedures and a drill programme, and makes sure the company can respond at any time. Ships are maintained to the rules: inspections, reporting of defects with their causes, corrective action and records. Equipment whose sudden failure could cause a hazardous situation is identified as critical equipment and given extra measures, such as tests of standby systems. Documents are controlled: valid editions where they are used and obsolete ones removed.
Key figures
- DPA
- Ashore, with direct access to the highest level of management
- Master's authority
- Overriding authority on safety and pollution prevention
- Master's review
- Periodic review of the SMS, reported to the company
- Critical equipment
- Sudden failure could cause a hazardous situation: extra measures
- Familiarisation
- Before duty, for new and transferred personnel
Remember
- The DPA links ship and company and has direct access to top management.
- The SMS must state the master's overriding authority on safety and pollution.
- The master periodically reviews the SMS and reports weaknesses ashore.
- Key shipboard operations have plans, instructions and checklists.
- Critical equipment gets specific measures, such as regular tests of standby units.
Common mistakes
Wrong: The DPA is the ship's safety officer on board.
Right: The DPA is ashore, with direct access to the highest level of management, and links every ship to the company.
Wrong: The master may not depart from an SMS procedure under any circumstances.
Right: The master has overriding authority to take the decisions he or she judges necessary for safety and pollution prevention, and should report the reason.
Wrong: Critical equipment means everything listed in the maintenance system.
Right: It is equipment whose sudden failure could create a hazardous situation, such as the steering gear or the emergency generator.
Worked case
The superintendent tells you by phone to start loading before the ballast is fully discharged, to meet the charterer's loading deadline. The chief mate warns that the stress limits would then be exceeded. The master's first reply is to argue with the office. What does the SMS allow?
Show the answer
The master has overriding authority on safety and pollution prevention, and this decision is a safety matter. The master refuses the unsafe instruction, records the reason and informs the company in writing. If the office still presses, anyone on board may contact the DPA, who has direct access to top management. Load only when the ballast and stress plan allow it.
Practice question
Where is the designated person ashore (DPA) based?
- On board, as the ship's safety officer
- Ashore, with access to top management
- At the flag state's audit department
- At the classification society's office
Show the answer
Answer: B. The DPA is ashore and has direct access to the highest level of management. The DPA links the ships and the company.
3 · Reports
Reporting non-conformities, accidents and near misses
The SMS learns only from what is reported. Report non-conformities, accidents and near misses, find the root cause and fix it.
What must be reported
The SMS must have procedures to report non-conformities, accidents and hazardous occurrences to the company. Hazardous occurrences are events that could have caused harm. Reports must be investigated and analysed, so that safety and pollution prevention improve. The company sets procedures to put corrective action in place, including measures to stop it happening again.
Three findings
An observation is a statement of fact made during an audit and supported by objective evidence. It is not automatically a non-conformity: evidence must show a specified requirement is unmet. A non-conformity (NC) means that evidence exists. A major non-conformity is a serious threat needing immediate corrective action, or a lack of effective, systematic implementation of an ISM requirement. External audit handling is in Ship business.
Near misses
A near miss is a sequence of events or conditions that could have caused a loss, such as injury, pollution or damage, but did not, only because the chain was broken by chance. The IMO guidance on near-miss reporting, MSC-MEPC.7/Circ.7, asks companies to encourage these reports. They are free lessons: the same causes, next time, may not be stopped by luck.
Just culture
People report only when they trust the system. A just culture means honest errors are not punished, while reckless acts and deliberate violations are not tolerated. Reports should be easy to make, may be anonymous, and should be answered. Feedback is essential: tell the crew what changed because of their report.
Root cause and corrective action
Corrective action removes the cause of an NC that has happened. Preventive action removes the cause of a possible one. Ask why several times until you reach the root cause, such as an unclear procedure, a missing tool or workload, not just the person who made the error. Agree who acts and by when, then check later that the fix worked.
Key figures
- Near-miss guidance
- MSC-MEPC.7/Circ.7 (IMO, 2008)
- Non-conformity
- Objective evidence that a specified requirement is not met
- Major NC
- Serious threat needing action now, or ISM not systematically applied
- Observation
- Evidence-backed statement of fact recorded during an SMS audit
Handling a near miss on board
- Make the situation safe and stop the work if needed. — The hazard that nearly caused harm may still be there.
- Notify the officer in charge and company through the SMS; record the initial facts. — Unrecorded events cannot be analysed or shared.
- Collect facts: time, place, people, conditions, photos. — Memories fade fast; evidence supports a fair analysis.
- Find the root cause with the people involved. — Blaming one person rarely fixes an unclear procedure or design.
- Agree corrective and preventive actions with owners and dates. — An action without an owner and a deadline is seldom done.
- Share findings and feedback with the crew and company; check that actions work. — Other ships learn from it, and you confirm the fix works.
Remember
- Report non-conformities, accidents and hazardous occurrences to the company.
- A near miss is a loss avoided only by chance; report it.
- A major NC is a serious threat needing immediate action.
- Just culture: honest errors are not punished; reckless acts are not tolerated.
- Fix the root cause, then check that the action worked.
Common mistakes
Wrong: Nobody was hurt, so there is nothing to report.
Right: No injury does not mean no loss. Report any damage or pollution too. A near miss could have caused harm but did not; report it so the causes can be addressed.
Wrong: The corrective action is to warn the person who made the error.
Right: Look for the root cause, such as an unclear procedure, a missing tool or a design fault, and fix that.
Worked case
During mooring, a rope parts under load. The snap-back hits the bulwark where an AB had been standing seconds earlier. Nobody is hurt. The bosun says to splice a new eye and carry on. What do you do?
Show the answer
Stop the operation and make the station safe. Report the rope failure and narrowly avoided injury through the SMS. Keep the parted rope and record the facts: load, rope age, lead and positions of the crew. Check rope condition, leads and crew positions, then establish why inspection, replacement or mooring-planning safeguards failed. Agree actions, inform the company and brief all mooring teams.
Practice question
What is a near miss?
- An accident that caused only minor injuries to the crew
- A breach of a written procedure found during an internal safety audit
- A chain of events that could have caused loss, stopped by chance
- A defect in critical equipment found during maintenance
Show the answer
Answer: C. A near miss is a sequence of events or conditions that could have caused a loss, prevented only by a fortunate break in the chain.
4 · Audits & review
Internal audits, company verification and management review
The company checks its own system: internal audits at least every 12 months, the master's review and a management review that drives change.
Internal audits
The company must carry out internal safety audits on board and ashore at intervals of not more than 12 months. This is ISM section 12. In exceptional circumstances, the interval may be exceeded by up to 3 months; the reason must be documented. Commercial pressure alone is not an exceptional circumstance. The audit checks that safety and pollution-prevention work follows the SMS.
Who audits
Internal auditors should be independent of the area they audit, unless the company is too small for this to be practicable. An officer should not audit his own department. Audits follow documented procedures. The results go to everyone responsible for the area, and the management in charge must take timely corrective action.
Your role in an audit
Before the audit, check your own records: drills, permits, maintenance and familiarisation forms. During it, show how the work is really done and answer honestly. Afterwards, take part in agreeing the root cause and the actions. An audit that finds nothing is not a success if it looked only at paper.
Review and evaluation
The company must periodically evaluate the effectiveness of the SMS and review it at management level. The management review uses audit results, the masters' reviews, reports of NCs, accidents and near misses, and performance data. Its output is decisions: new resources, changed procedures or training. The company must also check that anyone doing ISM tasks for it, such as a manning agent, follows the Code.
External audits in one line
The flag or its recognised organisation carries out initial checks, annual DOC checks, intermediate SMC checks and renewal within five years; see Ship business.
Key figures
- Internal audits
- On board and ashore, at intervals of not more than 12 months
- Exceptional extension
- Up to 3 months, reason documented (ISM 12.1, since 1 July 2010)
- Auditor
- Independent of the area audited, unless impracticable
- Delegated ISM tasks
- The company verifies that delegated ISM tasks comply with the Code
Remember
- Internal audits on board and ashore at least every 12 months.
- An extension of up to 3 months is for exceptional circumstances only, documented.
- Auditors should be independent of the area they audit.
- The management review turns findings into decisions and resources.
- External ISM audits are the flag's job; internal audits are the company's.
Common mistakes
Wrong: The internal audit can be skipped in a year with an external audit.
Right: Internal audits are still required at intervals of not more than 12 months. The external audit does not replace them.
Wrong: The chief engineer can audit the engine department to save time.
Right: Auditors should be independent of the area audited, unless that is impracticable. Another qualified auditor should do it.
Worked case
Your ship's last internal audit was 13 months ago. The superintendent who should do it is busy with a new building, and the office suggests waiting until dry dock in four months. Is that acceptable?
Show the answer
No. The interval is 12 months. It may be exceeded by up to 3 months only in exceptional circumstances, documented. A busy superintendent is a resource problem, not an exceptional circumstance, and waiting four more months would reach 17 months anyway. The company must send another independent auditor now and record why the audit was late.
Practice question
What is the maximum normal interval between internal safety audits on board?
- 6 months
- 12 months
- 24 months
- 36 months
Show the answer
Answer: B. ISM section 12.1 requires internal safety audits at intervals not exceeding 12 months.
5 · Risk assessment
Risk assessment, the controls hierarchy and permits to work
Risk is likelihood × severity. Assess a task before you start it, choose the strongest control you can and use a permit for high-risk work.
Hazard and risk
A hazard is anything that can cause harm: a fall from height, a toxic atmosphere, a rotating shaft. Risk combines how likely the harm is with how bad it would be. A risk assessment identifies the hazards of a task, rates the risk, chooses controls and checks that the residual risk, the risk left after the controls, is acceptable. The ISM Code requires the company to assess all identified risks.
The risk matrix
Many companies use a 5 × 5 risk matrix. Likelihood runs from 1, rare, to 5, almost certain. Severity runs from 1, minor injury, to 5, a death or major pollution. Risk = likelihood × severity. A common banding is 1–4 low, 5–12 medium and 15–25 high. High risk means you do not start until controls bring it down. Use your own company's matrix and bands.
Hierarchy of controls
Choose the strongest control first. Elimination: remove the hazard entirely, for example by doing the job from deck instead of climbing. Substitution: use something less dangerous. Engineering controls: guards, fixed ladders, ventilation. Administrative controls: procedures, permits, training, signs. Personal protective equipment (PPE), such as a harness, comes last because it relies on each person using it correctly.
Worked example
Changing a foremast lamp while the ship rolls could cause a fatal fall. For this example, likelihood 3 × severity 5 = 15: high. Delay until conditions are suitable. Use approved access and fall protection, a work-aloft permit and a standby person. If reassessment supports likelihood 1, residual risk is 1 × 5 = 5, medium. Start only if company acceptance and authorisation rules are met and all controls are verified. Controls may reduce likelihood, severity or both; justify each rating.
Permit to work
A permit to work is a written authority for high-risk work, such as hot work, entry into an enclosed space, work aloft or over the side, or work on electrical systems. It states the task, hazards, precautions, tests and time limit, and is signed by the person in charge. For enclosed spaces, follow the IMO recommendations MSC.581(110) of 2025, which replaced A.1050(27): test the atmosphere, including carbon dioxide, before and during entry.
Toolbox talk
Before the job, hold a short toolbox talk with everyone involved: the task, the hazards, the controls and who may stop the job. Anyone may stop work that has become unsafe. If conditions change, such as the weather, the plan or the people, stop and assess again.
Key figures
- Risk
- Likelihood × severity (e.g. 1–5 each on a 5 × 5 matrix)
- Common bands
- 1–4 low, 5–12 medium, 15–25 high (company matrices vary)
- Controls hierarchy
- Eliminate, substitute, engineer, administrative, PPE
- Worked example
- Mast work: 3 × 5 = 15; if reassessed likelihood is 1, 1 × 5 = 5
- Enclosed spaces
- MSC.581(110) (2025), replacing A.1050(27)
Remember
- Risk = likelihood × severity; assess before you start.
- Choose the strongest control first; PPE is the last line.
- Controls may reduce likelihood, severity or both; justify the residual rating.
- A permit to work covers hot work, enclosed spaces, work aloft and similar tasks.
- Anyone may stop unsafe work; reassess when conditions change.
Common mistakes
Wrong: With a harness on, work aloft at sea is low risk.
Right: PPE is the weakest control. First remove or reduce the hazard, for example by waiting for anchor and calm water.
Wrong: Once the permit is signed, the risk assessment is finished.
Right: Reassess when conditions change, and close the permit only when the work is complete and the place is safe.
Worked case
You must open a cargo hold that has been closed for 20 days with a cargo of logs, to check lashings. The hatch is open and the air looks clear. A cadet wants to go straight down the ladder. Can the cadet enter, and what must happen first?
Show the answer
Stop entry. Logs can deplete oxygen and release gases. Follow the SMS enclosed-space procedure: ventilate; sample remotely at several heights and locations for oxygen, flammables and relevant toxic gases, including carbon monoxide and carbon dioxide. Enter only with safe readings, acceptable residual risk, an authorised permit, an attendant, communications and rescue readiness. Maintain ventilation and monitoring; leave if conditions become unsafe.
Practice question
On a 5 × 5 matrix, a task is rated likelihood 3 and severity 4. What is the risk score?
- 7
- 12
- 15
- 20
Show the answer
Answer: B. Risk = likelihood × severity = 3 × 4 = 12.