The International Safety Management Code is the maritime industry's foundational safety management standard, and yet misunderstanding of what it actually requires is widespread among ship owners who have delegated ISM compliance to their technical manager.
Understanding what the ISM Code demands, what the critical deliverables are, and how to evaluate whether your management company is genuinely delivering compliance (as opposed to maintaining paper compliance) is essential knowledge for any serious ship owner.
What is the ISM Code and Why Is It Mandatory?
The International Safety Management (ISM) Code is an international standard for the safe management and operation of ships and for pollution prevention. It was adopted by the International Maritime Organisation (IMO) as part of SOLAS Chapter IX, making it mandatory for ships engaged in international voyages above 500 GT from 1998 onwards.
The ISM Code operates on a simple but demanding premise: that safe ship operation requires a documented, implemented, and continuously improving Safety Management System (SMS) that covers both the shipboard environment and the shore-based management company. A company cannot have a compliant SMS on paper that is not being actively implemented on its vessels, the Code explicitly requires evidence of effective implementation, not just documentation.
The ISM Code is structured around 16 elements, from Safety and Environmental Protection Policy (Element 1) through to Documentation (Element 11) and Company Verification, Review, and Evaluation (Element 12). Every element has specific requirements that must be demonstrably implemented.
SMS Documentation: The Company's Safety Management System
The Safety Management System is the documentary backbone of ISM Code compliance. For a technical ship manager, building and maintaining an SMS that meets ISM Code requirements is a core deliverable, not an optional extra.
The SMS must include:
Policy Documents
A safety and environmental protection policy signed by the company's highest level of management (typically the Director or CEO). This document establishes the company's commitment to safe operation and is the foundation of the entire SMS.
Procedures and Instructions
Documented procedures for all aspects of vessel operation that carry safety or pollution prevention relevance: navigation, cargo operations, mooring, bunkering, emergency response, planned maintenance, and more. Procedures must be vessel-specific where required, a generic procedure that does not match the vessel's actual equipment or operational pattern is a non-conformity risk.
Emergency Preparedness Plans
The SMS must include documented plans for responding to potential emergency situations: fire, flooding, grounding, collision, man overboard, and, for tanker operators, cargo spill response. Emergency plans must be regularly exercised through drills, with drill records maintained.
Reporting and Investigation Procedures
Near-miss reporting, accident reporting, and non-conformity reporting procedures. One of the most common ISM audit findings is insufficient near-miss reporting, vessels that submit zero near-miss reports are almost certainly not operating in a genuine safety reporting culture.
The Two ISM Certificates: DOC and SMC
ISM compliance is evidenced by two certificates:
Document of Compliance (DOC)
Issued to the company after an audit by the flag state or a Recognised Organisation (RO) confirms that the shore-based SMS meets ISM Code requirements. The DOC specifies the ship types the company is approved to manage. It is valid for five years with annual verification audits required to maintain its validity.
Safety Management Certificate (SMC)
Issued to each individual vessel after an audit confirms that the SMS is being effectively implemented onboard. The SMC is valid for five years with an intermediate verification audit required between the second and third anniversary dates.
A vessel trading in international waters without a valid SMC is in breach of SOLAS and is subject to port state control detention. For technical ship managers, tracking the validity of DOC and SMC certificates, and the intermediate verification schedule, is a non-negotiable compliance obligation.
Interim Certificates
When a new company is formed or a new vessel is added to an existing DOC, an Interim DOC (valid 12 months) and Interim SMC (valid up to 6 months) are issued to allow the company time to demonstrate implementation before the full certificate is issued.
Master's Obligations Under the ISM Code
The ISM Code places specific obligations on the vessel's Master that technical ship managers must support and enforce:
The Master is responsible for implementing the company's SMS onboard
The Master has overriding authority to take decisions necessary for safety, even if those decisions conflict with commercial instructions from charterers or owners
The Master must ensure that the crew is familiar with the SMS
The Master must review the SMS and report deficiencies to the company's shore management
A company that commercially pressures a Master not to exercise their overriding authority, or whose shore-based management fails to respond when a Master raises safety concerns, is in fundamental breach of the ISM Code's intent, regardless of whether its documents are in order.
Company Obligations Under ISM Code
The company's obligations under the ISM Code go beyond maintaining documents. The Code requires the company to:
Ensure adequate resources and shore-based support for safe vessel operation
Appoint a Designated Person Ashore (DPA) with direct access to highest management and adequate authority
Respond promptly and effectively when vessels report hazards, near-misses, or non-conformities
Conduct internal audits of the SMS at intervals not exceeding 12 months
Review the SMS at regular intervals, update it as regulations change, and continuously improve it based on operational experience
The company's commitment to these obligations is assessed at the DOC annual verification audit. A company that has conducted no internal audits since the last annual verification, or that cannot produce records of DPA engagement with vessel safety concerns, will find the audit outcome difficult to defend.
Audit Requirements: Internal and External
ISM compliance audits operate at two levels:
Internal Audits
Required annually under ISM Code Element 12. Internal auditors must be independent from the function or area being audited, the Chief Engineer cannot audit the engineering department's own maintenance records. Internal audit findings must be documented, corrective actions must be assigned and tracked, and the effectiveness of corrective actions must be verified before a finding can be formally closed.
External Audits
Conducted by the flag state or an approved Recognised Organisation (classification society acting as RO) for DOC and SMC issuance and renewal. External audit frequency follows the certificate validity cycle: annual verification for DOC, intermediate verification for SMC (between 2nd and 3rd anniversary), and renewal audit every 5 years.
Most major classification societies (DNV, Lloyd's Register, Bureau Veritas, ClassNK) are approved as Recognised Organisations for ISM audits, meaning the same organisation can provide both class surveys and ISM certification, a logistical advantage that many ship managers use to streamline the annual compliance calendar.
Non-Conformity Management: The Test of a Genuine SMS
How a ship management company manages non-conformities (NCs) is the most revealing indicator of whether its SMS is genuine or cosmetic. The ISM Code defines a Non-Conformity as an observed situation where objective evidence indicates the non-fulfilment of a specified requirement.
A genuine, functioning ISM compliance system will:
Document all non-conformities, from internal audits, near-miss investigations, PSC inspections, and vetting reports
Conduct root cause analysis, identifying not just what went wrong, but why it went wrong (human error? procedure gap? inadequate training? management pressure?)
Implement corrective actions, specific, accountable, time-bound actions to address the root cause
Verify effectiveness, confirm that the corrective action has actually prevented recurrence before closing the NC
A Major Non-Conformity (major NC), defined as a situation that poses a serious threat to personnel safety or the environment, or a significant breach of ISM Code requirements, must be corrected before a DOC or SMC can be issued or renewed. A company with unresolved major NCs cannot receive ISM certification.
The pattern of a company's non-conformity register over time tells the story of its safety management maturity. A register that shows recurring non-conformities in the same categories, or that shows NCs being closed without verified corrective actions, indicates systemic management weakness regardless of what the SMS documents say.
How Emaris Delivers ISM Compliance for Ship Owners
Emaris Shipping holds an active ISM-certified SMS managed by our Director, Mr. Muhammad Sodiq, a certified DPA, CSO, and Flag State Inspector with over 13 years of maritime operations experience specialising in HSSEQ management and ISO certification systems.
Our ISM compliance programme for vessels under technical ship management includes:
Vessel-specific SMS documentation maintained to current flag state and classification society requirements
Annual internal audit programme with independent auditors and fully documented findings
Non-conformity register with root cause analysis and verified corrective actions for every finding
DPA engagement with all vessel-reported near-misses, with response communicated back to vessel within 48 hours
DOC and SMC certificate tracking with advance notification of verification audit requirements
For ship owners whose vessels are approaching an SMC intermediate or renewal audit, our ship safety management approach ensures the vessel and company documentation are audit-ready at all times, not just in the weeks before an inspection.
Frequently Asked Questions
What is the difference between the ISM Code and the ISPS Code?
The ISM Code (International Safety Management Code) governs safety and pollution prevention management. The ISPS Code (International Ship and Port Facility Security Code) governs ship and port security. Both are mandatory under SOLAS for most commercial vessels, and both require separate certification: DOC/SMC for ISM, and an International Ship Security Certificate (ISSC) for ISPS. Many ship management companies combine both roles, appointing the same individual as both DPA (ISM) and CSO (ISPS).
What happens if a vessel loses its SMC?
A vessel without a valid SMC cannot legally engage in international trade. Port state control authorities are authorised to detain a vessel that cannot produce a valid SMC on request. The certificate would be reinstated following a successful reinstatement audit confirming that the non-conformities causing the suspension have been resolved.
How often must internal ISM audits be conducted?
The ISM Code requires internal audits at intervals not exceeding 12 months. In practice, most professional ship management companies conduct annual internal audits of both shore-based operations and onboard SMS implementation. The 12-month interval may be extended by a maximum of 3 months in exceptional, documented circumstances.
Can a ship owner have their own ISM compliance separate from their manager's DOC?
If a ship owner has delegated ISM management to a third-party ship manager, the manager's DOC covers the managed vessels. If the owner wishes to retain ISM responsibility, they must hold their own DOC, which requires establishing and auditing their own SMS. In practice, most third-party management arrangements transfer ISM responsibility to the manager as part of the management agreement.
External Sources: