Every ship over 500 tons carries a Safety Management System. On the best-run vessels it shapes how the crew actually works. On too many others it is a binder that comes off the shelf when an auditor arrives. The gap between those two states is where accidents and detentions live.
A Code Written Because People Kept Dying
The International Safety Management Code, the ISM Code, exists for a blunt reason: investigation after investigation found that most maritime accidents were caused not by freak weather or mechanical bad luck, but by human error and poor management. Adopted by the IMO and made mandatory through SOLAS Chapter IX, it took effect for passenger ships and high-speed craft in 1998 and for other cargo ships of 500 gross tonnage and above on international voyages in 2002. Its premise is that if the management of safety is systematic rather than ad hoc, fewer people die.
The mechanism it requires is the Safety Management System, the SMS: a documented set of policies, procedures, responsibilities, and reporting lines covering how a company and its ships operate safely and protect the environment. On paper, every compliant company has one. The difference between vessels is not whether the SMS exists. It is whether it is alive.
The Architecture, in Plain Terms
Before getting to why systems fail, it helps to understand the parts, because the structure itself carries the intent. The ISM framework rests on a small number of load-bearing elements.
The SMS: The documented system of safety and environmental policy, procedures, and responsibilities that the company and ship operate to.
The DOC: The Document of Compliance, issued to the company after audit, confirming its shore-side system meets the Code for the ship types it operates.
The SMC: The Safety Management Certificate, issued to the individual ship, confirming the SMS is effectively implemented on board.
The DPA: The Designated Person Ashore, with direct access to the highest level of management, linking ship and company and safeguarding safety.
Two features of this structure reveal what the Code is really trying to do. First, the DOC and SMC are linked: if a company’s Document of Compliance lapses or is withdrawn, the Safety Management Certificates of its ships fall with it, because a ship cannot be well managed by a company that is not. Second, the SMC certifies not that procedures exist but that they are effectively implemented on board. The Code is asking about practice, not paperwork, from the outset.
The Person Who Makes It Work
The single most important, and most misunderstood, element is the Designated Person Ashore. The Code requires every company to designate a person ashore with direct access to the highest level of management, responsible for monitoring the safety and pollution-prevention aspects of each ship’s operation and ensuring adequate resources and shore support are provided. The phrase that matters is direct access to the highest level of management.
The DPA is not a title on an org chart. It is a guarantee that a safety concern from the ship can reach the top of the company without being filtered by the people whose budgets it might threaten.
That is the genius and the vulnerability of the role. Done properly, the DPA is the channel that stops commercial pressure from quietly overriding safety, because the person raising the alarm can go straight to the top. Done as a name on a certificate, with no real involvement or authority, the channel is decorative and the protection is gone. Auditors and inspectors increasingly probe the DPA’s actual involvement, not just their appointment, precisely because the difference is where the system succeeds or fails.
The Binder Problem
Here is the failure mode the whole industry recognises. A company builds an SMS, often a thick and impressive one, and then the ship operates one way while the manual describes another. Procedures are written for the auditor rather than the crew. Risk assessments are copied and filed rather than thought through. Near-misses go unreported because reporting feels like paperwork with no payoff. The SMS becomes a binder that lives on a shelf, produced when an inspector arrives and ignored the rest of the time.
The consequences are not abstract. A paper SMS shows up in Port State Control detentions, where ISM deficiencies act as a multiplier: a scatter of individually minor findings can be read together as objective evidence that the safety management system is not working, which is itself a detainable deficiency. It shows up in modern tanker vetting, where inspection regimes now assess whether the crew can actually perform and explain their tasks, not merely whether a procedure exists. The industry has, deliberately, been closing the gap where a paper system could pass as a real one.
A Safety Management System that the crew does not use is not a safety system. It is a liability with a professional cover, and inspectors are now trained to find exactly that.
What a Living System Looks Like
The contrast with a working SMS is stark, and it is less about the documents than about behaviour. On a ship where the system is alive, procedures reflect how the work is genuinely done, so following them is natural rather than a performance. Near-misses are reported because the crew has seen reports lead to real changes, which means the company is learning from small failures before they become large ones. The DPA is a known, trusted point of contact who actually engages, not a name few aboard could identify.
Above all, a living system shows continuous improvement, which is one of the Code’s stated objectives. Non-conformities and incidents are analysed and feed back into changed procedures, so the SMS evolves with the ship and its trade rather than fossilising. The test is simple: does the system make the ship safer, or only make it look compliant? A crew that would keep working the same way even if the manual vanished has a real system. A crew that behaves one way for the auditor and another the rest of the time does not.
Closing the Gap
Turning a binder into a working tool is not about writing more procedures. Usually it means writing fewer and better ones, procedures that match reality closely enough that the crew uses them without being told. It means a reporting culture where raising a near-miss is rewarded rather than punished, so the company sees the small signals. It means a DPA with genuine authority and genuine engagement. And it means treating audits and inspections as a check on whether the system is actually working, rather than a performance to survive.
The ISM Code was never meant to generate paperwork. It was meant to make the management of safety systematic, because systematic safety saves lives and ships. For operators across the region, where Port State Control and vetting regimes are steadily raising the bar on demonstrated implementation, the payoff for closing the gap between the binder and the bridge has never been clearer. A safety management system that is genuinely lived is cheaper, safer, and far easier to defend than one that only looks the part.
Frequently Asked Questions
What is the ISM Code and is it mandatory?
The International Safety Management (ISM) Code is the IMO’s mandatory standard for the safe management and operation of ships and for pollution prevention. It is made compulsory through SOLAS Chapter IX and applies to passenger ships and to cargo ships of 500 gross tonnage and above on international voyages. It requires every company to develop and maintain a documented Safety Management System.
What is the difference between the DOC and the SMC?
The Document of Compliance (DOC) is issued to the company after audit, confirming that its shore-side safety management system meets the ISM Code for the ship types it operates. The Safety Management Certificate (SMC) is issued to each individual ship, confirming that the system is effectively implemented on board. The two are linked: if the company’s DOC is withdrawn or lapses, the SMCs of its ships become invalid.
Who is the Designated Person Ashore and why does the role matter?
The Designated Person Ashore (DPA) is required by the ISM Code and must have direct access to the highest level of management. The role monitors the safety and pollution-prevention aspects of each ship’s operation and ensures adequate resources and shore support. Its importance lies in that direct access: it allows a safety concern from the ship to reach top management without being filtered by intermediate commercial interests. Auditors assess the DPA’s genuine involvement, not just the appointment.
How does a “paper” SMS lead to detention?
When a safety management system is documented but not actually followed, inspectors can find a pattern of individually minor deficiencies that together indicate the system is not working. Under Port State Control this can be recorded as an ISM-related detainable deficiency, the so-called ISM multiplier, because the collective evidence points to a management failure rather than isolated faults. Modern vetting regimes similarly test whether crews can perform tasks, not just whether procedures exist.
Sources: Maritime and Port Authority of Singapore, ISM Code objectives and SMS · ISM Code overview: SOLAS IX, DOC, SMC, DPA, functional elements · ISM compliance guide, DOC/SMC validity and the DPA’s role · IMO ISM Code (Resolution A.741(18)); SOLAS Chapter IX
Continue reading
-
compliance Fixed Firefighting Systems: Choosing for the Engine Room
-
compliance Immersion Suits: What Tropical Waters Actually Require
-
compliance SCBA and EEBD: Two Sets Constantly Confused
-
compliance Liferaft Servicing: How Certification Quietly Lapses
-
compliance The Firefighting Foam Ban: What AFFF Phase-Out Means at Sea