The ISM Code explained: what it requires and how to keep your SMS working

What is the ISM Code?

The ISM Code's full name is the International Management Code for the Safe Operation of Ships and for Pollution Prevention. IMO adopted it in 1993 by resolution A.741(18), and it became mandatory when SOLAS chapter IX entered into force on 1 July 1998. Its stated purpose is to provide an international standard for the safe management and operation of ships and for pollution prevention.

The Code is deliberately short and written in general terms. It does not tell a company how to load cargo or keep a watch. It tells the company to have a documented system that makes sure those things are done safely, and to prove that the system works. In the Code's own words, the cornerstone of good safety management is commitment from the top.

The Code has been amended several times, most recently by resolution MSC.353(92), in force from 1 January 2015, which added references to guidance on the Designated Person, near-miss reporting and company implementation.

In July 2026, IMO's Sub-Committee on Implementation of IMO Instruments (III 12) began a review of the ISM Code implementation guidelines. The review concerns the guidelines, not the Code itself.

Which ships and companies does the ISM Code apply to?

Under SOLAS chapter IX, the ISM Code became mandatory, regardless of build date:

• from 1 July 1998 for passenger ships, and for oil tankers, chemical tankers, gas carriers, bulk carriers and cargo high-speed craft of 500 gross tonnage and above;
• from 1 July 2002 for other cargo ships of 500 gross tonnage and above.

The duties fall on the Company: the owner, or any manager or bareboat charterer who has taken over responsibility for operating the ship and agreed to take on all the duties the Code imposes. Where the operator is not the owner, the owner must report the operator's details to the flag Administration.

What does the ISM Code require?

The Code has two parts. Part A sets out what the company must do; Part B covers certification.

The company's safety management objectives, under section 1.2.2, are to provide safe practices and a safe working environment, to assess all identified risks to its ships, personnel and the environment and establish safeguards, and to continuously improve the safety management skills of people ashore and on board.

What are the functional requirements of a safety management system?

Section 1.4 lists six functional requirements every SMS must include:

1. a safety and environmental protection policy;
2. instructions and procedures for safe operation and environmental protection, in line with international and flag State legislation;
3. defined levels of authority and lines of communication between shore and ship personnel;
4. procedures for reporting accidents and non-conformities;
5. procedures to prepare for and respond to emergencies;
6. procedures for internal audits and management reviews.

The SMS must also ensure compliance with mandatory rules and take into account codes and guidelines from IMO, flag Administrations, class societies and industry organisations. This is how industry guidance, such as OCIMF and INTERCARGO publications, becomes part of what an auditor expects to see.

What does the Designated Person Ashore do?

The Designated Person Ashore (DPA) provides the link between the company and the people on board. Section 4 requires the DPA to have direct access to the highest level of management, and to monitor the safety and pollution prevention aspects of each ship's operation, making sure adequate resources and shore support are applied. IMO guidance in MSC-MEPC.7/Circ.6 covers the DPA's qualifications, training and experience.

The Master, under section 5, implements the policy on board, issues clear orders, verifies that requirements are observed and periodically reviews the SMS, reporting its deficiencies to the office. The SMS must state the Master's overriding authority to make decisions on safety and pollution prevention.

How is ISM compliance certified?

Compliance is verified by the flag Administration or a recognised organisation, usually the class society, through two certificates:

A copy of the DOC must be kept on board so the Master can show it to flag or port State control officers.

Auditors grade findings. A non-conformity is an observed situation where objective evidence shows a requirement is not met. A major non-conformity is a deviation that poses a serious threat to people, the ship or the environment and needs immediate action, or a lack of effective and systematic implementation of the Code. A major non-conformity has to be downgraded before a certificate can be issued or kept.

What does the ISM Code say about internal audits and review?

Section 12.1 requires internal safety audits on board and ashore at intervals not exceeding 12 months. In exceptional circumstances the interval may be exceeded by not more than three months. Auditors should be independent of the area audited, unless the company is too small for that to be practicable, and results must reach the people responsible, who take timely corrective action.

The company must also periodically evaluate the SMS as a whole (section 12.3). Most companies do this through a management review, which is where audit results, incidents, near misses, PSC findings and vetting observations should come together. If you also complete TMSA 3 or DryBMS, the same evidence can serve both; see our TMSA 3 guide and DryBMS guide.

How does the ISM Code cover maintenance and critical equipment?

Section 10 requires procedures to keep the ship in line with the rules, with inspections at set intervals, non-conformities reported with their cause, corrective action and records. Section 10.3 adds that the company must identify equipment and technical systems whose sudden failure may cause hazardous situations, and set specific measures to make them reliable, including regular testing of standby equipment and systems not in continuous use. These measures must be part of the ship's maintenance routine, which is why auditors and PSC officers look at the planned maintenance system.

How does cyber risk fit into the ISM Code?

IMO resolution MSC.428(98) affirms that an approved SMS should take cyber risk management into account, in line with the ISM Code's objectives. It encourages Administrations to ensure cyber risks are addressed in SMSs no later than the first annual verification of the company's DOC after 1 January 2021. Practical guidance is in the IMO Guidelines on maritime cyber risk management (MSC-FAL.1/Circ.3, as revised). Auditors now expect the SMS to identify the ship's IT and operational technology systems, assess the risks to them and set out how the crew detect, respond to and recover from an incident.

Why do safety management systems fail in practice?

Most SMS failures are not missing procedures. They are procedures that nobody on board can use. The patterns auditors and inspectors meet most often:

• manuals that have grown by adding a circular after every incident, until they contradict each other;
• generic procedures that describe equipment the ship does not have;
• checklists signed by people who cannot explain the task;
• near misses that are reported but never analysed or fed back;
• management reviews that list findings but do not change anything;
• risk assessments copied from ship to ship without being reviewed for the job in hand;
• revisions issued ashore that never reach the ship, so the crew still work from an older copy.

When this happens, PSC officers record ISM deficiencies, and vetting inspectors record process and human observations. ISM deficiencies made up 4.5% of all Paris MoU deficiencies in 2025, and a detainable ISM deficiency can follow when several technical failures point to the same weakness in the system. We look at these failure patterns in more depth in where most safety management systems break down and why documented controls fail under real audits.

How do you keep an SMS that crews actually follow?

1. Write for the person doing the job. Short, task-based procedures, in the working language of the crew (section 6.6).
2. Map every requirement to one procedure. A compliance matrix shows where each ISM, flag and industry requirement is met, so nothing is lost when duplication is removed.
3. Control documents properly. One current version, reviewed and approved changes, obsolete copies removed (section 11).
4. Make reporting worth doing. Analyse near misses and non-conformities, and tell the crew what changed as a result.
5. Audit practice, not paperwork. Observe the work as well as the records.
6. Close the loop in the management review. Trend findings across the fleet and act on repeats.
7. Keep critical equipment visible. Link it to the planned maintenance system so tests and standby checks are not missed.

For a closer look at why crews stop reading manuals, see why crews don't read the SMS.

Where does an SMS revamp help?

An SMS revamp helps when the system is compliant on paper but hard to use on board. It also helps when the company itself changes: for example, merging two companies' SMSs into one after a merger, or combining or separating the SMSs of several DOCs within one group. Master Mariners restructure the manuals into plain, task-based procedures and trace each requirement of the ISM Code, flag rules, SIRE 2.0, TMSA 3 and DryBMS to the procedure that meets it. Synergetic has completed 14+ SMS revamps. To keep controlled procedures and audit findings in one place afterwards, see DMS X7 and HSEQ X7, the document management and HSEQ modules of Marine X7.

Related