Operational Guide · Registers & Logbooks

# Internal SMS Audit

How to plan and conduct the internal audit the ISM Code requires before every external audit — and how to make it a useful tool, not just a formality.

ISM Code internal audit SMS DOC SMC

## Operational Explanation

The internal audit is the periodic verification, carried out by qualified personnel independent of the area being audited, of the compliance and effectiveness of the Safety Management System. It is the mechanism by which the Company self-assesses before the certification body does, and it is an explicit requirement of the ISM Code.

A well-conducted internal audit identifies NCs before the external auditor does, allowing them to be addressed calmly; a "box-ticking" internal audit leaves it to certification audits or PSC inspections to uncover the same deficiencies, with more serious consequences.

## Regulatory Reference

ISM Code, par. 12 (Company Verification, Review and Evaluation): the Company must conduct periodic internal audits to verify SMS compliance, with auditors independent of the area under audit, except where the Company's small size makes this impracticable.

## Scope of Application

Applies both to the Company's shore offices and to every ship in the fleet, at intervals not exceeding 12 months (common practice, unless a different approved internal procedure applies).

## Procedure / How to Complete It

1. Plan the annual internal audit programme, covering every area of the SMS and every ship in the fleet.
2. Assign auditors who are qualified and independent of the area/ship being audited.
3. Conduct the audit by checking documents, records (ORB, GRB, NC, Near Miss) and crew interviews.
4. Record the NCs identified, classifying them and assigning a CAPA with an owner and a deadline.
5. Report the audit results to the DPA and, in aggregated form, to the Management Review.
6. Verify at the next audit that the CAPAs from the previous one have been effectively closed.

## Practical Example

Example report: "Internal SMS audit, vessel XYZ, 14.04.2026 — 2 minor NCs (winch maintenance checklist, incinerator ash record), 0 major NCs. CAPAs assigned with a 30-day deadline. Next internal audit scheduled within 12 months."

## Real Cases

Classification/certification societies, during external DOC renewal audits, systematically check the internal audit programme of the last 12 months: the absence of an audit on one or more fleet vessels, or auditors not independent of the area verified, are among the most common NCs identified at this stage.

## Common Mistakes Mistake Library

Mistake | Consequence | How to avoid it
--- | --- | ---
An auditor verifying their own area of responsibility | Loss of independence, NC in external audit | Always assign auditors external to the area/ship to be verified
Internal audit limited to checking the presence of documents, without crew interviews | Systemic NCs (e.g. weak safety culture) do not emerge | Always include direct interviews and field observation, not just document review
Internal audit programme does not cover all fleet vessels within the required interval | NC in external certification audit | Track the annual programme with deadlines for each vessel and verify compliance

## PSC Observations

Although PSCOs do not conduct the internal audit itself, they check the on-board evidence of the last internal audit carried out (report, open/closed NCs) as part of the general verification of the SMS's functioning.

## Operational Tips

- Schedule internal audits spread across the year, not concentrated just before the external audit.
- Train internal auditors in interview techniques and root cause analysis, not just document checklists.
- Use the aggregated results of internal audits as a primary input for the Management Review.

## Checklist

- Annual internal audit programme covers all vessels and shore offices
- Auditors independent of the area/vessel verified
- Document review plus crew interviews included
- NCs identified, classified and assigned a CAPA
- Closure of the previous audit's CAPAs verified

## FAQ

How often must an internal audit be conducted on a ship?
Common practice, in the absence of a fixed term in the Code, is not to exceed 12 months between one internal audit and the next on the same ship.
Who can conduct an ISM internal audit?
Qualified personnel (often with 'internal auditor' ISM/ISO training), independent of the area or ship under verification.
Does the internal audit replace the external certification audit?
No: they are complementary. The internal audit is conducted by the Company itself; the external audit, conducted by the Flag Administration or a recognised organisation, issues/renews the DOC and SMC.
🎬 Additional photos, videos and interactive diagrams for this topic will be available in a future version of the platform.

## Related Topics

Non Conformity (NC) Management Management Review Document of Compliance (DOC) and Safety Management Certificate (SMC)

### Leave feedback

Help us improve the platform during the beta -- it takes thirty seconds.

How useful do you find the platform so far?
Comment (optional)
Sign me up for the newsletter
Role