An audit that turns up nothing is not proof the system is sound — it may only mean nobody looked hard enough. This chapter works through how findings get graded, why a corrective action has to outlast the person who made the mistake, and what a ship actually needs in hand before a PSC officer starts asking questions.
An internal audit that turns up nothing is not good news. It usually means one of two things: the system genuinely has no weak points that day, which is rare on a working ship, or the audit did not look hard enough to find them. Either way, the audit's job is not to produce a clean report for the file — it is to find the gap in the safety management system before an external auditor, a port State control officer, or an incident finds it instead.
Internal audits are carried out by the company against its own SMS, using auditors who are independent of the area being audited — the chief officer does not audit the deck department he runs. External audits are carried out by the flag State or a recognised organisation acting on its behalf, and check the same ground from outside the ship's own reporting chain. Both cover the same functional elements the ISM Code requires every operator to have in place: safety and environmental policy, defined responsibilities, resources and personnel, the designated person ashore, the master's authority, resources provided for the master, plans for shipboard operations, emergency preparedness, reporting of non-conformities and accidents, maintenance of ship and equipment, documentation, and company verification, review and evaluation.
An audit programme is not there to prove the SMS works. It is there to find where it does not, while there is still time to fix it.
Every audit finding has to be graded, because the grade decides how urgently the company has to react. An observation is a statement of fact with no objective evidence of a breach — something that could weaken the system if left alone, worth recording and watching. A non-conformity (NC) is an observed departure from the SMS or from the ISM Code itself: a procedure exists and was not followed, or a required record does not exist. A major non-conformity is a non-conformity serious enough to pose a significant threat to the safety of personnel or the ship, a serious risk to the environment, or one that shows the SMS is not being effectively or systematically implemented. A major NC calls for immediate corrective action, and in the worst case can hold up certification until it is closed.
The grading is a judgement call, and it is the one most often argued over in the auditor's office. The test is not how embarrassing the finding looks, but what could have happened if the gap had been exploited by bad luck rather than found by an auditor. A missing entry in a drill log is usually an NC. A missing entry that turns out to mean the drill was never actually run is a major NC, because now the crew's real readiness for that emergency is unknown, not just their paperwork.
Grade the finding by what it says about risk, not by how bad the paperwork looks.
Every corrective action starts with a root cause, and the most common mistake in an SMS is stopping one step too early. “The AB forgot to log the readings” is not a root cause — it is the failure itself, restated. A root cause sits at least one step behind that: why was it possible, or likely, for that AB to forget? Perhaps the log sheet is kept somewhere inconvenient, or is due at a time that clashes with another routine watch task, or the last few ABs to hold the job were never actually shown how the log gets checked. Asking “why” several times in succession is a simple way to keep pushing past the first, most convenient answer.
This matters because the corrective action has to match the cause. If the cause really were carelessness, re-briefing the individual might work. But retraining the person who made the error, on its own, rarely survives an auditor's scrutiny, because it does nothing for the next person to do that job — and there will be a next person. A genuine corrective action changes the procedure, the equipment, the checklist, the rota, or the way the job is assigned, so the failure is harder to repeat regardless of who is doing the work. Training stays useful, but as a secondary control alongside a process change, not as the whole answer.
A risk assessment written after the job is not a risk assessment — it is paperwork written to excuse what has already happened. The whole value of assessing risk beforehand is that the controls can still be chosen, not just recorded, while there is still time to eliminate a hazard rather than simply warn people about it. A risk assessment done retrospectively, to satisfy the permit system, is one of the more common findings behind an SMS that looks compliant but is not actually functioning.
The hierarchy of control gives the order in which controls should be sought, from strongest to weakest: eliminate the hazard entirely; substitute it with something less dangerous; engineer it out with a physical barrier or design change; administrate it with procedures, permits and training; and only then protect the individual with personal protective equipment. PPE sits at the bottom because it depends on a person wearing it correctly, every time, under pressure — it is the least reliable control, not the first one to reach for. A risk assessment whose only listed control for a hazard is PPE has effectively stopped at the weakest rung without trying the stronger ones above it. A competent assessor works down the hierarchy and records, for each hazard, why the stronger controls were not reasonably practicable before settling on the weaker one.
A risk assessment is a decision made before the job, not a form completed after it.
A permit to work is a control in its own right, not a formality sitting on top of the real controls. It exists for jobs where the hazard is serious enough that isolation, atmosphere testing, or a stand-by presence has to be confirmed and signed for by someone independent of the person doing the job, before work starts — enclosed space entry, hot work, work on electrical systems, work aloft, and work over the side are the jobs most SMSs single out by name.
The permit only works as a control if issuing it is at least as inconvenient as skipping it would be tempting. A permit book kept two decks from the work site, or a duty officer too busy to walk over and check before signing, quietly turns the permit into a piece of paper filled in from memory after the job is already under way. That is why an auditor checking a permit-to-work system does not stop at reading the completed forms — they ask where the permit is issued from, who actually goes and looks at the job, and whether the timings on the permit are physically possible given everything else that officer was doing on that watch.
A permit is only a real control if issuing it requires someone to actually go and check the job, not just sign a form.
Port State control is not an event to prepare for the night before arrival — by the time the PSC officer is walking up the gangway, the ship either is or is not in the condition its certificates claim. Four things need to line up, continuously, for that to be true. Certificates need to be valid and need to match the ship as it actually is — a certificate for equipment that has since been changed or removed is as much a problem as an expired one. Records need to be contemporaneous: filled in at the time the event happened, not reconstructed the week before arrival, because a PSC officer who spots one batch-completed log page will start looking harder at all the others. Equipment needs to be tested, working, and carrying the certificates to prove it — a fire pump that runs is not enough if its last service record cannot be produced. And the crew need to be able to demonstrate, not just describe, the drills the records say they have done: mustering promptly, operating the equipment correctly, and explaining their own role without being prompted.
None of this is PSC-specific — it is simply what a functioning SMS looks like day to day. A ship that runs its safety management system properly is, incidentally, always ready for PSC; a ship that only tidies up for PSC is running the audit trail, not the system.
PSC readiness is not a checklist done in port — it is what a functioning SMS looks like on an ordinary day at sea.
The two scenarios below are the kind of judgement call an auditor, a chief officer, or a candidate under oral examination is expected to make on the spot — not a formula to substitute into, but a chain of reasoning from what was found to what has to happen next.
During an internal audit aboard a chemical tanker, you find that the hot-work permit file has no completed permits for two grinding and welding jobs the bosun's crew carried out in the paint store last week, although the jobs themselves were done safely and a fire watch was actually posted. This is the third time in the past 18 months that hot-work permits have gone missing for short jobs done by the deck crew. The chief officer proposes closing the finding by re-briefing the deck crew on permit procedure and recording a toolbox talk. As the auditor, decide whether that closes the finding.
Hot-work permits missing for 2 jobs; the work itself was carried out safely Third occurrence of the same type of finding in 18 months Proposed corrective action: toolbox talk and re-briefing only
Start with what the repetition tells you.
This is not an isolated lapse. A control that has already failed twice before, in the same way, on the same crew, points to something in the process rather than one person's memory on one day.
Find what is one step behind “the crew forgot.” Ask why permits keep going missing for short jobs specifically — where the permit book is kept, how long it takes to get one issued and signed for a five-minute job, and whether the deck crew see the paperwork as protecting them or slowing them down.
Test the proposed action against that cause.
A toolbox talk restates the rule to people who, on this evidence, already know the rule — it does not change the time cost of using the permit system for a short job, so nothing has removed the reason the permit gets skipped.
Decide what would actually change the process.
For example, requiring the chief officer's countersignature before any grinding or welding starts regardless of job length, or relocating permit issue to the deck office where it can be issued in the time it takes to walk there.
AnswerDo not close the non-conformity on re-briefing alone. Keep it open, require the root cause to be investigated and stated — why a known procedure is being bypassed for short jobs — and accept closure only against a corrective action that changes the process, with the toolbox talk kept as a secondary measure, not the whole answer.
The trap: treating a repeated finding as three separate lapses in individual memory, when three identical findings are themselves the evidence that the system, not the people, needs to change.
Two days before a ro-ro passenger vessel arrives at a port operating an active port State control regime, the safety officer's pre-arrival check turns up two findings. First: the enclosed-space entry permit for a contractor's entry into a fuel oil tank last week was never completed, although the duty engineer's log confirms the tank was gas-freed beforehand and an engineer stood by at the tank top throughout the entry. Second: the emergency generator's weekly test log has an entry for every week over the past 6 months, but all the entries are in the same handwriting and appear to have been signed on the same occasion rather than after each individual test. Neither finding has yet been reported to the DPA. Decide how each finding should be graded, and what has to happen before the vessel arrives in 2 days.
Finding 1: enclosed-space permit not completed; the entry itself is confirmed gas-freed and supervised Finding 2: 6 months of weekly generator test-log entries, apparently all signed on one occasion Neither finding yet reported to the DPA Vessel arrives in 2 days
Separate the two findings by what they say about reality.
Not just paperwork. In Finding 1 the record is missing but the underlying control — gas-freeing and a stand-by — is independently confirmed to have happened. In Finding 2 the record exists but its own appearance casts doubt on whether the underlying event, the weekly test, happened at all.
Apply the major non-conformity test to each.
A major NC is one that poses a serious threat to the ship, environment or personnel, or shows the SMS is not being systematically implemented.
Decide what has to happen before arrival rather than after PSC finds it.
The generator has to be run and its test properly logged now, so its true state is known and current, not simply re-signed to fill the gap. The DPA has to be informed of both findings without delay, since reporting non-conformities to the company is itself a requirement of the SMS, not an optional courtesy.
AnswerGrade the enclosed-space finding as a non-conformity — the control was genuinely applied, only the record was not — and correct the permit-completion practice as the corrective action. Grade the generator log finding as a major non-conformity, because the equipment's real readiness cannot currently be evidenced; run and properly log a fresh test immediately, and report both findings to the DPA before the vessel arrives, rather than waiting to see whether PSC finds them first.
The trap: grading every missing form the same way — a form missing because the job was done safely and simply not written up is a different order of problem from a form that may be masking a test that never happened.
SMS audit cycleInternal audits at intervals set by the SMS, not exceeding 12 months; external audits by flag State or ROObservationA fact noted with no evidence of a breach — a watch item, not yet a findingNon-conformity (NC)An observed departure from the SMS or the ISM CodeMajor non-conformitySerious threat to safety, ship or environment, or systematic SMS failure — immediate actionRoot causeAt least one step behind the human action, not the action restatedHierarchy of controlEliminate → substitute → engineer → administrate → PPE, strongest firstPermit-to-work jobsEnclosed space entry, hot work, electrical work, work aloft, work over the sideDPADesignated Person Ashore — direct access to top management, independent reporting linePSC deficiency vs detentionDeficiency: corrected within an agreed time. Detention: ship held, unsafe to sail