At management level the question is never whether you know the rule — it is whether you can show the system that makes the rule hold on a day nobody is watching. This chapter works through how that system is built, tested and defended.
Every SMS on paper describes the same loop: policy, responsibilities and authority, procedures, resources and training, operational controls, reporting of non-conformities and incidents, and management review. Candidates can usually recite that list. What separates a pass at Chief Engineer level is understanding that the loop only works if the last step actually happens — because management review is the step that takes what reporting turns up and changes something before it happens again.
A system that never changes in response to its own reports is not really a system — it is a set of instructions being followed and re-followed while the same faults recur. The review step is what turns reporting into learning.
This matters for how you answer an examiner's question about a finding that keeps coming back. If the same near-miss, the same overdue job or the same shortcut shows up at consecutive audits, the honest management-level answer is not "the crew needs to be told again." It is that the review process failed to catch, or failed to act on, a pattern it should have caught the first time. Saying that — and describing what a working review would have done differently — is what the examiner is listening for.
The Master's overriding authority sits inside this same loop: it exists precisely because a procedure cannot anticipate every situation, and the person on the spot has to be able to depart from it for safety without being second-guessed afterwards. A mature SMS treats a documented departure from procedure, properly justified and reported, as evidence the system is being used with judgement — not as a non-conformity in itself.
A risk assessment is only as good as the weakest control it settles for. The hierarchy runs eliminate, substitute, engineer, administrate, protect — each step is tried, in order, before dropping to the next, because each step down relies on more human behaviour and less on the physical situation simply not being dangerous any more.
Eliminating the hazard removes it from the job entirely — doing a repair at the next dry-dock instead of afloat, for instance. Substitution swaps in a less hazardous way of doing the same job. Engineering controls change the physical situation — guarding, ventilation, interlocks — so the hazard is contained whether or not anyone remembers to be careful. Administrative controls rely on people following a procedure correctly, under time pressure, possibly at the end of a long watch. Personal protective equipment is the last barrier between a person and a hazard that everything above it has failed to stop.
An examiner probing this will often describe a job with PPE as the only stated control and ask what is missing. The expected answer is not "more PPE" — it is naming which higher step was skipped and why it should not have been.
Enclosed space entry is the one procedure on board where getting the sequence slightly wrong can kill someone within minutes, so it is worth understanding why each step exists rather than just listing them. Identify the space and the hazards it could plausibly contain. Isolate it — blank flanges, locked-out pumps, disconnected drives — so nothing can be introduced or started while people are inside. Ventilate mechanically, not by opening a hatch and hoping. Then test.
Gases behave according to their density relative to air, and a tank or void is rarely at a uniform temperature or ventilation rate throughout, so a single reading — even a good one — only describes the point the probe was held. Oxygen is checked against 20.9 %, because both a depleted and an enriched atmosphere are dangerous. Flammable gas is checked against the lower explosive limit, and toxics — commonly H₂S and CO — against their own exposure limits, because a space can be perfectly breathable and still be acutely toxic.
Every element of the sequence is there because the alternative failure mode has actually killed people at sea. Rescue arrangements missing is the single omission examiners weight most heavily, because it is the one that turns a bad atmosphere into a multiple fatality when an untrained colleague goes in after a collapsed entrant.
An investigation that stops at "human error" has described what happened, not why it was possible. Every human error happens inside a system — a procedure, a piece of equipment, a level of fatigue, a training gap, a time pressure — and it is that system that a proper investigation has to reach.
A useful discipline is to keep asking why, past the first answer, until the answer stops being about the person in front of you and starts being about the conditions they were working under. An engineer opened the wrong valve — why was it identifiable only by memory rather than a label; why was he doing that job alone; why was the job scheduled at the end of a long watch. Each "why" that lands on a system feature, not a person, is a candidate root cause.
Distinguish the proximate cause — the last thing that happened before the incident — from the root cause underneath it. Corrective action aimed at the proximate cause treats the symptom; corrective action aimed at the root cause is what actually stops the incident type from recurring.
This is also the test an examiner applies to a proposed corrective action: does it change the system, or does it just instruct the individual involved to be more careful next time? "Re-briefed" or "verbally counselled" as the entire corrective action is a signal the investigation did not go far enough. A non-conformity — and particularly a major one, where there has been a serious threat to safety, the environment or the ship — is only properly closed when the action taken addresses the cause the investigation actually found.
Each MARPOL annex pairs an operational limit with a record book, and the record book is what an inspector actually checks, because equipment running correctly in the moment cannot be verified after the fact — only the record of it can. Annex I sets the oil content limit for machinery space bilge discharge and requires the automatic stopping device and the Oil Record Book entries to match the sounding and tank movements. Annex IV covers sewage, Annex V garbage — with its own discharge and retention rules by category — and Annex VI covers fuel sulphur content and the engine's emission compliance.
The sulphur limits work the same way: a global limit and a tighter limit inside an Emission Control Area, met either by compliant fuel or an approved equivalent arrangement such as an exhaust gas cleaning system, with every changeover between fuels logged — position, time, tanks in use — because that log is the only proof a changeover happened when it should have.
Compliance that exists only in the equipment's behaviour and not in the record is, from a port State control officer's point of view, indistinguishable from non-compliance — they were not there to watch it happen, so the record is the only evidence they have.
This is also why silencing or resetting a pollution-prevention alarm without logging the event as one is a serious matter on its own, separate from whatever caused the alarm: it breaks the record chain that the whole system depends on to be checkable.
A drill is only doing its job if it tests something that might actually go wrong, not just confirms that everyone knows where the muster list is posted. Varying the scenario — a different casualty, a different weather assumption, a genuinely simulated failure of the first-choice equipment — is what turns a drill from a formality into a rehearsal that changes what people would actually do.
When an inspection — internal audit, flag State, or port State control — finds a deficiency, the response that protects the ship and the certificate is the same in every case: acknowledge the finding, do not argue it on the spot or attempt to explain it away, and move straight to what corrective action is proposed and by when. A finding handled this way, with a credible plan attached, is usually the difference between a non-conformity that gets closed on schedule and one that escalates.
An inspector is assessing the system's response to being found wanting as much as the deficiency itself — a ship that produces a clear corrective action plan on the spot is demonstrating exactly the review-and-improve loop the SMS is supposed to run.
Detention-worthy findings are, almost without exception, ones where the evidence trail itself is missing or contradicts what is on board — a record not kept, a drill not held, an alarm event not logged — because that absence is what tells the inspector the system cannot be trusted to have caught the next one either.
Both scenarios below are written as an examiner would run them — a situation, then a question that expects a decision and the reasoning behind it, not a single fact recalled from a list.
You are the duty engineer on a chemical tanker. A cargo tank has been gas-freed, inerted, purged and gas-freed again for an internal structural inspection. Before entry, the tank is tested at top, middle and bottom: O 20.9 %, HC 0 % LEL, H₂S 0 ppm, CO 0 ppm. A permit is issued, an attendant is posted at the tank opening, and two ratings enter with hand tools to chip loose scale. After 40 minutes the work is paused so a floodlight can be rigged; the attendant leaves the opening to help carry the light down the deck. Fifteen minutes later work resumes without a further gas test and without the attendant back at the opening. As the engineer in charge of the entry, what is wrong, and what do you do now?
Permit issued on an initial test of O 20.9%, HC 0% LEL, H₂S 0 ppm, CO 0 ppm (top, middle, bottom) Work stopped for 15 minutes to rig lighting Attendant left the entrance during the stoppage Work resumed with no re-test and no attendant present
A permit is a time-limited authorisation to be inside the space under a specific.
Tested atmosphere — it is not a standing clearance for the shift. Any interruption to the entry, whatever the reason, ends that authorisation.
Chipping scale disturbs surfaces that may be holding rust.
Old residue or coating breakdown products, any of which can release gas as work continues. An atmosphere that was clean at the first test is not guaranteed to still be clean forty minutes later — the test result describes a moment, not the shift.
The attendant's job is continuous: watch the entrants.
Keep communication open, and be the one link to rescue if something goes wrong inside. Leaving the post — even for fifteen minutes, even to help the job along — removes that link for exactly the period nobody can see what is happening inside.
Two failures have therefore stacked on top of each other.
The space was re-entered without re-testing after an interruption, and it was re-entered without an attendant at all. Either one alone is a serious deviation from the permit; together, if anything had gone wrong, there would have been no test confirming a safe atmosphere and no one outside to respond.
AnswerStop work and get the entrants out immediately. Post a new attendant, re-test the space at top, middle and bottom before anyone goes back in, and treat the resumed entry as a fresh entry on a fresh permit. Record the interruption, the reason work stopped, the re-test results and the time re-entry was authorised.
The trap: treating the pre-entry gas test as a one-off clearance for the job rather than the start of an ongoing duty to monitor — an enclosed space can change state while people are still inside it, and every break in the entry is a reason to test again, not a reason to hurry back in.
You are the Chief Engineer reviewing the engine log ahead of the annual ISM internal audit. Over the last two months the 15 ppm oil content alarm on the oily water separator has tripped and been reset three times, on three different watches, by three different engineers. Each log entry simply reads "OWS alarm — reset, discharge stopped, resumed normal." None of the three events was written up as a non-conformity or investigated beyond the reset. The Oil Record Book shows the discharges themselves were logged, but not the alarm events. You check the planned maintenance system: the coalescer element has a 6-month service interval and was last changed 14 months ago. How do you handle this ahead of the audit?
Three 15 ppm OWS alarms in 2 months, three different watchkeeping engineers Each event logged only as "reset, discharge stopped, resumed normal" No non-conformity raised, no investigation beyond the reset Coalescer service interval: 6 months; last actually serviced: 14 months ago Oil Record Book shows discharges but not the alarm events themselves
How do you handle this ahead of the audit?
Three different engineers hitting the same alarm the same way over two months is a pattern, not a lapse by one watchkeeper.
When the same finding shows up under different people, the common factor is the system they are all working in, not any one of them.
The planned maintenance record gives a concrete lead.
The coalescer element is more than twice its service interval overdue. A fouled coalescer is a well-known cause of nuisance and genuine oil-content excursions alike, so the overdue service is a strong candidate for the actual root cause rather than the watchkeepers' judgement.
The second gap is procedural.
Nobody was told that an OWS alarm has to be written up and investigated in its own right, separately from the discharge stopping correctly. Three engineers all did the same incomplete thing because there was no instruction telling them to do more than reset it.
Closing this at "engineer reminded to log alarms properly" would leave both the overdue maintenance and the missing procedure untouched, so the same alarm would very likely trip again next month under a fourth engineer.
The corrective action has to reach the two things that actually allowed the pattern: the maintenance schedule and the response procedure.
AnswerRaise it as a non-conformity — arguably major, since equipment integrity for overboard discharge was compromised for over a year — and open corrective actions against the root cause: service the coalescer and correct the PMS interval compliance, issue a written procedure requiring every OWS alarm to be logged as an event and investigated, and brief all watchkeeping engineers on it before the audit. Verify effectiveness at the next scheduled check rather than closing the file on the briefing alone.
The trap: writing the corrective action as a reminder to the individual engineers on watch — that treats an overdue maintenance job and a missing procedure as a training problem, and a training memo does not service a coalescer.
Enclosed space: O₂ 20.9%HC < 1% LEL; H₂S < 5 ppm; CO < 30 ppm — test top, middle, bottom, before entry and after every interruptionHierarchy of controlEliminate → substitute → engineer → administrate → PPE — PPE is the last resort, not the planPermit to workTime-limited, named attendant at the entrance, working communication, rescue equipment laid out and mannedBilge/OWS discharge ≤ 15 ppmEn route, equipment running, automatic stopping device fitted and testedSulphur in fuel: 0.50% global / 0.10% ECAOr approved equivalent arrangement — log every fuel changeover with position, time, tanksDrill intervalsFire & abandon-ship monthly; enclosed-space entry & rescue at the SMS-set intervalNon-conformity vs major NCMajor = serious threat to safety, environment or ship — requires immediate corrective actionRoot cause vs proximate causeProximate is what happened; root is why the system allowed it — corrective action targets the rootORB / GRB / BWRBContemporaneous, signed, retained — the paper record is the primary evidence an inspector checksSMS management reviewA recurring finding at the same point is a review failure, not a repeated crew failure