Internal SMS Audit
How to plan and conduct the internal audit the ISM Code requires before every external audit — and how to make it a useful tool, not just a formality.
Operational Explanation
The internal audit is the periodic verification, carried out by qualified personnel independent of the area being audited, of the compliance and effectiveness of the Safety Management System. It is the mechanism by which the Company self-assesses before the certification body does, and it is an explicit requirement of the ISM Code.
A well-conducted internal audit identifies NCs before the external auditor does, allowing them to be addressed calmly; a "box-ticking" internal audit leaves it to certification audits or PSC inspections to uncover the same deficiencies, with more serious consequences.
Regulatory Reference
ISM Code, par. 12 (Company Verification, Review and Evaluation): the Company must conduct periodic internal audits to verify SMS compliance, with auditors independent of the area under audit, except where the Company's small size makes this impracticable.
Scope of Application
Applies both to the Company's shore offices and to every ship in the fleet, at intervals not exceeding 12 months (common practice, unless a different approved internal procedure applies).
Procedure / How to Complete It
- Plan the annual internal audit programme, covering every area of the SMS and every ship in the fleet.
- Assign auditors who are qualified and independent of the area/ship being audited.
- Conduct the audit by checking documents, records (ORB, GRB, NC, Near Miss) and crew interviews.
- Record the NCs identified, classifying them and assigning a CAPA with an owner and a deadline.
- Report the audit results to the DPA and, in aggregated form, to the Management Review.
- Verify at the next audit that the CAPAs from the previous one have been effectively closed.
Practical Example
Example report: "Internal SMS audit, vessel XYZ, 14.04.2026 — 2 minor NCs (winch maintenance checklist, incinerator ash record), 0 major NCs. CAPAs assigned with a 30-day deadline. Next internal audit scheduled within 12 months."
Real Cases
Common Mistakes Mistake Library
| Mistake | Consequence | How to avoid it |
|---|---|---|
| An auditor verifying their own area of responsibility | Loss of independence, NC in external audit | Always assign auditors external to the area/ship to be verified |
| Internal audit limited to checking the presence of documents, without crew interviews | Systemic NCs (e.g. weak safety culture) do not emerge | Always include direct interviews and field observation, not just document review |
| Internal audit programme does not cover all fleet vessels within the required interval | NC in external certification audit | Track the annual programme with deadlines for each vessel and verify compliance |
PSC Observations
Operational Tips
- Schedule internal audits spread across the year, not concentrated just before the external audit.
- Train internal auditors in interview techniques and root cause analysis, not just document checklists.
- Use the aggregated results of internal audits as a primary input for the Management Review.
Checklist
- Annual internal audit programme covers all vessels and shore offices
- Auditors independent of the area/vessel verified
- Document review plus crew interviews included
- NCs identified, classified and assigned a CAPA
- Closure of the previous audit's CAPAs verified