ISM Audits process

Definitions and abbreviations

Definitions

The following definitions apply to this procedure:

ADMINISTRATION: Government of the State whose Flag the ship is entitled to fly.

ANNIVERSARY DATE: Day and month of each year that corresponds to the date of expiry of the relevant document or certificate.

AUDIT: A process of systematic and independent verification, through the collection of objective evidence, to determine whether the safety management system complies with the requirements of the ISM Code and whether the safety management system is implemented effectively to achieve the Code's objectives.

• Initial Audit: The first complete audit of the safety management system of a company or a ship to establish whether the documented management system complies with the ISM Code and the system has been effectively implemented. All requirements of the Code are covered during this audit.

• Intermediate Audit: An audit of the ship to ensure the continuous effective implementation of the safety management system and to assess modifications carried out since the previous audit on board the ship. This audit also includes a review of any corrective actions implemented by the company arising from nonconformities issued at a previous audit. If only one (1) intermediate audit is to be carried out and the period of validity of the safety management certificate is five (5) years, it should take place between the second and third anniversary dates of the safety management system. All requirements of the Code are covered during this audit.

• Periodical Audit: An annual audit of the company to ensure the continuous effective implementation of the safety management system and to assess modifications carried out since the previous company audit. This audit also includes a review of any corrective actions implemented by the company arising from nonconformities, issued at a previous audit. Periodical audits must take place within three (3) months before or after the anniversary date of document of compliance. All requirements of the Code are covered during this audit.

• Renewal Audit: A complete audit of a safety management system which leads to issue of a new document of compliance or safety management certificate. All requirements of the Code are covered during this audit.

• Interim Audit: An audit of a company or ship to facilitate initial implementation of the ISM Code.

• Additional Audit: An audit other than the mandatory certification audits defined above requested by a company, Flag State, and Port State, recommended by an Auditor or required under these procedures.

AUDITOR: A person who is trained, qualified and authorised in accordance with IACS Procedural Requirement 10 (PR10) and the surveyor qualification procedure to carry out ISM audits and to conclude whether compliance has been achieved.

AUDIT UNIT (AU): A Recognised Organisation (RO) office responsible for performing an ISM audit.

BRANCH OFFICE: An office that is part of the company is under the company's control and is subject to the same safety management system.

COMPANY: The owner of the ship or any other organisation or person such as the manager, or the bareboat charterer, who has assumed the responsibility for operation of the ship from the shipowner and who, on assuming such responsibility, has agreed to take over all the duties and responsibilities imposed by the ISM Code.

CONVENTION: The International Convention for the Safety of Life at Sea, 1974 as amended.

CORRECTION: An immediate action taken to eliminate the cause of a nonconformity.

CORRECTIVE ACTION: A process that involves investigation of a nonconformity to identify the root cause and implement actions to prevent recurrence.

DOCUMENT OF COMPLIANCE (DOC): Document issued to a company that complies with the requirements of the ISM Code.

INTERIM DOC: A document issued, to a newly established company or when new ship types are to be added to an existing DOC, to facilitate initial implementation of the ISM Code.

INTERIM SAFETY MANAGEMENT CERTIFICATE: A document issued to new ships on delivery, when a company takes the responsibility for the operation of a ship new to that company or when a ship changes Flag, to facilitate initial implementation of the ISM Code.

INTERNATIONAL SAFETY MANAGEMENT (ISM) CODE: The International Management Code for the Safe Operation of ships and for Pollution Prevention as adopted by the Assembly, as may be amended by the International Maritime Organisation.

CREW AND SYSTEMS UNIT (CS UNIT): Recognised Organisation (RO) office where CS Unit Contact is located or as defined by HO.

LEAD AUDITOR: An Auditor who is responsible for leading a team of Auditors.

MAJOR NONCONFORMITY: An identifiable deviation that poses a serious threat to the safety of personnel or the ship or a serious risk to the environment, that requires immediate corrective action and includes the lack of effective and systematic implementation of a requirement of the ISM Code.

UNRESOLVED MAJOR NONCONFORMITY: A major nonconformity which has not been downgraded to a nonconformity before the end of the audit.

UPGRADED NONCONFORMITY: A nonconformity raised by the society during a previous audit, which has not been adequately addressed and cannot be closed.

NONCONFORMITY: An observed situation where objective evidence indicates the non-fulfilment of a specified requirement.

OBJECTIVE EVIDENCE: Quantitative or qualitative information, records or statements of fact pertaining to the existence and implementation of a management system element, which is based on observation, measurement or test, and which can be verified.

OBSERVATION: A statement of fact made during a safety management audit and substantiated by objective evidence. It may also be a statement made by the Auditor referring to a potential weakness in the management system which, if not corrected, may lead to a nonconformity in the future.

PREVENTIVE ACTION: An action to eliminate the cause of a potential nonconformity or other undesirable potential situation before it occurs.

SAFETY MANAGEMENT AUDIT: A systematic and independent examination to determine whether the management system activities and related results comply with planned arrangements and whether these arrangements are effectively implemented and are suitable to achieve objectives.

SAFETY MANAGEMENT CERTIFICATE (SMC): A document issued to a ship which signifies that the company and its shipboard management operate in accordance with the approved safety management system.

SAFETY MANAGEMENT MANUAL: The documentation used to describe and implement the safety management system.

SAFETY MANAGEMENT SYSTEM (SMS): A structured and documented system enabling company personnel to effectively implement the company safety and environmental protection policy.

SUBSTANTIAL MODIFICATIONS: A modification of the documented safety management system established by the company, for example:

• Newly identified ship types

• Organisational changes influencing the effectiveness of the safety management system

TECHNICAL DEFICIENCY: A defect or failure in the operation, a part of the ship's structure, machinery, equipment or fittings.

VOLUNTARY CERTIFICATION: ISM Code certification issued at the request of the company and not on behalf of the Flag Administration for cases such as:

• The Flag Administration has not recognised Recognised Organisation (RO) and an RO

• The Flag Administration does not require mandatory application of the ISM Code

• ISM Code certification is not applicable for the vessel

Abbreviations

AU - Audit Unit

CA - Corrective Action

CLIA - Cruise Lines International Association

CSQM - Crew and Systems Quality Manager

CSR - Continuous Synopsis Record

CS Unit - Crew and Systems Unit

DCSQM - Delegate Crew and Systems Quality Manager

DOC - Document of Compliance

DPA - Designated Person Ashore

FM - Fleet Management

Form K - ISM Code nonconformity report from the audit report

FM_REG - FM Registration Department

MNC - Major nonconformity

MO - Operational Management Department

MOC - Marine Operations Centre

MOU - PSC Memorandum of Understanding

NC - Nonconformity

NMM - Neptune Marine Management database

NPSS - Neptune Provisional Survey Statement

PSC - Port State Control

QSCS - IACS Quality System Certification Scheme

RO - Recognised Organisation

SMC - Safety Management Certificate

SMS - Safety Management System

STCW - Standards of Training Certification and Watchkeeping for Seafarers

TMSC - Transfer of Management System Certification

Responsibilities

General

In addition to the responsibilities defined in the related procedure, the following responsibilities related to ISM activities apply.

Company Responsibilities

The verification of compliance with the requirements of the ISM Code does not relieve the company, management, officers or seafarers, of their obligations as to the compliance with national and international regulations related to safety and protection of the environment.

The company is responsible for:

1. Informing relevant employees about the objectives and scope of the audit

2. Appointing responsible members of staff to accompany the Auditor(s)

3. Providing the resources needed by the Auditor(s) to ensure an effective and efficient audit

4. Providing access and objective evidence as requested by the Auditor(s)

5. Co-operating with the Auditor(s) to ensure that the audit objectives are achieved

6. Informing Recognised Organisation (RO) about significant changes to the safety management system which may require an additional audit, such as substantial modification of the management system, establishment of branch offices, or changes in the operations that introduce new hazards

7. Requesting additional audits, when required

8. Maintaining the conditions for ISM certification

9. Submission of root cause analysis and proposed corrective actions for any nonconformities raised during ISM audits to the attending Auditor. This can be directly at the time of the audit, or through the Move website within fifteen (15) days of the completion of the audit.

10. Submission of information relating to the actual completion of corrective actions through the Move website for approval of the Auditor within ninety (90) days of audit completion

Auditor/Audit Team

The persons participating in the audit are responsible for complying with the requirements regulating the audit.All documents checked and information obtained during the audit shall be treated as confidential.When an audit is performed by more than one Auditor a Lead Auditor shall be assigned by the System Operations Manager.

The responsibilities of a Lead Auditor (in case of a team of Auditors) or the Auditor include:

Preparation of the Audit

• Planning and carrying out assigned responsibilities effectively and efficiently

• Organising specialised technical assistance required to fulfil the competence requirements for the audit when required

Performing the Audit

• Complying with the applicable requirements and other appropriate directives

• Reporting any major obstacles encountered in performing the audit

• Clearly communicating major nonconformities, nonconformities and observations to the company or shipboard management immediately

Reporting the Audit results

• Reporting the audit results clearly, conclusively and without undue delay

• Sending the audit report to the CSQM/DCSQM for validation to make it available to the company and Flag Administration through the Move website

• Issuing certificates according to the level of authorisation

• In case of a technical deficiency report as per paragraph Emergency Response Drills and Exercises

Invalidation of SMC and/or DOC

• Initiating the process of invalidation of ISM certification (as per Invalidation of the ISM certification and withdraw of ISM certificate) (should the company fail to undertake its responsibilities for dealing with corrective actions)

Follow-up of the Audit

• Verifying the effectiveness of corrective actions taken by the company

Crew and Systems Quality Manager (CSQM)/Delegate Crew and Systems Quality Manager (DCSQM) (as per the surveyor qualification procedure Paragraph 2.1)

The responsibilities of CSQM/DCSQM include:

• Reviewing audit reports and issued certificates for System Logbook(s)/System Certificates Editor(s) they are responsible for, in accordance with FM objectives (see CSQM job validation guidance in attached files)

• Instructing the Auditors they are responsible for, and assisting them to manage with the company any matters which may arise

• Planning and ensuring quality monitoring of the Auditors they are responsible for, in accordance with the monitoring of quality of services procedure and the related procedure

CS Unit

The responsibilities of the CS Unit include:

• Reviewing and requesting MO approval for all new ISM contracts

• Signing contracts with companies for delivery of ISM services (as per ism certification services contracting)

• Ensuring the follow-up of vessel ISM certification

• Requesting pre-authorisation and/or informing the Flag Administration (with copy to MOC) about audit schedules, when required (in accordance with Flag-specific the related survey procedure)

• Submitting audit reports (when required) and certificates related to audits to the company under the CS Unit responsibility

• Supporting the company in case of any difficulties in registering the information about corrective action (CA) proposal and CA performed through the Move website, (as per Dealing with major nonconformities, nonconformities and observations)

• Discussing with MOC/MO and issuing instructions related to additional audits after a vessel detention (as per paragraph Port State Control Detention and Banned Ships)

• Reviewing and discussing with Auditors and the company any request for invalidation of ISM certification and, once agreed, sending the Form Z to MOC and MO

• When conditions for invalidation of the ISM certification are met discussing the matter with the company and, if not resolved, initiating the process of invalidation of ISM certification (as per Invalidation of the ISM certification and withdraw of ISM certificate)

• Invoicing the audit

The CS Unit shall monitor the registration of company actions related to corrective action proposals and performed corrective actions, (the monthly list sent to CSQM by HO is to be used to retrieve this information) for nonconformities raised during audits of companies and vessels under their responsibility. The CS Unit shall contact the company and inform them about overdue actions or actions which will soon become overdue.

The CS Unit shall remind the company about periodical or additional audits (especially additional audits requested during regular ship/company audits) which will soon become overdue and certificates which will soon expire (the monthly list sent to CSQM by HO is to be used to retrieve this information). Information about this activity shall be registered in the respective ship or company file.The responsibility of control and follow-up of nonconformities and audits is the responsibility of the company, and this task shall be considered as a special service to support the client.

Systems Operations Manager

The Systems Operations Manager is responsible for assigning a qualified Auditor(s) to conduct company and shipboard audits following the request by the company.

Marine Operations Centre (MOC)

The responsibilities of MOC include:

• Reviewing and monitoring the audit reports (as per the related procedure)

• Issuing definitive certificates when required

• Managing the process of Transfer of Management System Certification (TMSC) (as per the related procedure), and other cases when required

• Assisting Audit Units under their responsibility in understanding the Code, Recognised Organisation (RO) procedures and instructions

• Liaising with MO and Flag Administrations for operational matters

• When requested submitting to the Flag Administration, after random verification, the audit reports and certificates

• Updating the ship and company data on basis of the information from the reports

• Managing the process of DOC/SMC withdrawal (as per Invalidation of the ISM certification and withdraw of ISM certificate)

Operational Management Department (MO)

The responsibilities of MO include:

• Authorising all new ISM contracts

• Issuing instructions for additional audits, further to detentions (as per paragraph Port State Control Detention and Banned Ships)

• Managing the information of possible ISM failures (IACS PR 17) detected by Surveyors during Class/Statutory surveys (as per the related survey procedure)

• Managing the process of quality monitoring, internal audits of MOC’s and AU’s, VSA’s and VCA’s, when needed (as per the related procedure)

• Managing the process of monitoring and re-authorisation of Auditors (through QUALIF database)

• Monitoring the process and instructing MOC in case of TMSC (change of RO) proposals and managing TMSC operational processes (as per the related procedure)

• Monitoring the process and instructing MOC in case of DOC/SMC withdrawal (as per Invalidation of the ISM certification and withdraw of ISM certificate)

Management Systems (ISM/ISPS/MLC) Department (FM_SAT)

Responsibilities are defined in the related procedure, Section 4.

ism certification services contracting

General

All ISM certification services must be contracted before being delivered.

Contracting Process

Request for Services

Each Audit Unit (AU) receiving a request for ISM audit services shall contact the CS Unit Contact to verify whether an ISM contract exists for that company or ship.

When the AU receives the request directly from the CS Unit of the ship, it is considered that this check has already been done.

Requests for MO Approval

Approval from the relevant MOC and MO must be received before any new ISM service is contracted (including the cases where the TMSC does not apply).

Before requesting the MO to approve a new contract for a ship for which Recognised Organisation (RO) does not provide any service, the CS Unit Contact shall request the MOC to register the ship in the Neptune database and assign a Register Number.

The ISM/ISPS/MLC Evaluation Grid form (see paragraph Attached Files Attached Files) shall be used for this purpose.

When drafting the ISM/ISPS/MLC Evaluation Grid the CS Unit Contact shall consider:

1. Company branch office requirements, if any, as per HOW TO DETERMINE COMPANY BRANCH OFFICES TO BE AUDITED

2. Fleet characteristics

3. Ship/company history

4. Requirements for change of RO (TMSC) as per the related survey procedure

5. Any further information that could help the MO’s decision

The MOC shall analyse the request, comment through ISM/ISPS/MLC Evaluation Grid if needed and send it to the MO for final approval.

The MO’s, to take a final decision, may request an "overall visit" on board the ship, with exception for new constructions and vessels classed by Recognised Organisation (RO), to ascertain the condition of the vessel.

This “overall visit” shall be factually reported, together with photos, if necessary, by e-mail to the correspondent MOC and MO.

Rejected Requests

Where the request for ISM services is rejected by the MO, the CS Unit shall inform the company in writing, and a record of this communication shall be in the respective ship/company file.

These steps must be strictly followed before setting any contract for the requested ISM services (company or ship certification).

Approved Requests

Following the MO’s approval and before any service has been delivered the CS Unit shall prepare a set of Certification Conditions for ship or company (through System Certificate Editor) which contain the latest revision of Marine & Offshore General Conditions as integral part of the document.

The Certification Conditions shall be signed by the company representative on the last page. The first page of the Certification Conditions and all pages of the Marine & Offshore General Conditions shall have the initials of the company's representative.

The signed Certification Conditions shall be sent to HO to be filed by FM_REG, and a signed copy is to be kept in the respective ship or company file.

For ships where the ISM company is not the same as the ISPS company or MLC Shipowner individual Certification Conditions are to be issued to each company or shipowner. The form allows the selection of the applicable standards.

Annex to Contract for Proposed Services

The CS Unit shall also prepare an Annex to Certification Conditions describing the proposed services agreed with the client by using the ISM/ISPS/MLC Form I (see paragraph Attached Files Attached Files), which shall be signed by the company.

The CS Unit may adapt the ISM/ISPS/MLC Form I in accordance with local specific issues related to fees (i.e. local currency instead of points) or in its general format to comply with specific situations, but additional clauses can only be inserted with head office agreement.

In accordance with Marine & Offshore General Conditions, attention is to be drawn on the obligation to inform Recognised Organisation (RO), without delay, of any changes which may imply invalidation of the certification (as example when the company stops its activity, when the company no longer manages a type of vessel listed on the DOC, when a ship is sold, scrapped or the company is no longer responsible for the ship, etc.).

Contract Review

The contract review for ISM services shall be based on:

• The CS Unit Contact analysis of the request for certification for a company/ship (where relevant particulars shall be taken into consider ation)

• MO approval

• The confirmation that the Certification Conditions together with Marine & Offshore Division General Conditions is duly signed

Retention of Contracts

The original signed contracts shall be kept in files of the CS Unit without limitation of duration unless HO decides otherwise.

Contract Follow-up, Renewal and Cancellation

Termination further to Inadequate Performance

When the company's fleet is often detained by the PSC or when the company systematically does not take appropriate measures for dealing with outstanding nonconformities, the Society, with the involvement of the MO’s and, if required, Flag Authorities reserves the right to terminate the ISM contract (in accordance with Marine & Offshore General Conditions).

Termination further to Non-payment of Fees

Non-payment of fees may also result in suspension or termination of the contract (in accordance with Marine & Offshore General Conditions).

Use of the Recognised Organisation (RO) Logo

Control of Logo Use

Clients' may request to use the Recognised Organisation (RO) ISM Logo which shall be sent by the client's local CS Unit Contact together with the instructions for use of the logo (see paragraph Attached Files Attached Files).

It is the responsibility of each CS Unit Contact to control the use of logo, record and identify each company using the logo and ensure that the authorisation will cease as soon as the certification of the company has been terminated for any reason. Records of this shall be retained locally.

Use of the Recognised Organisation (RO) Logo and adherence to the instructions for use shall be verified by the CS Unit during client visits and during audits.

ISM COMPANY AND SHIPBOARD AUDITS OVERVIEW

General Principles

Sampling Methodology

All audits are based on sampling of records, data and information. During the audit the Auditor shall select and evaluate the representative samples of information (through interviews, review of documents and records, visual examination etc.) which will enable the Auditor to conclude if the management system is effectively implemented and complies with requirements of the ISM Code.As the Auditor does not evaluate all available information (only the representative sample), where no nonconformities were identified, this does not mean that nonconformities do not exist, they just have not been identified in the representative information sampled during the audit.During the opening and closing meeting the Auditor shall emphasise the sampling methodology used for the audit.

Audit Principles and Scope

All periodical audits (SMC initial, intermediate, and DOC initial, annual and renewal) shall be full scope audits covering all elements of the ISM Code and all aspects of the management of shipboard safety and pollution prevention and shall be carried out according to the principles specified, for initial audit, including the evaluation of effectiveness of the SMS in meeting the requirements of the ISM Code.

Company and Shipboard Audits

Company Audits

Company IMO Number

The Auditor shall ensure that the company has an IMO Company Identification Number assigned according to SOLAS regulation Chapter XI-2-1/3-1 "Company and Registered Owner Identification Number".If the company had not been assigned with an IMO number, the Auditor may instruct the company representative to request directly to IHS Maritime.

Company database access

CS Units, MOC’s, MO’s, Auditors and HO have access to the company database and have a possibility to enter the data but since CS Units have direct contact with their local clients, they are considered the most appropriate to keep company database updated.

Ships sampling

Before starting any full-scope company audit and to define the sample of ship records to be verified during the audit, the Auditor shall review:

• The list of ships managed by the company covered by each DOC (including ship name, IMO Number, ship type, GT, etc.)

• Detention history, including PSC inspection and detention reports of the ships and any sanctioned or banned vessels

The list of ships shall be attached to the audit report. For changes in ship types, the Auditor shall refer to paragraph Company Certification Scenarios and company certification scenarios.

Multiple Branch Office Companies

Multiple branch office audits shall be coordinated by the System Operation Manager of the company main office CS Unit. The DOC shall be issued or endorsed by the System Operation Manager of company main office CS Unit after all required branch office audits were carried out accordingly (as per HOW TO DETERMINE COMPANY BRANCH OFFICES TO BE AUDITED).

Company Interim Audits

Audit Preparation

Interim audits in the company may be required in following situations (ISM Code Chapter 14.1):

• The company is newly established

• New ship types are added to an existing DOC

For other possible situations refer to paragraph Company Certification Scenarios and company certification scenarios of this procedure.

Document ReviewA formal document review is required and must have been completed before proceeding with any interim audit, to verify that the SMS and any relevant documentation comply with the requirements of the ISM Code.Performing the AuditThe objective of the interim audit is to verify that company has developed SMS that meet the requirements of the ISM Code and demonstrates plans for SMS implementation throughout the organisation and its fleet within the period of validity of the interim DOC.Document RegularisationFurther to a satisfactory audit, an interim DOC valid for a maximum of twelve (12) months from the audit completion date is issued by the Auditor unless a specific requirement from the Flag Administration has been received or is stated in the Flag-specific the related survey procedure.ReportingThe reason for performing an interim audit shall be specified in the audit report.Audit Follow-upThe Auditor may recommend additional audits to verify that the progress of implementation is in line with the plan set up by the company.

Company Initial Audits

Performing the Audit

The initial audit shall verify:

• The effective functioning of the SMS, including objective evidence that the company's SMS has been in operation for at least three (3) months on board at least one (1) ship of each type operated by them

• Objective evidence (records) from the internal audits performed by the company ashore and on board at least one (1) ship of each type to which the DOC applies

• The Class and Statutory records for at least one (1) ship of each type to which each DOC applies (check that the Statutory and Classification certificates are valid and that no surveys/conditions of class are overdue)

• An updated list of ships managed by the company covered by each DOC, including the ship name, Flag, IMO number, ship type, GT, etc. (copy to be attached to the audit report)

Document RegularisationFurther to a satisfactory audit, a short-term DOC valid maximum five (5) months from the audit completion date is issued by the Auditor unless a specific requirement from the Administration has been received or is stated in the Flag-specific the related survey procedure. The definitive DOC valid maximum five (5) years from the audit completion date will be issued by MOC or the Flag Administration in accordance with Recognised Organisation (RO) authorisation (as per Regularisation of certificates after the Audit).

Company Periodical (Annual) Audits

Audit PreparationPeriodical (annual) audits must take place within the window three (3) months before to three (3) months after the anniversary date of the DOC.

Performing the Audit

The periodical audit shall verify that:

• The SMS is effectively implemented and maintained

• Any modifications made to the SMS comply with the requirements of the ISM Code

• Where nonconformities have been issued during the previous audit, that the root cause has been identified, and appropriate corrective actions have been implemented

• The Class and Statutory records for at least one (1) ship of each type to which each DOC applies (check that the Statutory and Classification certificates are valid and that no surveys/condition(s) of class are overdue)

• Where defects or findings have been raised during Port State and Flag State inspections, that the root cause has been identified, and appropriate corrective actions have been implemented

• An updated list of ships managed by the company covered by each DOC, including the ship name, Flag, IMO number, ship type, GT, etc. (copy to be attached to the audit report)

Annual audits of the company shall include a review of nonconformities reported in relation to previously conducted company and ship audits, both internal and external. The Auditor shall select a sample of the reported nonconformities and verify the company´s investigation, analysis and resolution of the nonconformities in accordance with the requirements of Chapters 9 and 12 of the ISM Code.

Document RegularisationFurther to a satisfactory audit, the applicable DOC(s) shall be endorsed unless a specific requirement from the Administration has been received or is stated in the Flag-specific the related survey procedure.

Company Renewal Audits

Audit PreparationA DOC renewal audit shall be carried out within three (3) months of the expiry date of the DOC and shall be completed before the expiry date.Performing the AuditThe renewal audit shall be carried out according to the same principles given for the initial verification.Renewal audits of the company may include a review of nonconformities reported in relation to previously conducted company and ship audits. The Auditor may select a sample of the reported nonconformities and verify the company´s investigation, analysis and resolution of the nonconformities in accordance with the requirements of Chapters 9 and 12 of the ISM Code.

Document RegularisationFurther to a satisfactory audit, a definitive DOC valid for a maximum of five (5) years is issued by the Auditor, unless Recognised Organisation (RO) is not authorised by the Flag Administration (as per Flag-specific the related survey procedure) in which case, the Auditor should issue a short-term DOC valid for a maximum of five (5) months. Refer to paragraphs Untitled and Untitled for specific consideration related to certificate validity date.

Shipboard Audits

General

Any shipboard audit shall be performed only with the ship fully manned in accordance with its Safe Manning Document. To ensure that the manning level on board is correct, the Auditor shall verify the requirement of the minimum Safe Manning Document, crew list and crew certificates.Shipboard audits, except for interim, shall only be performed under normal operating conditions, (e.g. when the ship is not in dry-dock or laid-up).

Ship Interim Audits

Audit Preparation

Interim shipboard audits may be required in following situations (ISM Code Chapter 14.2):

• New ship on delivery

• Ship new to the company

• Change of Flag (additional audit may be performed as per paragraph Ship Certification Scenarios and vessel certification scenarios in absence of any instructions to the contrary from the Flag Administration)

For other situations requiring interim audit, refer to paragraph Ship Certification Scenarios and vessel certification scenarios of this procedure. Interim audits may be conducted in circumstances other than normal operating conditions, provided that the ship is fully manned in accordance with its Safe Manning Document.The duration for the interim audit could vary according to several elements/criteria which shall be taken into consideration (e.g. type of ship (passenger vessels), number of crew (muster list to be checked), ship status (re-activation), etc.).

Performing the Audit

It shall be verified on board that:�

• The DOC or interim DOC, is relevant to that shipThe SMS provided by the company for the ship includes all elements of the ISM Code and has been assessed during the audit for issuance of the DOC or interim DOCThe Master and senior officers are familiar with the SMS and the planned arrangements for its implementationInstructions which have been identified as essential to be provided prior to sailing have been given (including lifeboat station and firefighting responsibilities) and specific additional reference material associated with safety requirements from the SOLAS training manual is available on boardPlans exist for an internal audit of the ship within three (3) monthsThe relevant information on the SMS is given in a working language or languages understood by the ship's personnelAll Class and Statutory certificates are valid and correct, as well as the Safe Manning Document

Document RegularisationFurther to a satisfactory audit, an interim SMC valid for a maximum of six (6) months from the audit completion date is issued by the Auditor unless a specific requirement from the Administration has been received or is stated in the Flag-specific the related survey procedure.If authorised by the Administration, the validity of the interim SMC may be extended for a maximum period of six (6) months.ReportingThe reason for performing an interim audit shall be specified in the audit report.

Ship Initial Audits

Performing the Audit

The issuance of a SMC is subject to:

• On board confirmation that a valid definitive DOC (not interim) relevant for the ship type and Flag has been issued to the companyThe DOC has been issued by an Administration or an organisation recognised by the Administration or another IACS SocietyThe maintenance of valid Class certificates in compliance with the requirements of a Classification Society meeting the requirements of Res. A.739(18) and A 789(19), as may be amended, or with national regulatory requirements of an Administration which provide an equivalent level of safetyThe maintenance of valid Class and Statutory certificatesObjective evidence that the SMS has been effectively functioning for at least three (3) months on board the shipObjective evidence (records) from the internal audits performed by the company on board the ship

Document RegularisationFurther to a satisfactory audit, a short-term SMC valid for a maximum of five (5) months from the audit completion date is issued by the Auditor unless a specific requirement from the Administration has been received or is stated in Flag-specific the related survey procedure. The definitive SMC valid maximum five (5) years from the audit completion date will be issued by MOC or the Flag Administration in accordance with Recognised Organisation (RO) authorisation (as per paragraph Issuance of Definitive Certificates by Marine Operations Centres (MOC)).

Ship Intermediate Audits

Audit Preparation

Intermediate audits for ships shall be performed at least once during the five (5) year validity period to maintain the validity of the SMC. If only one intermediate audit is required, then it must take place between the second and the third anniversary dates.Performing the AuditIn addition to the criteria in Ship Initial Audits, intermediate audits shall verify that:

• The SMS is effectively implemented and maintainedAny modifications made to the SMS comply with the requirements of the ISM CodeWhere nonconformities have been issued during the previous audit, that the root cause has been identified and appropriate corrective actions have been implemented

• Where defects or findings have been raised during Port State and Flag State inspections, that the root cause has been identified and appropriate corrective actions have been implemented

• The Classification and Statutory certificates are valid and that no surveys or Conditions of Class are overdue

Document RegularisationFurther to a satisfactory audit, a SMC shall be endorsed unless a specific requirement from the Administration has been received or is stated in the Flag-specific the related survey procedure.

Ship Renewal Audits

Audit PreparationA renewal audit shall be carried out within three (3) months of the expiry date of the SMC and shall be completed before the expiry date.Performing the AuditSMC renewal audits shall be carried out according to the same principles as Ship Initial Audits and Ship Intermediate Audits.

Document RegularisationFurther to a satisfactory audit, a definitive SMC valid for a maximum of five (5) years is issued by the Auditor unless Recognised Organisation (RO) is not authorised by the Flag Administration (as per Flag-specific the related survey procedure) in which case the Auditor should issue a short-term SMC valid for a maximum of five (5) months. Refer to paragraphs Untitled and Untitled for specific consideration related to certificate validity date.

review of requests and auditor assignment

Request for Audit

Informing of Audits

The AU System Operation Manager (SYSOM) must be informed about any audit to be performed in the AU area.

Confirmation of Contract

The SYSOM shall verify with the CS Unit of the ship, the conditions of the existing ISM contract and obtain agreement on the settlement of invoices.

Transfer of Certification

In case of Transfer of Management System Certification (TMSC) (change of RO), the provisions of the related survey procedure shall be followed.

Appointment of Auditor(s)

The SYSOM appoints the Auditor or the audit team, depending on the type of audit to be performed, the time available to carry out the audit and the Auditor's qualifications.

When selecting the audit team, it must be ensured that the members are familiar with the language of the audit and at least one of the members is familiar with the language in the SMS documentation is written. If there is no Auditor familiar with the working language, or they are unable to communicate effectively with the personnel, the audit should not be continued.

Rotation of Auditors

For ships in service activities the rotation of Auditors (avoiding the same Auditor repeatedly attending the same ships) shall be implemented as far as reasonably practicable (if the size of the team and availability of qualified Auditors) and shall be documented.

For small teams (less than two (2) qualified Auditors for the job):

• QMC will exercise a specific vigilance on the robustness and integrity of relevant audits reports at the time of the performance of the audit reports monitoring

• HO (MO) will implement specific requirements for the monitoring of the concerned Auditors which takes place every second year

Review of the Request for Audit

Review of Request for Audit

The request for audit is reviewed by the AU considering the following conditions:

• Auditing services must be contracted (confirmation from ship CS Unit may be required)

• Recognised Organisation (RO) is authorised by the Flag Administration (Flag-specific the related survey procedure to be checked)

• Any shipboard audits (except interim SMC audit) may only be conducted if the company is in possession of a definitive DOC

• All shipboard audits shall only be conducted if the ship is fully manned in accordance with Safe Manning Document

• Initial, intermediate and renewal shipboard audits shall only be conducted if the ship is under normal operating conditions (e.g. when the ship is not in dry-dock or laid-up)

• Interim audits may be conducted in circumstances other than normal operating conditions, provided that the ship is fully manned in accordance with its Safe Manning Document

• Special consideration shall be given to detained ships or ships performing an audit for reactivation (laid-up)

Follow-up of Request for Audit

Further to request for audit, the Auditor:

• Coordinates and arranges the audit with the company

• Coordinates with the audit team (in case of multiple Auditors)

• Arranges the document review, if required

• Requests an audit report job number

• Prepares the audit including the audit plan which shall be communicated to the company and those involved in the audit

Document review

Applicability

A formal document review is required as indicated below:

1) Only required when modifications to the previously reviewed SMS have been carried out.2) If such audit has been approved by MO.3) In case of change of RO: MO authorisation shall be obtained.

4) Only required if Recognised Organisation (RO) were not involved in the interim verification process.

General

• The document review shall verify that the SMS and any relevant documentation comply with the key elements of the ISM Code.When the review reveals that the SMS is not in compliance, the audit shall be delayed until the company has completed the necessary corrective action. Amendments made to SMS documentation to correct deficiencies identified during review may be verified in the office or during the corresponding audit.Any major nonconformity found in the SMS documentation must be downgraded or cleared before completing the document review.A corrective action shall be proposed by the company for each identified nonconformity.

Reporting Document Reviews

• The Auditor shall indicate that a document review has been carried out in the “Audit Selection” section of the audit report.

• The Auditor shall complete the “Document Review” section of the audit report, including the reference of the documents reviewed.

• The Auditor shall complete the relevant report item with a narrative summary of the document review, including any nonconformities and respective corrective actions.

• A copy of the SMS documentation list shall be attached to the audit report, this list shall include the page(s) that show the content and revision status of the reviewed SMS documentation.

Performing the Audit

Preparation for the Audit

Pre-requisites for Attendance

The Auditor shall verify that the conditions defined in paragraph Review of Request for Audit and hereafter are met.When conditions are not met, the Auditor shall discuss and clarify the matter with the company and request the advice of their CSQM or CS Unit. If the matter is not resolved prior to attendance, the Auditor shall cancel the audit and inform the company, CS Unit, MOC and MO accordingly.

Audit Preparation

The Auditor shall prepare for the audit by checking:

• The relevant Flag-specific the related survey procedure for any additional/specific instructions, level of recognition, etc.

• Neptune database or Move for the ship’s status including any nonconformities or observations raised during the previous attendance, see also paragraph Review of Nonconformities for actions

• Neptune database for any issued PR 17 reports, see also paragraph Follow-up of PR 17 Reports for actions

• Neptune database or Move for the last company DOC report for vessel audits to see if there are any issues that need to be evaluated on board

• Equasis database for PSC history and any detention

• All applicable IMO Documents relating to the ISM Code

Validity of Document of Compliance

For each audit, other than the company interim audit, the Auditor shall check that a relevant valid document of compliance or a copy thereof (not necessarily a certified true copy) is available and is:

• Applicable to the Flag and ship type to be audited or types of ships presently managed by the companyIssued by an Organisation complying with IMO Code for Recognised Organisations (for Flags which are signatories of SOLAS 74) and/or EU Legislations

Fleet List

At every company audit, the Auditor shall require an updated list of ships managed by the company, including the ship name, Flag, IMO number, ship type, GT, etc. to be presented in advance to guide the Auditor in determining the ship samples required by paragraph Ships sampling.

Preparation of the Audit Plan

The audit plan shall be flexible to permit modifications based on information gathered during the audit and to permit the effective use of resources.The Auditor shall produce an audit plan, in co-operation with the company or ship, and shall be communicated to all those involved in the audit. For company audits, the audit plan shall be sent to the client sufficiently in advance to allow for the coordination of the departments and ensure availability of personnel. For vessel audits, where the request does not allow for the plan to be sent in advance, this can be presented and agreed at the opening meeting. Communication of the audit plan and agreement of the schedule shall be documented in the audit report.

The audit duration shall be discussed and agreed with the Master and/or DPA and shall consider all criteria that could have an impact on the time spent on board (i.e. type of ship, number of crew, vessel operations, etc.).

Audit plans are pre-populated in the audit report, however, they are fully editable and the Auditor can add and remove lines as required.

Content of Audit Plan

The audit plan shall include:

• Identification of the individuals or organisational units having significant responsibilities within the SMS

• Identification of the Auditor(s) and company representative(s)

• The language of the audit

• The date and place where the audit will be conducted

• The date and time of the opening and closing meetings

• The specific timings for each audit activity (start time and finish time)

• The expected time and duration of an emergency response drill

• The schedule of any interim meetings to be held with the company/ship management

Audit Plans and Planning for Integrated Audits and Inspections

Where an ISM shipboard audit is conducted at the same time as an ISPS audit and/or an MLC inspection, planning shall be in accordance with the related survey procedure.

The common areas audited (opening meeting, closing meeting, document review, etc.) which are applicable to all three (3) codes shall be reflected in all three (3) audit plans for the same time, i.e.

• Opening meeting 0900-0930 (day 1)

• Document review 0930-1100

• Closing meeting 1630-1700 (day 2)

Confirmation of Changes to the SMS

To ensure that the information about any major change in the SMS (i.e. creation of a new company branch office) has been provided to the Auditor before the audit starts, the following sentence, to be answered by the Auditor, has been added to the audit plan:

"Are there any major changes in the company SMS which could imply in revision of the audit plan below?”

Audit Preparation Checklist

An audit preparation checklist may be used by Auditors to assist them in the process of planning and preparing for an audit (see paragraph Attached Files Attached Files).

Opening Meeting

Opening Meeting

Any ISM audit shall begin with an opening meeting with the participation of the Auditor(s) and the senior management of the company or ship, and those responsible for the functions concerned, the purpose of which is to ensure that personnel are fully aware of the objectives and scope of the audit.

Opening Meeting Agenda

The opening meeting agenda shall include as a minimum:

• Introduction of the Auditor(s) to the shipboard or company management

• Explanation of the scope and objectives of the audit

• Providing a short summary of the methods and procedures to be used, including sampling and reporting methodology (as per paragraph Sampling Methodology)

• Definitions of levels of finding and required actions

• Establishing the official communication links between the Auditor(s) and the shipboard or company personnel

• Addressing the risk of induced hazards by Auditor(s) on board ships, with special consideration to the possible presence of asbestos

• Emphasising the safety of personnel and the vessel are of paramount importance

• Making auditees aware of the Auditor’s Stop Work Authority in the event of unsafe situations

• Emphasising the confidentiality of the information received during the audit

• Confirming that the resources, documentation and facilities needed to perform the audit are available

• Confirming resources and timings for conduction emergency drills

• Confirming the arrangements for accompanied inspection of the ship

• Confirming or re-arranging of the audit plan if required, including the time and date of the closing meeting and any possible interim meetings

• Explaining the need for the audit team to have private meetings

• Providing the opportunity for the auditees to raise questions about the audit

Once the scope of audit has been confirmed and agreed, the Auditor shall confirm by having the Request for Audit signed and dated by the Master or company representative and attached to the audit report.

Recording of Opening Meetings

The opening meeting shall be recorded in the audit report and the summary documented in the “Observations” column of the opening and closing meetings section of the Infocard.

Audit Execution

Audit Objective

The objective of an ISM audit is to verify that:

• The SMS complies with the requirements of the ISM Code

• The SMS is being implemented effectively to ensure that the objectives of the ISM Code are met

• Improvement mechanisms are in place and implemented

Authenticity of Information and Access to Documents and Records

All records having the potential to facilitate verification of compliance with the ISM Code shall be open to scrutiny during an audit. For this purpose, the company shall provide Auditors with Statutory and Classification records relevant to actions taken by the company to ensure that compliance with mandatory rules and regulations is maintained.

The company shall ensure that the Auditor has access to Statutory and Classification records during audits, also when these records are issued by another Classification Society, other RO or the Administration itself.

The Auditor is entitled to acquire information from other societies or the Flag Administration, to verify the accuracy and authenticity of the information presented by the company.

Vessel Class and Statutory Status

When auditing a vessel, as a part of the audit process the Auditor shall review the Statutory and Classification survey records (Refer to Authenticity of Information and Access to Documents and Records).

Vessel Compliance with Mandatory Rules and Regulations

The verification of compliance with mandatory rules and regulations neither duplicates nor substitutes surveys for other certificates. The verification of compliance with the ISM Code does not relieve the company, the Master or any other entity or person involved in the management or operation of the vessel of their responsibilities.

During vessel audits, compliance with new rules and regulations in force since the last periodical verification shall be verified.

Fleet Compliance with Mandatory Rules and Regulations

When auditing a company managing vessels classed by another society, or for which the Flag Administration or another society performs the Statutory surveys, the Auditor shall review the Statutory and Classification survey records for at least one vessel of each ship type to which the DOC is applicable. These records shall be made available at the company's office.

During company audits, compliance with new rules and regulations in force since the last periodical verification shall be verified.

Assessment through Gathered Evidence and Observation

The Auditor(s) shall assess the SMS based on the documentation presented by the company and objective evidence of its effective implementation. Such evidence shall be collected through interviews, review of documentation and records, observation of activities and examination of the condition and operation of the ship, its equipment and technical systems.

Limitations

Consideration shall be given to the limitations that may be placed on the Auditor's ability to gather information and collect objective evidence when audits are carried out during the hours of darkness or other similarly restrictive operational conditions.

When the activities are planned to be carried out under any restrictive operational conditions the Auditor’s ability to gather information is not to be impaired. In cases where it is not possible to complete the audit due to such limitations, the audit plan may be changed as necessary to complete the audit when such limitations will be absent. If this is still insufficient to complete the scope of the audit, the audit shall not be commenced or credited.

Changes to the SMS

The Auditor shall consider any changes made to the SMS since the last external audit, and where changes are deemed to be significant or having an impact on the operation of the SMS, a document review shall be conducted and formally documented in the audit report as per Document review.

Crew List and Auditees

At every shipboard audit the Auditor must ensure that the manning level on board is correct. This requires a check, as a minimum, of the Safe Manning Document, crew list and crew certificates (according with SCTW, including Flag endorsements, signatures, etc.).

The Auditor shall obtain a copy of the crew list and mark the personnel whose qualifications were verified and who were audited, this shall then be attached to the audit report.

For company audits, the Auditor shall record the names and function of all personnel interviewed during the audit, these personnel shall either be documented in the report, or attached either marked on the organisational chart, or as a list.

Flag State Specific Requirements

In the scope of the audit the Auditor should verify the SMS compliance with Flag Administration requirements.

• Unless otherwise instructed by the Administration, Auditors shall verify compliance with Flag State requirements by sampling in the same way that compliance with other mandatory requirements is verified.Where Administrations have specified requirements to be verified at every scheduled audit, either on board or ashore, an appropriate audit plan shall be formulated, and agreement shall be reached on the estimated additional time that will need to be added to the usual audit duration. The company/ship shall be informed accordingly.

The Flag-specific samples verified shall be documented in the respective section of the audit report (ISM056).

Follow-up of PR 17 Reports

The Auditor shall verify with the CS Unit or MOC if any PR 17 reports have been issued since the last verification for the vessel, in case of vessel audit, or fleet of the company in case of company audit. This information is also available in Neptune.

Where PR 17 reports have been issued, the Auditor shall review the reports together with related MO instructions and shall verify the company analysis, implementation and follow up of corrective actions on identified deficiencies.

A nonconformity shall be raised where PR 17 reports and identified deficiencies were not effectively addressed by the company.

Cyber Security

The Auditor shall verify that the requirements of IMO Resolution MSC.428(98) and the IMO Guidelines on Cyber Risk Management (MSC-FAL.1/Circ.3) are implemented and incorporated into the SMS.

In addressing these requirements, the company shall ensure that they have the necessary procedures for managing cyber security risks, ensuring appropriate training for their personnel, and integrating cyber considerations into their regular system and software maintenance schedules. The SMS shall also include procedures for responding to cyber security breaches and for reporting of incidents and near misses.

The audit shall include verification of:

• The availability and distribution of cyber security management system documentation

• The familiarisation of personnel with their respective duties and responsibilities in relation to the cyber security management system

• The performance of cyber security management processes in line with cyber security management system documentation

Refer to maritime cyber risk management in safety management systems for guidance on cyber security.

Monitoring of Asbestos

At every shipboard and company audit, other than interim audit, the Auditor shall verify that the company has developed and implemented a maintenance and monitoring program for asbestos in line with provisions of IMO MSC Circular 1045. This may be a stand-alone document, or may form part of the IHM documentation required by international conventions and regulations, including the European Ship Recycling Regulation (EU SRR) and the Hong Kong Convention (HKC).

Review of Nonconformities

Periodical and renewal audits of the company shall include a review of nonconformities reported in relation to previous internal and external company and shipboard audits. The Auditor shall select a sample of the reported nonconformities and audit the company's investigation, analysis and resolution of the nonconformities in accordance with the requirements of Chapters 9 and 12 of the ISM Code.

Clearance of Nonconformities

The clearance of nonconformities of previous audits and the recording of the same is of primary importance and verification of completion of the agreed corrective actions shall be done no later than the next scheduled audit (annual, intermediate or renewal).

Where a nonconformity(ies) has been raised during the previous audit and the nonconformity has been corrected, but not reported through Move the Auditor shall raise a finding relating to the implementation of corrective actions.

Where a nonconformity(ies) has been reported through Move, but has not been corrected, or where the nonconformity has neither been addressed through move or corrected, the Auditor shall:

• Upgrade the uncorrected nonconformity to a major nonconformity

  and

• Raise a nonconformity relating to the implementation of corrective actions

Tour of the Vessel

During shipboard audits, the Auditor shall visit the deck, engine room, bridge and accommodation areas, to:

• Gain an overall impression of housekeeping, maintenance and condition of the ship and equipment

• Observe shipboard operations being conducted

• Verify the effectiveness of familiarisation and training

• Observe emergency drills

• Conduct interviews with ship’s crew

Emergency Response Drills and Exercises

During shipboard audits, the Auditor shall verify that the crew of the vessel are familiar with the procedures and equipment for responding to emergency situations and this should be made known through the audit plan (as per paragraph Preparation of the Audit Plan), and resources confirmed during the opening meeting (as per paragraph Opening Meeting Agenda).

The Auditor shall agree the scenario of the drill with the Master, and report the details in the audit report, including the performance of the crew.

When a drill is not conducted during the audit, this shall be documented accordingly in the audit report, with a summary of why there was no drill and what alternative measures were observed and verified to justify.

During office DOC audits, the Auditor shall verify that the company has appropriate mechanisms and procedures, including out of hours contact details to enable the office to respond and assist in the event of a vessel emergency. Testing of shore-based response should be conducted periodically and records retained.

Technical Deficiencies Identified during the Audit

Where an ISM Auditor identifies a technical deficiency deemed to present a serious threat to safety or the environment or that requires attention by Class or the Flag Administration shall:

• Establish if the company has taken appropriate action to correct the technical deficiency. In every case the Auditor shall establish that such technical deficiencies have been reported to the responsible Class Society or Flag Administration.

• Establish whether the technical deficiency constitutes or is symptomatic of a major nonconformity and, if so, follow the requirements of Dealing with major nonconformities, nonconformities and observations.

Audit Review

Auditor and Audit Team Review

At the end of the audit, prior to closing meeting the Auditor/audit team shall review the audit performed to:

• Verify that the scope of audit has been completedPrepare the audit conclusionsDetermine the grading of any audit findingsDraft any applicable nonconformity and observation reports

Determination of Findings

The Auditor(s) shall determine if findings are to be reported as major nonconformities, nonconformities or observations.Audit findings shall be reported in a clear, concise manner and supported by objective evidence, refer to Dealing with major nonconformities, nonconformities and observations for guidance.

Closing Meeting

Closing Meeting

Once the audit scope has been fully covered and any findings reports drafted, a closing meeting shall be held with the senior management of the company or the ship staff and those responsible for the functions concerned.

Closing Meeting Agenda

Closing meeting agenda should include as a minimum:

• A reminder of scope and objective of the audit

• A reminder of the methods and procedures to be used, including sampling and reporting methodology

• Confirmation of the result of the audit and the audit team conclusion (certification or not, certificate endorsement, additional audit(s) required,etc.)

• Presentation of any nonconformity and observation reports (Form K)

• Acceptance of the nonconformity and observation reports and signature by the company or ship representative

• Explanation of the process and time frames for corrective action proposals and for clearing any nonconformities as per Dealing with major nonconformities, nonconformities and observations

• Explanation of the procedures for any additional audit required

• Emphasise the confidentiality of the information received during the audit

• Provide the opportunity to raise questions about the audit conclusion and required actions

Presentation of Audit Findings

Major nonconformities, nonconformities and observations should be presented to the company or shipboard management in such a manner that they clearly understand the results of the audit.

Recording of Closing Meetings

The closing meeting shall be recorded in the audit report, and the summary documented in the “Observations” column of the opening and closing meetings section of the Infocard.

End of Audit

The audit can be considered as completed when:

• The scope of the audit has been fully covered

• The certificate has been endorsed or issued

• Any major nonconformities raised have been downgraded

• Any issued nonconformity or observation reports have been agreed and signed by the company/vessel representative and, if possible, corrective actions have been proposed by the company and agreed by the Auditors

Dealing with major nonconformities, nonconformities and observations

General

Accuracy of Grading

The Auditor(s) must accurately grade the audit findings into major nonconformities, nonconformities and observations, according to the definitions given in Definitions and abbreviations.

Dealing with Non-mandatory Codes and Guidelines

Implementation of Codes, Guidelines and Standards recommended by IMO, Administrations, Classification Societies and other maritime industry organisations are not mandatory under the ISM Code. Therefore, nonconformities should not be issued against these requirements, however Auditors should encourage companies to adopt these recommendations through the issuance of observations.

Writing of Nonconformity Reports

Each nonconformity report (Form K) must be signed by the company's representative, showing acceptance of the nonconformity issued at the end of the audit.

Each nonconformity report shall:

• Be recorded on a separate Form K (in the audit report)

• Be complete and concise and written in such a manner as to be easily understood. Clarity should not be sacrificed for the sake of brevity

• State clearly the act or situation identified as noncompliant with the company’s SMS or the ISM Code

• Clearly identify and explain the difference between the requirement and objective evidence of noncompliance with the requirement

• Be attributed to one ISM Code reference only. This reference must record the relevant clause or sub clause of the Code

• Be attributed to “other reference”. This reference should be to the applicable requirement of the company’s SMS. In the absence of a procedure reference, this shall be attributed to other references such as: ISO Standards (in case of Integrated Management Systems), Flag requirement, statutory requirement, or Class rules

One copy of each signed Form K shall be left on board, and a copy attached to the report.

Major Nonconformities (MNC)

General

A major nonconformity raised on a ship must be downgraded before the ship can sail. Downgrading may take place only after an immediate verifiable correction has been taken to remove any serious threats to personnel, the ship or the environment. An acceptable plan for implementation not exceeding three (3) months shall be agreed for completion of the necessary corrective actions.

Additional Audits for Downgraded Major Nonconformities

Following the downgrading of a major nonconformity, at least one additional audit shall be carried out on board the vessel within the time frame indicated in the agreed corrective action plan not exceeding three (3) months to verify that effective actions have been taken. In such cases an additional audit of the company's shore-based operations may also be carried out if the Auditor deems it necessary.

Following the downgrading of a major nonconformity raised during DOC audit, at least one additional audit of the company’s shore-based operations shall be carried out within the time frame indicated in the agreed corrective action plan not exceeding three (3) months to verify that effective actions have been implemented.

Major Nonconformities for Overdue Audits

If an audit is performed after a specified time window a major nonconformity shall be raised. The audit scope for an overdue periodical audit shall be, to that of the overdue periodical audit and the MNC shall be downgraded based on the completion of the audit.

If the overdue audit is an additional audit, the scope of the audit shall be that of an initial audit.

The MOC shall inform the Flag Administration about any raised major nonconformity.

Additional audits for clearance of downgraded MNC’s shall be required within a period not exceeding three (3) months from the end of the audit. The additional audit shall be reported in the audit report as "SMCP or DOCP overdue".

DOC Validity for Overdue Audits

Where a major nonconformity has been raised because a DOC audit has not taken place within the specified time window, the associated SMC’s continue to remain valid and in place without any additional verification if there are no other major nonconformities.

Immediate Actions for Major Nonconformities

Major nonconformity(ies), including those that are downgraded before the completion of the audit, shall be reported to the corresponding Flag Administration as follows:

• The Auditor shall inform the MOC and CS Unit immediately of any MNC(s) identified during DOC audits, which shall be reported, by the MOC of the company, to all Flags on whose behalf DOC’s have been issued and by which Recognised Organisation (RO) is authorised, and obtain their instruction on the scope of the additional audit

• MNC(s) identified during SMC audits shall be reported only to the Flag of the vessel concerned by the MOC

Where the corresponding DOC has been issued by another RO, MNC(s) identified during an SMC audit shall be reported to that organisation. The Auditor shall inform the MOC and the CS Unit Contact at the time the MNC is identified. The MOC shall then immediately inform the Flag Administration and obtain their instruction regarding actions required.

• When the DOC was issued by Recognised Organisation (RO), the Auditor informs the respective CS Unit Contact and the MOC of the ship

• When the DOC was not issued by Recognised Organisation (RO), the Auditor notifies the respective MOC of the ship who shall notify the DOC issuer (with MO in copy). In cases where one or more of these RO(s) are not identifiable, the Flag Administration shall be requested to forward relevant information to the respective RO(s).

Major Nonconformities and Certificate Endorsement

A certificate cannot be issued, endorsed, renewed or extended before any major nonconformity has been downgraded.

Major Nonconformities and Certificate Invalidation

An unresolved major nonconformity renders the ISM certificate invalid. When the MNC concerns a DOC, then all related SMC’s are also invalid.

Downgrading of Major Nonconformities

The Auditor identifying an MNC shall immediately inform the Master/company to allow them to take the immediate corrective actions required to downgrade the MNC.

Some Flags have specific requirements for dealing with MNC’s, which are stated in the Flag-specific the related survey procedure.

The MNC can be downgraded into an NC once the Auditor has been provided with:

1. The objective evidence that an immediate correction has been implemented, and the serious threat to the personnel or ship or a serious risk to the environment has been removed.

   When the MNC is related to a technical deficiency, objective evidence that the immediate risk has been removed may consist of evidence that the Classification Society of the ship has been informed and/or that the appropriate certificate has been issued or endorsed by the attending Class and/or statutory surveyor after required repairs were carried out.

   Undertakings or assurances from the company, whether verbal or in writing, are never sufficient objective evidence in such cases.

2. Company proposal of CA(s) or agreed limit date for CA(s) proposal

Downgraded MNC’s will be cleared once the effectiveness of the CA(s) has been verified during an additional audit which is to be performed within three (3) months.

Reporting Major Nonconformities

Downgrading of a MNC must be recorded in the appropriate section of the Form K including the Auditor's comments and a clear recommendation for an additional audit.

All Form K’s reporting raised MNC(s), and NC(s) shall be completed, printed and signed by the ship/company's representative and the Auditor.

DOC Withdrawal for Major Nonconformities

A company whose DOC has been withdrawn shall not be issued with an interim DOC, and no new DOC shall be issued unless an additional audit in scope of initial audit has been successfully performed. The expiry date of the new DOC, issued by the Auditor, shall be the same as that of the withdrawn one.

Notification to Fleet of DOC Withdrawal for Major Nonconformities

The company shall be required to notify the affected vessels immediately when any DOC is withdrawn.

Where the associated SMC(s) are withdrawn as a result of the withdrawal of DOC caused by MNC, new SMC(s) shall not be issued unless the DOC has been reinstated and an additional audit to the scope of initial audit (new SMC issued by the Auditor) has been carried out on board at least one vessel of each type operated by the company.

SMC Withdrawal for Major Nonconformities

An interim SMC shall not be issued to a vessel from which the SMC has been withdrawn because of an MNC(s). A new SMC shall not be issued before an initial verification has been carried out on board the ship. Depending on the nature of the MNC(s) raised on board an additional DOC audit, in scope of annual audit, may also be requested prior to the issuance of SMC. The new SMC shall have the same expiry date as the withdrawn one.

Nonconformities

Proposal of Corrective Action and Root Cause Analysis

The company is responsible for investigation of the root causes, proposing and implementing corrective action (CA) for each identified nonconformity.

The Auditor, who has raised the nonconformity has to agree with the root cause analysis (RCA) and CA(s) proposal and define the CA(s) implementation limit date not exceeding three (3) months from the audit completion date.

It is preferable that the RCA and CA(s) are proposed by the company during the closing meeting or, if not agreed, within a limit date not exceeding fifteen (15) days from the audit completion date.

RCA and CA(s) agreed during the closing meeting shall be registered by the Auditor on Form K together with CA(s) completion limit date.

RCA and CA(s) not agreed during the closing meeting should be proposed by the company through Move within the agreed CA(s) proposal limit date.

If, the company cannot register the CA(s) proposal, the company shall send the information to the CS Unit Contact of the company/vessel, who shall register the information through Move on their behalf.

Following the registration of RCA and CA(s) the Auditor, who has raised the nonconformity, will receive an automatic e-mail from Move with information that the CA(s) has been proposed.

The proposed RCA and CA(s) shall then be reviewed by the Auditor who issued them through Move.

If the Auditor considers that the proposed RCA addresses the cause of the nonconformity, and the CA(s) will rectify the situation and prevent recurrence, the Auditor approves the client actions.

If the proposed RCA and CA(s) are not acceptable, the Auditor will deny the client actions, through Move, and the company will have to propose new CA(s).

Following the Auditors action (approve or deny) an automatic email is sent to the company (if the proposed CA(s) have been registered by the company) or to the CS Unit Contact of the company/vessel (if the proposed CA(s) have been registered by CS Unit Contact of the company/vessel) informing them about the Auditors action.

If the proposed CA(s) have been registered by CS Unit Contact of the company/ship, they shall inform the company about the Auditors action as the company will not have been informed by automatic email.

If the Auditor has not agreed with proposed CA(s), within the agreed limit date, the Auditor shall, in collaboration with CS Unit Contact of the company/vessel, try to reach a solution with the company.

If a solution cannot be reached the existing ISM certification shall be invalidated as per Invalidation of the ISM certification and withdraw of ISM certificate.

Nonconformities during PSC Detentions

Any nonconformities raised during a PSC detention and downgraded shall have the root cause analysis and proposed corrective actions for the downgraded nonconformity agreed at the time of the audit and prior to the closing meeting. The fifteen (15) days permitted by Proposal of Corrective Action and Root Cause Analysis shall not apply in these situations. See also paragraph Audit - Dealing with Nonconformities.

Implementation of Corrective Actions

Nonconformities must be cleared (before they become overdue otherwise Flag instructions are required) by the Auditor during the additional audit, if requested, or no later than the next scheduled audit (annual, intermediate or renewal).

The company shall register, within agreed CA(s) completion limit date, information about performed CA(s) through Move.

If, for any reason, the company is unable to register the required information, the company shall send the information to the CS Unit Fleet Contact of the company/vessel, who shall register the actions through Move on behalf of the company.

Following the registration of performed CA(s) (by the company or by the CS Unit Contact of the company/vessel) the Auditor, who has raised the nonconformity, will receive an automatic e-mail from Move with information that the performed CA(s) have been registered, and that Auditor acceptance is required.

The performed CA(s) will be accepted by the Auditor who raised the NC(s), through Move, if in line with proposed CA(s) previously agreed by the Auditor.

If the performed CA(s) are not in line with previously agreed proposed CA(s), the Auditor will deny the validation through Move and the company will have to perform and register through Move new CA(s) in line with proposed CA(s) previously agreed by the Auditor.

Following the Auditor action through Move (approve or deny) an automatic email is sent to the company (in case the implemented CA(s) have been registered by the company) or to the CS Unit Contact of the company/vessel (in case the performed CA(s) have been registered by CS Unit Contact of the company/vessel) informing them about the Auditor action.

In case the performed CA(s) have been registered by CS Unit Contact of the company/vessel the CS Unit Contact has to inform the company about the Auditor action as the company has not been informed by automatic email.

In case the Auditor has not agreed with performed CA(s) within the agreed CA(s) completion limit date the Auditor shall, in collaboration with CS Unit Contact of the company/vessel, MOC and Flag Administration if needed, discuss with the company, and start the process of invalidation of ISM Certificate in case that any appropriate solution with the company has not been reached.

The registration of performed CA(s) is not mandatory, in case when the additional audit, for clearance of NC(s) has been requested.

The performed CA(s) shall be verified and NC(s) cleared by the next attending Auditor during the requested additional audit.

The performed CA(s) may be verified and NC(s) cleared by the next attending Auditor during any other additional audit (as per Dealing with major nonconformities, nonconformities and observations performed before the requested additional audit (e.g. after detention, change of name, change of Flag, TMSC, etc.) even if the company has not yet registered the information about performed CA(s) after the Auditor has verified that the CA(s) have been effectively implemented.

The NC(s) for which the additional audit has not been requested, and CA(s) were registered by the company through Move shall be cleared no later than the next scheduled audit (annual, intermediate or renewal), after the Auditor has verified that the CA(s) have been effectively implemented.

The performed CA(s) may be verified and NC(s) cleared by the Auditor during any other additional audit (as per Dealing with major nonconformities, nonconformities and observations) performed before the next scheduled audit (annual, intermediate or renewal), even if the company has not yet registered the information about performed CA(s) after the Auditor has verified that the CA(s) have been effectively implemented.

For each audit to be performed the Auditor will receive, in the audit report, the information about all open NC(s) which were raised during the previous audit.

Additional Audits for Clearance of Nonconformities

In case of nonconformities raised during the audit, additional audit(s) may be necessary to confirm the validity of a DOC and/or SMC. The company is responsible for applying for any additional follow-up audit required by the Auditor.

Upgrading of Nonconformities

Any CA(s) not completed by the company within the agreed limit date indicate that the requirements of the ISM Code are not effectively implemented. In such case the corresponding NC(s) must be "upgraded" by the Auditor to a major nonconformity.

The audit report allows the Auditor to upgrade NC(s) from a previous job into an MNC(s). The Auditor should change the NC(s) description that it's copied by into the new MNC(s) created. The description of the MNC(s) should not be the same as the description of the upgraded NC(s) and it should focus on the failure of the system to deal on time with the NC(s).

The Auditor with the assistance of the CS Unit Contact, MOC and Flag Administration, if needed, shall discuss with the company, and start the process of invalidation of ISM certificate (as per Invalidation of the ISM certification and withdraw of ISM certificate) in case that any appropriate solution with the company has not been reached.

Observations

Any observed situation not leading to a nonconformity, but which may be helpful to the company shall be recorded as observation, submitted to the company at the closing meeting and included in the audit report. No further action by the company or the Auditor is required.

Soft Grading

Soft grading is where audit findings are incorrectly categorised at a lower status than they should be, for example, when the audit evidence shows a clear breakdown, in terms of conformance to requirements, the finding should be categorised as a nonconformity, so the problem would be treated with root cause analysis and corrective action.

By soft grading a nonconformity as an observation, the audited organisation is not required to implement corrective action, letting the problem(s) linger, risking further deterioration of the management system.

Auditors should take necessary steps to avoid soft grading or being pressured into raising findings at a lower status.

Regularisation of certificates after the Audit

Certificate Issuance and Endorsement

A DOC or SMC may be issued, endorsed or renewed before all identified nonconformities have been closed provided that a schedule has been agreed between the company and the Auditor(s) for the implementation of the necessary corrective actions.Once the audit is completed with satisfactory results (even if NC(s) were identified), the Auditor needs to regularise the certificates (issue, endorse or renew) depending on the audit performed.When the results of the audit are not satisfactory the Auditor does not issue or endorse the certificate and informs the company, the Flag Administration and other parties concerned or initiates the process of invalidation of the ISM certification (as per Invalidation of the ISM certification and withdraw of ISM certificate).When the CA(s) are not proposed by the company at the closing meeting, the Auditor shall instruct the company representative, that proposal of CA(s) is necessary for the audit completion and for the regularisation of documents, including the issuance of definitive certificates. This situation does not prevent the issuance/endorsement of the certificates and the issuance of the NPSS. The company should propose CA(s) through Move within the agreed CA(s) limit date (as per paragraph Proposal of Corrective Action and Root Cause Analysis).

Certificates are fully editable by the Auditors with the possibility to make changes in the data before issuance. The Auditors shall inform the CS Unit and MOC about any changes made to ensure the updating of data in the relevant database.If during the company audit it is confirmed that a type of ship is no longer managed by the company, the DOC shall be re-issued (as per paragraph Determination of Ship Types on ISM Certification) or shall be withdrawn (as per Invalidation of the ISM certification and withdraw of ISM certificate).

Document Regularisation

The Auditor shall leave on site the following documents:

• Regularised certificatesA copy of any nonconformity reports or observations

Validity of First Certificate

Certificates with a maximum validity of five (5) months from the audit completion date (short-term certificates), shall be issued by the Auditor after initial audits or TMSC (see the related procedure) to cover the time period between the audit and the issuance of the definitive SMC or definitive DOC by the Marine Operations Centres or the Flag Administration, depending on Recognised Organisation (RO) authorisation.

Consecutive Interim Audits

Special consideration shall be taken in relation to consecutive interim audits to determine the real intention of the company. In case of any doubt the Flag Administration shall be contacted by the MOC for instructions.Specific instructions in the Flag-specific the related survey procedure shall be followed.

Copies of the DOC

The company shall provide a copy of the up-to-date DOC(s) to each branch office location (if any) and each ship covered by specific DOC for the Flag of the vessel the copy of the DOC does not have to be authenticated.A copy of the up-to-date SMC(s) shall be available at the company's head office.

Extension and Re-issuance of Certificates

Interim or short-term certificates shall not be re-issued nor extended unless duly authorised by the Flag Administration.

Issuance of Definitive Certificates

Recognised Organisation (RO) Authorisation

Before issuance of ISM certificates, the Flag instructions, as defined in Flag-specific the related survey procedure, and Move Platform - Flag Recognition & Authorisations shall be consulted.Attention shall be paid to the fact that, in some cases, Recognised Organisation (RO) may be authorised to carry out audits but not authorised to issue definitive certificates.

Validity of Definitive Certificates

Untitled

The validity of ISM certificates is specified in the ISM Code. The date of completion of the initial audit determines the expiry and the anniversary date for the corresponding full term ISM certificate.

Untitled

When the renewal verification is completed within three (3) months before the expiry date of the existing certificate, the new certificate shall be valid from the date of completion of the renewal verification for a period not exceeding five (5) years from the date of expiry of the existing certificate.

Untitled

When the renewal verification is completed more than three (3) months before the expiry date of the existing certificate, the new certificate shall be valid from the date of completion of the renewal verification for a period not exceeding five (5) years minus one (1) day.

Untitled

There is no relationship between the anniversary date of the ISM certificates (DOC/SMC) and the date of term of Class or Statutory certificates and/or ISPS certificate.

Types of Certificates

Three (3) types of certificates related to ISM are available: interim, definitive with a short-term and definitive with full-term validity. Interim and short-term definitive certificates are issued by the attending Auditor and delivered to the company/ship in accordance with Flag requirements and in case of Transfer of Management System Certification (TMSC) if applicable.Definitive certificates are issued by:

• MOC following an initial audit or after an additional audit due to Transfer of Management System Certification (TMSC) if Recognised Organisation (RO) is authorised by the Flag Administration, or

• Auditor, following a renewal audit or additional audit (not related to TMSC) as defined in paragraphs Company Certification Scenarios and Ship Certification Scenarios and company certification scenarios and vessel certification scenarios if Recognised Organisation (RO) is authorised by the Flag Administration.

Specific instructions from Flag Administrations (as defined in Flag-specific the related survey procedure) must be considered, including those where the certificate shall be issued in a local language and/or has local signatures. In those specific cases the Auditor may issue definitive certificates subject to a re-issuance of the certificate by the CS Unit of the ship following receipt of the certificate together with correspondent report.

Issuance of Definitive Certificates by Marine Operations Centres (MOC)

Certificates issued by the MOC shall:

• Be prepared, printed, and reviewed according to the local organisation of the Marine Operational Centre using the audit report as reference

• Be signed by the MOC Manager (or anyone else officially appointed by the MOC Manager) as per requirements of the related management procedure

• Be stamped on the original and bear the word "Copy" on copies

No correction is permitted on a certificate any error shall result in the destruction of the certificate.

Before dispatching to the client, the MOC transmits the certificate to the CS Unit for verification.

When a system certificate is re-issued at company request (in case of change of name, change of company address, loss of the original certificate...), it shall bear all the existing endorsements from the original certificate (place and date of the audit, name of the Auditor...), as well as the Recognised Organisation (RO) stamp and signature.

Registration of Certificates issued by MOC in NMM

The MOC’s shall register in NMM all audits performed by Recognised Organisation (RO) with corresponding certificates issued by Recognised Organisation (RO) or by Flag Administrations (MOC’s shall register in NMM the data concerning the certificates issued by the Flag Administration by selecting field "Issued by Flag ").

Even when Recognised Organisation (RO) is recognised by the Flag Administration on case-by-case basis, the respective job performed and corresponding certificate issued shall be registered by MOC in NMM.

That will permit to the owners to monitor the status of vessel and fleet and enable Recognised Organisation (RO) to comply with RO obligation for activity reporting toward the Administrations.

If Recognised Organisation (RO) is not recognised by the Flag Administration as RO, the certification services shall be performed on voluntary basis and, in this case, the performed jobs together with related certificates, shall be registered in NMM, as non-convention = V (voluntary).

In case that Recognised Organisation (RO) voluntary certificate is replaced by Flag certificate, MOC’s shall register in NMM the data concerning the certificates issued by the Flag Administration by selecting field "Issued by Flag".

Determination of Ship Types on ISM Certification

The ship types listed on DOC’s and SMC’s shall be consistent with the specific ship types defined in SOLAS IX Regulation 1 and on pertinent SOLAS documentation on board ship.

Some ships are designed for use in multiple services (for example oil tanker/chemical tanker). The ship type(s) listed on the DOC and SMC shall reflect the service(s) in which the ship is fit to serve, and the safety management system shall include appropriate procedures for these ship types.

The Auditor shall determine at each periodical audit of the company, the ship types operated by the company at the time of the audit. If the Auditor discovers that the company no longer operates a ship type listed on the DOC, the Auditor shall either document an observation to formally advise the company that the ship type will be removed from the DOC if this situation persists at the next scheduled audit or immediately remove the ship type no longer operated from the existing DOC.

If, at a scheduled audit, the Auditor determines that the company has not been operating ships of a particular type since a previous periodical audit the DOC(s) shall be replaced with new DOC(s) without the ship type no longer operated.

If the company notifies the CS Unit that the ship type is no longer operated, this information shall be forwarded to the MOC who shall start the process of the DOC withdrawal, if no ships operated by a Flag or DOC re-issuance without the ship type that is no longer operated.

Audit reporting

General

On completion of the audit, the Auditor shall complete the audit report and ensure that the required entries are completed.

The audit report shall be prepared by the Auditor, based on information gathered by and discussed with the audit team members (in case of audit team). It must be accurate and complete, reflecting the content of the audit.

Report Content

A quality ISM Code audit report should be accurate, evidence-based, clearly written and should document the positive as well as the negative findings, by accurately reflecting on what was audited and observed.

A quality audit report should add value to the SMS and validate the conclusion of the Auditor by:

• Clearly stating the objective evidence used to draw the conclusions, both positive and negative, such as crew interviews, drills, and document checks, evidence of the samples used should be documented in the report

• Using plain language, the report should have a clear narrative, be directly understandable and be free of abbreviations, acronyms and jargon

• Highlighting strengths and best practices

• Identifying weaknesses and risks

• Combining positive assurance with areas for improvement

• Providing a holistic view of system effectiveness (not just compliance)

The audit report should be completed as far as possible and preferably be completed during the audit.

The audit report narrative should also clearly link to any nonconformity or observations raised to the objective evidence and expand on the text of the finding.

The narrative should also clearly conclude that the root cause analysis has identified the cause of the nonconformity and the actions proposed will prevent recurrence.

Any nonconformities being closed must be clearly documented in the report and contain a summary of the actions taken by the client, including the effectiveness of the root cause analysis and implemented corrective actions.

The company is responsible for providing a copy of the audit report to the vessel once available in Move.

Refer to attached list for details of documents to be attached to the audit report.

Reporting Key Performance Indicators (KPIs)

KPI’s (all objectives are considered as average):

• NPSS - The NPSS shall be sent immediately after audit completion, in a maximum of forty-eight (48) hours, independently of the report preparation and the CA proposals, if any.Report - The audit report shall be completed and submitted within fifteen (15) days from the completion of the audit.

• Validation - The CSQM/DCSQM shall complete the review and validation within three (3) days of submission of the report.

• Invoice - The invoice shall be issued within five (5) days of validation of the report.

Review of Audit reports, invoicing and dispatching

Review of Audit Reports

Extent of Review

The definition and scope of review of audit reports by the CSQM/DCSQM and MOC defined in the related procedure.

Audit Invoicing and Report Dispatching

Untitled

Audits are invoiced as per the related procedure and as agreed by the ISM services contract.

Untitled

Dispatching of audit reports and issued certificates is done through Move.

Once validated by CSQM/DCSQM the audit report is automatically uploaded to Move where it is available to the company and Flag Administration.

Invalidation of the ISM certification and withdraw of ISM certificate

Reasons for ISM Certification Invalidation

ISM Certification (DOC or SMC) may become invalid for any of the following reasons:

Company Failures

a) Periodical/intermediate/renewal audit not requestedb) Corrective action not proposed or completed within agreed schedulec) Evidence of unresolved major nonconformityd) Amendments to the ISM Code not considered

Company Decisions

e) Transfer of Management System Certification (change of RO)f) Change of companyg) Others: ship sold, scrapped, lost, when the company is no longer operating a type of vessel listed on DOC, etc.

Company Responsibilities

In accordance with the ISM Code, the company is responsible for establishing the necessary arrangements to maintain the ISM Certification for DOC’s and SMC’s.

Recognised Organisation (RO) Responsibilities

Untitled

For the cases listed in paragraph Company Failures the Auditor/CS Unit Contact shall prepare a Notification for Invalidation of ISM Form Z (available in the audit report and NMM), after discussion with MOC/MO, which shall be distributed by MOC to each of the following parties:

• The company - action by AUThe Flag Administration - action by MOCThe Port State Authority (if appropriate) - action by AUThe RO responsible for issuance of SMC (in case of DOC invalidation) - action by MO/FM_REGThe RO responsible for issuance of DOC (in case of SMC invalidation) - action by MO/FM_REGThe Classification Society (in case of SMC invalidation) - action by MO/FM_REG

• The Recognised Organisation (RO) CS Unit, MOC, MO and to the report file - action by AU

Untitled

Withdrawal procedure may only be implemented when the Flag Administration has delegated this function to Recognised Organisation (RO).

Untitled

For the case in paragraph Company Decisions (e) refer to the related survey procedure.

Untitled

For the cases in paragraph Company Decisions (f) and Company Decisions (g), the Audit Unit receiving the communication from the owner/company shall inform the MOC, who will proceed to the cancellation of the ISM certificate(s) in Neptune and inform the Flag Administration of the invalidation of the ISM certification by Recognised Organisation (RO). No further action is needed unless the new company or buyer continues ISM certification with Recognised Organisation (RO).

Untitled

For the cases listed in paragraph Company Failures, an effort from the Auditor and the CS Unit Contact must be performed to convince the company to rectify the reasons which may cause the certification invalidation. The Flag Administration shall be informed by the Auditor/CS Unit Contact after discussion with MOC and MO. Flag Administration instructions, if any, are to be followed.Records of communications with the company shall be kept in the respective ship of company file.

Untitled

To fulfil the Society's obligations under SOLAS and IMO Resolutions, the Auditor shall prepare and submit to the CS Unit Contact a draft Notification of Invalidation of ISM Certification Form Z (available in the audit report and NMM). The copy of the Form Z should be attached to the audit report.

When a certificate is invalidated, the issuing RO shall without undue delay but not later than within five (5) working days, from the decision to invalidate, inform the Flag State and other RO’s if affected by invalidated certificate.

Untitled

The CS Unit Contact shall discuss the matter with the company, after having received MOC instructions.

Untitled

If the matter is not solved, the CS Unit Contact shall recommend ISM certification invalidation by completing a draft Form Z (available in NMM and the audit report), and try to obtain the company signature, and send it to the MOC together with the audit report and a copy of the communications with the company.

Untitled

In cases of ship (SMC) certificates withdrawal, the MOC shall be responsible for the final decision together with the CS Unit Contact. In case of company (DOC) certificates withdrawal the MO’s is responsible for the final decision. In both cases the responsible entity (MOC or MO) shall review the file, request the Flag Administration authorisation and, if appropriate, withdraw the ISM certification by cancelling the certificate in the database. All parties concerned shall be immediately informed by forwarding them the completed Form Z (available in NMM and the audit report).

The communication between Recognised Organisation (RO) and the company shall be limited to the ship and the company identification, the substance of the major nonconformity and the date of audit.

Untitled

When authorised by the Administration to withdraw the DOC, the MOC shall inform the company, with copy to the Administration, that the DOC is withdrawn and request the original DOC to be returned to the Society. The company shall be required in writing to immediately notify appropriate ships that the DOC is invalid.

Invalidation of a DOC shall result in the invalidation of the associated SMC’s.

Untitled

When authorised by the Administration to withdraw the SMC, the MOC shall inform directly or instruct the CS Unit/Auditor to inform the Master, that the SMC is withdrawn and request the original to be returned to the Society. The Administration, the company and the Classification Society (for non-RO-classed ships) should also be informed accordingly.

Untitled

The Master/DPA must clearly understand the circumstances of the recommendation for certificate withdrawal.

Untitled

The opportunity should be given to company to clarify the situation before any action from the Society.

Untitled

Specific instructions related to withdrawal of DOC’s and/or SMC’s due to MNC’s are found in the Dealing with major nonconformities, nonconformities and observations.

Untitled

All Notification of Invalidation of ISM Certification (Form Z) shall be distributed as defined in paragraph Untitled.

Form Z shall be sent by FM_REG to MOC, with copy to CU and Flag Administration. The MOC should inform the company about the invalidation of the ISM certificate.For cases of ISM Certification Transfer refer to the related survey procedure.

Form Z Creation

By the Auditor in the Audit Report

During an audit the Auditor is selecting Form Z from the "print" menu in the audit report.

By MOC/MO/CS Unit Contact in NMM

Through NMM (without an audit report) the MOC/MO/CS Unit Contact can create Form Z, by selecting “ISM Form Z” from the "ship reports" menu.

HOW TO DETERMINE COMPANY BRANCH OFFICES TO BE AUDITED

Untitled

Where a company assigns SMS responsibilities to branch offices, the verification shall include a representative sample of those offices. The sample selected shall be sufficient to ensure that all elements of the SMS and all requirements of the ISM Code can be assessed.

Untitled

The audit of each branch office shall address all requirements of the ISM Code relevant to that office.

Untitled

The company should perform internal audits of all branch offices and relevant records shall be made available to the Auditors.

Untitled

Where the company assigns SMS responsibilities to branch offices, the list of branch offices shall be indicated in attachment to the DOC.

The sampling process of branch offices for periodical verifications shall ensure that all branch offices are audited (at least once) during the period of validity of the DOC.

If an additional branch office is included by the company in its SMS during the period of validity of the DOC, it shall be verified at the next scheduled verification. The additional branch office shall be included in the attachment to the DOC, when the DOC is endorsed.

The System Operation Manager of the company head office CS Unit should coordinate branch office audits and issue/endorse the DOC following the audits.

Initial DOC Audit

Untitled

Where SMS activities are performed by branch offices, the number of branch offices to be verified is:

• Two (2) if the total number of branch offices is two (2) or three (3)Three (3) if the total number of branch offices is between four (4) and six (6)To be agreed if the total number of branch offices is more than six (6)

Untitled

Where a company operates branch offices, the head office must be audited as part of the initial verification.

Annual DOC Audit

Untitled

Annual audits shall ensure that all branch offices are visited during the period of validity of the DOC. The audit of the branch offices shall be agreed with the company. The frequency of branch office audits shall be determined based on the nature and extent of the activities undertaken by each branch office in accordance with Untitled.

Untitled

If the System Operation Manager of the CS Unit requests an audit to be performed on a company branch office, an audit report shall NOT be created (otherwise the system will consider the company HO as audited).

For these cases, the Auditor shall generate a checklist from Move or request a copy from FM_SAT for use during the audit and send to the System Operation Manager of the CS Unit who is responsible for the contract.

Only after receiving all branch office audit reports, scheduled as part of the annual audit, together with the outcome from the company head office audit that the System Operation Manager of the CS Unit shall endorse the respective DOC.

dealing with ad-hoc requests

General Provisions

Untitled

Instructions from the Flag Administration may be sought by the company or ship CS Unit and those prevail over the requirements stated in the present procedure. Any instructions from Flag Administration must be kept in writing and a copy thereof shall be attached to the audit report. In case a Flag Administration has not issued instructions by writing, the person receiving the verbal instruction shall send an e-mail to the Flag confirming the instruction received (with copy to MOC of the company/ship) and keep it in local file.

Untitled

Additional audits are any audits other than interim, initial, periodical company, intermediate shipboard or renewal audits, which may be requested by a company, Flag Administration, Port State Administration and FM or which may have been recommended by an Auditor or required by the Society's procedures.

Untitled

There are specific TNS’s which deal with following audits such as:

• the related survey procedure for audits related to Transfer of Safety Management Systems Certification

• Paragraph Port State Control Detention and Banned Ships of this procedure for audits following PSC detentions

Untitled

The scope of the additional audits for clearing of NC’s or downgraded MNC’s and for audits requested by the Auditor shall include but not be limited to:

• Verification of the implementation and effectiveness of corrective actions agreed by the Auditor, who raised the NC’s or MNC’s

• Verification of Class and Statutory records

• Review of parts of the company’s “SMS” as may be required to gather the objective evidence during the audit

Untitled

All Additional audits requested by Flag Administrations and PSC’s must be endorsed on the correspondent certificates. Other additional audits do not need to be endorsed as the additional audit endorsement spaces are limited.

Company Certification Scenarios

Refer to company certification scenarios for details.

Ship Certification Scenarios

Refer to vessel certification scenarios for details.

MISCELLANEOUS ISM ACTIVITIES

How to Treat FPSO’s, FSU’s, etc.

Untitled

Due to their special, individual characteristics of FPSO’s and FSU’s, the operation of each vessel should be evaluated on a case-by-case basis against the following four situations when deciding whether the ISM Code applies:

1. The vessel disconnects from the mooring system at regular intervals to proceed, under its own power, to a discharge port. In this case, SOLAS and the ISM Code apply, and the unit will need a Safety Management Certificate as from 1st July 1998.

2. The vessel can disconnect from the mooring system and will do so for meteorological or security reasons. SOLAS may apply in these circumstances. If so, it may be possible for the operator to obtain an exemption from the Flag Administration.

3. The vessel disconnects from the mooring system and proceeds, under its own power, to a dry-dock or repair berth for survey or repair, at very infrequent intervals, perhaps every five or ten years. In this case, it is likely that the Administration and the operator will have reached agreement on the arrangements to be made when this occurs.

4. The vessel can be disconnected from the mooring system but has no independent means of propulsion.

5. Disconnection occurs only when repairs are needed, that requires that the unit be towed to a repair yard. SOLAS and ISM Code will not apply in this case.

Untitled

In some parts of the world a safety case regime may be in operation that requires the operating company to have developed a risk-based management system covering the operation of the oil field as whole, including the vessel. The company may have addressed the requirements of the ISM Code by combining the existing risk-based safety management system in conjunction with a bridging document which addresses requirements of the ISM Code that are additional to those specified by the risk-based system.

Untitled

Any regulatory requirements imposed by the relevant coastal State Authorities must also be considered by the operator.

Untitled

The final responsibility for deciding whether the ISM Code applies lies with the Flag Administration. Where there is any doubt, the vessel's operator should contact the Flag Administration to obtain a decision.

Master is also the Owner

Process

Background

The Master/Owner vessel may not have any shore-based organisation, and this could give rise to problems of interpretation of the Code. The following sections of the ISM Code state or imply that the company has a shore-based organisation:

Section 2.2 The policy is implemented and maintained at all levels of the organisation both, ship-based and shore-based.

Section 3.3 ..... adequate resources and shore-based support are provided.

Section 4. Designated person … to provide a link between the company and those on board …. And that adequate resources and shore based support are applied …

Section 5. Master's responsibility and authority

Section 5.1.5 ..... reviewing the SMS and reporting it deficiencies to the shore-based management.

Section 5.2 …. request the company's assistance as may be necessary.

Section 8.3 …. the company's organisation can respond at any time to hazards, accidents and emergency situations involving its ships.

Section 9.3 … Nonconformities, accidents and hazardous situations are reported to the company,…..

The wording of the above requirements assumes there is a separation of roles and responsibilities, that is impracticable in single vessel, Master/Owner operations.

Meeting the Code Requirements

There are three approaches that the single vessel operator or Master/Owner can adopt to ensure compliance with the Code:

1. Assign two or more roles to the same person

2. Hire contractors to fulfil the roles of designated person, internal Auditor or shore-based system administrator, for example

3. A combination of a) and b) above

Whatever is the solution retained, the company should ensure its effective operational and administrative control, rather than trying to identify the organisational structure implied by the wording of the Code.

The effectiveness of the solution retained is important and not the location (ship or shore-based) of the involved personnel. For example, effective reviews of the SMS may be carried out, and deficiencies identified, analysed and corrected, even though the entire process may be administered by the Master, with no shore-based involvement.

Designated Person

The critical function of the Designated Person is to ensure that the safety and pollution prevention aspects of the operation of the ship are being effectively monitored. Although the Code refers to this person as a shore-based position, the Master/Owner may act as the Designated Person.

The Owner is the highest level of management and therefore responsible for the application of adequate resources, and shall ensure adequate shore-based support, for example, by establishing communications and contingency arrangements with agents or other third parties.

Emergency Response

A dedicated shore-based organisation is not necessarily required to ensure that the company can respond at any time to emergency situations on board the vessel.

The emergency response plans should cover all identified potential emergency situations and include how outside assistance can be obtained, i.e. emergency response centres, salvage tug contractors, spill clean-up contractors, etc.

The emergency plans should ensure that the shore-based emergency organisations can readily obtain current crew details. The agents at the ships sailing and departure ports could be involved in this process.

Internal Audits

The Code aims for independent personnel in this function "unless this is impracticable due to the size and the nature of the company".

Experience shows that the risk for an ineffective audit will increase with the lack of independence and it is encouraged that the company should employ an external contractor for this purpose.

The most important point is to verify that the chosen solution is effective in ensuring that the SMS is implemented.

Documentation

Provision should be made for the remote back-up of computer systems and files, and the retention ashore of copies of important documents. Examples include current crew list with next of kin details, copies of charter parties, H&M Insurance, P&I cover, etc.

Handling of Outside Contractors

When the company uses outside contractors, the following factors should be considered:

1. Precise nature of the contractual relationship, including any obligations imposed on the company

2. Basis on which the choice of contractor was made

3. Suitability of the contractor to undertake the assigned roles

4. Timeliness, frequency, completeness and effectiveness of the communications between the contractor and the company

The company may not be the only client of the contractor, and the provision of such services may not be the contractor's only activity. It is, therefore, important to ensure that the contractor is dedicating sufficient time and resources to filling the specified commitments to the company, and that they can contact the contractor when necessary.

It is mandatory that the contractor is periodically evaluated by the company to ensure he is meeting obligations set forth by the company.

Document of Compliance

In some cases, the vessel will be the company's only "site", but the vessel cannot be given as the address on the DOC. In these cases, the address may be the Master's home address, or that of an agent or other representative such as a bank, lawyer or a contracted Designated Person.

The Audit Process

When the vessel is the company's only site, the Auditor will conduct the office audits on the vessel. Whilst the office audit might overlap the shipboard audit, the Auditor shall complete separate audit reports for the office and the vessel.For the office part of the audit, emphasis should be given to the specific requirements of the Code applicable mainly to the shore organisation such as:

• Safety and Environment Policy

• Responsibility and authorities applicable to the key functions including Master and DPA

• Procedures covering element 12 of the Code "Company verification, review and evaluation"

Where found necessary by the Auditor and/or requested by the company, third party locations/outside contractors may be included in the audit.

Audit Reports

The audits must be reported in two different jobs (one for the company and one for the ship).

All process shall be identical to any ISM audit process (request, preparation, validation, certificate issuance, etc).

Auditor's Guidance for Master/Owner Scenario

ISM Code Section 1 & 2

Usually, the objectives and the policy are orientated on long-term perspectives to keep the family business running, i.e. Master/Owners are people-orientated and have personal interest in maintaining the vessel in good condition.

Instructions and procedures might be kept relatively short but must be comprehensive enough so that a relief captain and/or new crew members should receive adequate information about the SMS.

ISM Code Section 3

All ISM relevant functions of the Master (e.g. managing director, superintendent, crewing manager, designated person, Company Security Officer) must be clearly described.

Although an official shore-based organisation is not required, if all relevant tasks can be taken over by the Master and relevant contacts can be made from the ship (contact lists to be available), shore-based support is usually available through agents, charterer, brokers, consultant, P&I Club and family members.

The contractual relationship and the role of this support shall be defined in the ISM Manual (SMS).

The Master/Owner may act both as DPA and top management, providing they can demonstrate that the safety and pollution prevention aspects of the operation of vessel are being monitored effectively. As the Owner, representing the highest level of management, they are responsible for the application of adequate resources, and may ensure adequate shore-based support by, for example, establishing communications and contingency arrangements with agents or other third parties.

ISM Code Section 4

It is fully acceptable that the role of the Designated Person should be covered by the Master/Owner.

Subcontracting this position would be rather difficult, hardly any consultant would accept to take over this role, due to the relevant responsibility and potential legal consequences.

ISM Code Section 5

An extra Master's review of the SMS is not required, this is covered by the system outlined in Element 12.

A statement regarding the overriding authority of the Master makes no sense in the case of a Master/Owner but such a statement is valid for a potential relief Master.

ISM Code Section 6

Quite often, long-standing crew members (having fulfilled many contracts for the same Master/Owner) are engaged. In such a case, appraisal/crew ability reports are not necessarily required, as the work performance is known.

Familiarisation protocols should be used for new crew members.

On many ships operated by Master/Owners, only two (2) licensed bridge watch keepers are on board (respectively two (2) persons for the supervision of cargo works). Thus, the Auditor might pay special attention to the compliance with minimum rest hours.

ISM Code Section 7

Operational plans, instructions, procedures and checklists could be kept to a minimum but must be sufficient as guidance for the relief Master and new personnel.

ISM Code Section 8

If a shore-based contact is available, at least one emergency drill per year should include involvement of the shore-based support.

ISM Code Section 9

Although it might appear impracticable if the Master/Owner is reporting to themselves failures, accidents, etc. should be stated in writing and shall be analysed.

ISM Code Section 10

Reports from shore-based superintendents are not required, however on-board inspections and maintenance activities shall be recorded.

ISM Code Section 11

Provision should be made for the remote back-up of computer systems and files, and the retention ashore of copies of important paper documents.

ISM Code Section 12

Internal audits could, for example, be carried out by the relief Master.

However, to achieve full independence, it is advisable that the internal audits are carried out by a third-party contractor.

The evaluation and review of the system could be combined with the internal audit (if a respective review statement is performed and signed by the owner).

Port State Control Detention and Banned Ships

Ships detained by PSC

Request for Audit

The company's request for additional audit is normally received by the CS Unit which then conveys it to the appropriate Audit Unit. If received directly by the AU, the CS Unit should be contacted before commencing the audit.

The CS Unit should inform the company and the Flag Administration about the audit to be performed (an agreement for the invoicing is recommended before commencing the audit).

When the request is received from PSC or FM, the CS Unit Contact shall inform the company and Flag Administration. All additional audits requested by the PSC, on board a vessel or in a company premises, shall be agreed by the company.

Request may come also directly from the Flag Administration. In such case, FM shall be informed.

The AU receiving the request shall confirm that the detention is related to the ISM Code and clarify the matter with PSC, if necessary.

If the DOC has been issued by Recognised Organisation (RO), the CS Unit, with the assistance of the MO/MOC, shall consider the need of performing an additional company audit and discuss the matter with the company.

In the absence of any specific instructions to the contrary, the scope of any additional audit carried out following the detention of a vessel that holds an interim SMC shall include, as a minimum, the deficiencies identified by PSCO. Implementation will be verified to the extent that the available evidence permits.

Audit Preparation

The scope of the additional audit should include but not be limited to:

1. Dealing with deficiencies addressed by the PSC Officer in relation to failures in the SMS

2. Verification of Class and Statutory records

3. Review of previous audit nonconformities

4. Review of elements of the company SMS justified by objective evidence found during the audit

Those decisions shall be taken together with the respective MO and, when decided, the company and Flag Administration informed.Where a vessel has been detained and the PSC inspection report explicitly references an ISM MNC, the Recognised Organisation (RO) Auditor shall board the vessel and perform an additional audit with the scope of an initial audit.

If, during the shipboard audit, it becomes apparent that problems also exist with the SMS of the company, an additional audit to the extent of the annual audit shall be requested for the company.

In the absence of any specific instructions to the contrary, if a ship is justifiably detained twice within twelve (12) months, then an additional shipboard audit in the scope of an initial audit shall be performed for the ship's SMS and an additional audit of the company, if Recognised Organisation (RO) is the RO, in the scope of an annual audit.

Audit - Dealing with PSC Deficiencies

When attending a vessel because of Port State Control action, the Auditor shall consider the objective evidence presented by the PSC Officer. When such evidence is a technical deficiency, the Auditor should refer to paragraph Emergency Response Drills and Exercises.

Where the Auditor considers that the evidence indicates the presence of a major nonconformity, this shall be documented, and the company notified immediately, the Auditor shall then proceed as indicated in Dealing with major nonconformities, nonconformities and observations.

In cases where the PSC Officer alleges that there is evidence of a major nonconformity, and the Auditor disagrees, the PSC Officer will decide what further action must be taken.

Where the Auditor disagrees with the actions taken by the PSC Officer, the matter shall be discussed with the CSQM, and the Auditor shall provide the PSC Officer with a written explanation of the disagreement. The Auditor should request the MOC to inform the Flag Administration.

The reasons for the disagreement shall be documented in the audit report.

Audit - Dealing with Nonconformities

As per paragraph Nonconformities during PSC Detentions, when nonconformities are raised during PSC detentions, root cause analysis and proposed corrective actions shall be agreed at the time of the audit, clients shall not be permitted to take fifteen (15) days to propose actions. The Auditor shall ensure that the root cause has been correctly identified and that the proposed actions will both eliminate the nonconformity and prevent recurrence.

Document regularisation

On satisfactory completion of the additional audit, the Auditor shall endorse the SMC.

If the vessel departs from port with an unresolved MNC, the Flag Administration, Port State Control, MOC and FM shall be informed immediately and the process of invalidation of ISM certificate as per Invalidation of the ISM certification and withdraw of ISM certificate commenced.

When requested by the PSC Officer and/or by the Flag Administration, an Audit Attestation should be delivered on board by the Auditor as a summary of the additional audit carried out.

This Attestation will be a proof to PSC that additional audit further to detention has been performed and prevent delays in the release of the vessel.

Ships Banned by PSC MOU’s

The MO shall verify the reason that led to the banning of the vessel.

If the reason can be considered as evidence of unresolved major nonconformity, then the MO may decide to propose the withdrawal of the vessel SMC.

In such case, the MO shall create the Form Z (as per Invalidation of the ISM certification and withdraw of ISM certificate) stating the reason as "an unresolved MNC" and send it to the MOC, who shall send to the company for signature.

After receiving the Form Z signed by the company or if no response from the company in two (2) working days, the MO shall send the Form Z to the Flag Administration, asking for instructions (i.e., agreement to proceed with the SMC withdrawal).

CLIA Attestation

Reference

The Cruise Lines International Association (CLIA) requires all oceangoing cruise line members to implement a strict, mandated set of operational standards that frequently exceed international maritime laws relating to shipboard safety, security and environmental stewardship. These policies are available on the CLIA website under “CLIA Member Maritime Policies”.

Objective

In accordance with CLIA requirements, all related member policies are to be included in the company SMS even if they are not applicable for the company. For example, if the policy "safeguarding children in youth activities centres" is not applicable, they shall specify that this policy is not applicable on board their vessels as they don’t carry children or have youth centres on board.

Verification Process

The CLIA do not mandate RO verification of implementation of these policies by the company, however, this may be carried out if requested by the company, where Recognised Organisation (RO) is the DOC issuer.

On completion of satisfactory verification, an attestation of inclusion of member policies (see paragraph Attached Files Attached Files), may be issued.

The company shall distribute the attestation to their vessels as a proof of compliance.

Where the company requests an attestation for a vessel, for which Recognised Organisation (RO) is the SMC issuer, an on-board audit may be conducted for confirmation that CLIA member policies are included in vessels SMS.

These verifications may be performed during a periodical audit or by an additional audit if no periodical audit is due.

This service is not a statutory audit and not part of the scope of the ISM contract with the company, however, if this audit is requested, the CSQM may consider the Guide B for ISM services as reference to invoice the service.

REFERENCED DOCUMENTS

Attached Files

• Attachment A1. Company certification scenarios

• Attachment A2. Vessel certification scenarios

• Attachment A3. List of attached documents for ISM reports

• Attachment A4. Cyber risk management in management systems

• Attachment A5. ISM/ISPS/MLC Evaluation grid

• Attachment A6. ISM/ISPS/MLC Form I

• Attachment A7. Guidance for reporting document reviews

• Attachment A8. Audit preparation checklist

• Attachment A9. CSQM job validation guidance

• Attachment A10. Instructions for use of ISM Logo

• Attachment A11. Recognised Organisation (RO) ISM Logo

• Attachment A12. CLIA Model of Attestation

Appendix — maritime cyber risk management in safety management systems

Attached Files

See attached file “Attachment A4. Cyber Risk Management in Management Systems”.

Appendix — company certification scenarios

Attached Files

See attached file “Attachment A1. Company Certification Scenarios”.

Appendix — vessel certification scenarios

Attached Files

See attached file “Attachment A2. Vessel Certification Scenarios”.