ISM Internal Audit Checklist: 13 Elements Preparation
An internal audit that finds nothing has not proved the system works. It has proved the audit does not. The whole point of auditing yourself at intervals of no more than twelve months is to find the gaps while they are still yours to close, and a DPA who signs off a clean internal report and then watches an external auditor write six findings on the same vessel has a problem that sits in the audit process rather than in the ship. This is a working checklist for the thirteen elements, built around what to look at and what evidence settles it.
ISM internal audit · DPA
If the external audit finds more than you did, the audit is the finding
Run the thirteen elements as a live checklist, not a document
What the internal audit is actually required to do
Section 12 of the Code sets three obligations that shape everything else, and reading them in order explains why a thin internal audit is a compliance failure in its own right rather than a missed opportunity.
Audit at intervals of no more than twelve months
Ashore and on board, to verify that safety and pollution-prevention activities actually comply with the system. Twelve months is a ceiling, not a target, and a vessel trading hard will justify more.
Evaluate whether the system is working
A separate obligation from auditing compliance. A system can be followed exactly and still be ineffective, and this is the element most often answered with a signature rather than an assessment.
Keep auditors independent of what they audit
Independent unless impracticable for the size and nature of the company. In a small operator this is the clause that gets stretched; the honest answer is usually a reciprocal arrangement between vessels or superintendents rather than self-auditing.
What the Code does not do is tell you how hard to look. That judgement is the DPA’s, and it is measured afterwards by how much the external auditor finds that you did not.
The thirteen elements, and what settles each one
The column that matters is the third. An auditor does not accept that something is done because a procedure says it should be; they accept objective evidence — a record, a measurement or a statement of fact that can be verified. Auditing your own system means asking, element by element, what you would hand over.
Element
What to examine
Evidence that settles it
1. General
Whether the system as written matches the company and the fleet it is supposed to describe
A manual whose scope covers the vessel types and trades actually operated
2. Safety and environmental policy
Whether the policy is implemented and maintained at both levels, not merely posted
Crew able to say what it means for their own work, and evidence it is applied in decisions
3. Company responsibility and authority
Whether the organisation chart matches who actually decides, including when the named person is away
Defined responsibilities, interrelations, and a deputising arrangement that has been used
4. Designated person ashore
Whether access to the highest level of management is real and whether the DPA has resources and support
Records of direct reporting, and issues raised by the DPA with what happened to them
5. Master’s responsibility and authority
Whether the master’s overriding authority is stated and whether anyone has felt able to use it
The clause itself, plus the master’s own review of the system and the company’s response to it
6. Resources and personnel
Qualification, familiarisation and whether new joiners receive it before it matters
Familiarisation records dated against joining dates, certificates, and training actually delivered
7. Shipboard operations
Whether procedures for key shipboard operations exist, are usable and are followed as written
Completed checklists from real operations, with entries that vary as real work varies
8. Emergency preparedness
Whether drills exercise the scenarios identified and whether the shore response has been tested
Drill records naming participants and what went wrong, and an exercised shore contingency plan
9. Reports and analysis
Whether non-conformities, accidents and hazardous occurrences are reported, analysed and acted on
Reports with root causes that differ from the immediate cause, and actions that closed them
10. Maintenance
Whether inspections are held at appropriate intervals and critical equipment is identified and tested
The maintenance record with its overdue items, and standby equipment test records
11. Documentation
Whether valid documents are at the point of use and superseded versions have gone
Version control that works on board, not only ashore, and no obsolete copies in use
12. Verification, review and evaluation
The audit programme itself, auditor independence, and the management review
Internal audit reports with findings, and a review that changed something
13. Certification and verification
Validity, scope and endorsement of the certificates, and whether the ship matches what they describe
Current certificates matching vessel type, trade and the company named on them
The background to the Code itself and the certification cycle sits in our ISM compliance and SMS audit guide; this page assumes that and goes to the auditing.
Where findings actually cluster
Five elements produce the majority of findings, and they are the same five every year because they share a property: each one depends on something being done repeatedly and recorded at the time, rather than written once.
07
Shipboard operations
Checklists completed identically every time, which tells an auditor they were filled in afterwards. Real work produces variation; a run of identical forms is itself the evidence.
08
Emergency preparedness
Drills recorded but not exercised, the same scenario repeated, no shore element, and nothing written about what did not work. A drill where nothing went wrong was not a drill.
09
Reports and analysis
Root cause given as the immediate cause. “Crew error” closes nothing, recurs, and leaves the system unchanged while the paperwork says otherwise.
10
Maintenance
Overdue jobs with no approval behind them, and standby equipment that is not tested because it has never been needed. Both are documented in our guide to planned maintenance systems.
11
Documentation
A revision issued ashore and never reaching the bridge, superseded copies still in a folder, and two versions of the same procedure in use on sister vessels.
Where these accumulate they stop being an internal matter: a cluster of individual deficiencies can be written up as a failure of the safety-management system itself, which is how an inspection that started with small items ends in a detention. The mechanism is set out in our guide to the deficiencies behind detentions.
Evidence that exists because the work was done, not because an audit is coming
Marine Inspection records drills, checklists, maintenance and findings at the point they happen, with dates and names attached — which is the difference between an audit you prepare for and one you simply allow to happen.
Most internal audits are planned the way the manual is organised, chapter by chapter, which is the surest way to confirm that a system describes itself accurately. Four changes to how the audit is scoped do more for the finding rate than any amount of extra time on board.
Audit a trail, not a chapter
Pick one real operation that happened last month — a bunkering, an enclosed space entry, a crew change — and follow it through every element it touched: the procedure, the permit, the familiarisation of the people involved, the equipment used, the record afterwards. Gaps live between elements, and a chapter-by-chapter audit never crosses those joins.
Choose the vessel by exposure, not by rotation
Auditing each ship in turn spreads effort evenly over uneven risk. A recent change of management, a new trade, a crew that turned over completely, or a vessel that has just come out of a yard period all deserve attention ahead of the ship that is due.
Leave room between internal and external
An internal audit two weeks before the external one cannot produce corrective action, only corrections. Three months gives time to change something, verify that the change held, and arrive with a closed finding rather than an open one.
Ask the people who do the work
The officer who wrote the procedure will describe the system as intended. The rating who carries it out will describe it as operated, and the distance between those two accounts is where most of the real findings are. Neither is being dishonest.
None of this takes longer than a conventional audit. It takes the audit to different places, which is the only variable that changes what gets found — and you can book a demo to see how an audit trail is followed across the records it touches.
Auditing your own element
Element 4 is the awkward one, because the DPA cannot credibly audit it alone. The substance of the element is not whether a DPA has been appointed and named in the manual — that is a five-minute check — but whether the access it describes is real.
Is the direct line used, or only available?
A reporting line to the highest level of management that has never carried bad news is a line nobody has tested. Look for issues the DPA escalated and what the response was, in writing.
Does the DPA have the resources the role implies?
Time, access to vessels, and enough authority to stop something. A DPA role carried as a fraction of a commercial job is a finding waiting for an external auditor to notice it.
Do crews know who the DPA is and how to reach them?
Ask on board rather than checking the poster. A name on a notice that nobody has ever used is the same finding in a different place.
Who audits this element?
Somebody other than the DPA. A reciprocal arrangement with another operator, an external reviewer, or a suitably senior colleague outside the chain — and the arrangement itself is part of the independence evidence under section 12.
Writing a finding that survives
Most internal findings are weak in the same way: they describe an opinion rather than a situation. A finding that survives has three parts and loses none of them.
1
A statement of fact
What was seen, where, and when. “Three of the last six enclosed space entry permits were signed by the master after the entry had taken place” — not “permit control is weak”.
2
The objective evidence
The document, the record, the measurement or the observed condition, identified well enough that somebody else can go and look at the same thing.
3
The requirement it fails
The clause of the Code or the section of your own manual. A finding with no requirement behind it is an opinion, and it will be argued away rather than closed.
Closing out: correction is not corrective action
This is where internal audits most often fail quietly. The item gets fixed, the finding gets closed, and the same finding appears next year on a sister vessel — because what was addressed was the instance rather than the reason it was possible.
Correction
The permit is reissued, the extinguisher is serviced, the missing record is written up. Necessary, immediate, and on its own worth almost nothing.
Corrective action
Why it was possible for the permit to be signed late, and what changed so it cannot be. Usually a procedure that assumed somebody would be in two places at once.
Verification
Evidence at a later date that the change held. Closing on the promise of a change rather than on the change is how findings recur with a clean record behind them.
Fleet application
If it was possible on this vessel, it is possible on the others. A finding closed on one ship and never looked for on the rest is a finding that was half closed.
Each element with its own questions and the evidence expected against it, so an audit is carried out the same way on every vessel and the results compare.
Evidence captured where the work happens
Drills, checklists and maintenance recorded with dates, names and photographs at the time, which removes the reconstruction that produces identical forms.
Findings with their clause and their evidence
Statement of fact, evidence and requirement held together, so a finding arrives at the close-out in the shape it needs to be defended.
Close-out separated from correction
The immediate fix, the action taken against the cause and the later verification recorded as distinct steps rather than one tick.
Fleet-wide pattern visible to the DPA
The same finding appearing on three vessels shown as a pattern rather than three separate closures, which is the evaluation obligation doing real work.
Internal against external comparison
What your own audits found set beside what the external audit found, which is the only direct measure of whether the internal programme is working.
ISM internal audit: frequently asked questions
How often must internal ISM audits be carried out?
At intervals not exceeding twelve months, both ashore and on board, to verify that safety and pollution-prevention activities comply with the safety-management system. Twelve months is a maximum rather than a schedule, and vessels or trades with more exposure justify more frequent auditing.
Can the DPA audit the company’s own system?
Auditors should be independent of the areas being audited unless that is impracticable for the size and nature of the company. A DPA auditing the DPA element is the clearest conflict, and the usual answers are a reciprocal arrangement, an external reviewer, or a senior colleague outside that chain. The arrangement itself forms part of the independence evidence.
What is the difference between a non-conformity and a major one?
A non-conformity is a situation where objective evidence shows a specified requirement is not being met. A major non-conformity is a deviation posing a serious threat to people, the ship or the environment, or the absence of effective and systematic implementation of a requirement of the Code, and it calls for immediate corrective action.
What makes a finding defensible?
Three parts: a statement of fact describing what was seen, where and when; the objective evidence that supports it and can be examined again by somebody else; and the requirement it fails, cited from the Code or from your own manual. A finding missing the third part is an opinion and will be argued away.
Which elements generate the most findings?
Shipboard operations, emergency preparedness, reports and analysis, maintenance, and documentation. All five depend on something being done repeatedly and recorded at the time, which is where systems decay rather than where they are badly designed.
Why do the same findings come back every year?
Because the close-out was a correction rather than a corrective action. The instance was fixed and the reason it was possible was not, so it recurs — often on a sister vessel, where nobody thought to look after the first one was closed.
Before the external auditor
Make the awkward findings your own
Marine Inspection runs the thirteen elements as one consistent audit, keeps the evidence that findings rest on, and separates correction from corrective action and verification — so the internal report is the one that found the problem first.
