The Definitive Guide to ISM Compliance for Superyachts

The International Safety Management Code sits at the centre of every serious yacht operation. A well-maintained Safety Management System is not just a flag-state requirement — it is a living framework that governs how your vessel responds to emergencies, how your crew is trained, and how auditors judge the professionalism of your organisation. This guide walks through what the ISM Code demands, how roles and responsibilities are divided, what document management looks like in practice, and how to avoid the deficiencies that most commonly result in Port State Control detentions.

What the ISM Code Is and Who It Applies To

The ISM Code — formally adopted by the International Maritime Organization (IMO) under SOLAS Chapter IX — establishes an international standard for the safe management and operation of ships and for pollution prevention. Originally written for commercial shipping, it has been extended to the superyacht world and is now a foundational compliance requirement for most vessels operating internationally.

Mandatory ISM applicability under SOLAS covers vessels of 500 GT or more engaged on international voyages, as well as high-speed craft, mobile offshore drilling units, and vessels carrying passengers. However, many flag states have extended the obligation to smaller yachts — particularly those operating commercially or under a charter licence. Even for purely private yachts below the SOLAS threshold, an SMS based on ISM principles is widely regarded as best practice and is expected by many charterers, underwriters, and port authorities.

The two certificates that demonstrate ISM compliance are:

• Document of Compliance (DOC) — issued to the shipping company or management organisation, confirming that its shore-based Safety Management System meets ISM requirements.
• Safety Management Certificate (SMC) — issued to the individual vessel, confirming that the vessel's SMS operates in accordance with the verified company SMS.

Both certificates are issued by the flag state (or a recognised organisation acting on its behalf) and are subject to regular audits. Letting either lapse has immediate commercial and legal consequences: the vessel cannot legally trade, and P&I cover may be void.

Safety Management System Requirements

The ISM Code does not prescribe exactly how an SMS must look — it prescribes what it must achieve. Your SMS must address each of the following functional areas:

• Safety and environmental protection policy — a written statement of the company's commitment to safe operation and pollution prevention, signed by senior management.
• Instructions and procedures — covering all key operations: navigation, cargo handling (or guest operations), maintenance, emergency procedures, and crew welfare. These must be task-specific and written so the person performing the task can follow them without additional instruction.
• Defined levels of authority and communication — who makes decisions, who is notified, and how shore-side management is contacted during both routine operations and emergencies.
• Emergency preparedness procedures — documented plans for fire, flooding, man-overboard, medical emergencies, and other foreseeable scenarios. These must be rehearsed through regular drills.
• Non-conformity and hazardous occurrence reporting — a mechanism for crew to report near-misses, accidents, and SMS failures without fear of reprisal, feeding into continuous improvement.
• Maintenance procedures — ensuring the vessel and its equipment are maintained in accordance with applicable regulations and manufacturer requirements, with documented records.
• Internal audits and management review — a scheduled programme of internal self-assessment to verify that the SMS is being followed and is effective, with outcomes reported to shore management.

A critical point auditors check is whether the SMS is actually used on board, not just filed in a binder. Evidence of use — completed checklists, drill records, non-conformity reports — is what distinguishes a working SMS from a paper one.

Roles: DPA, Master, and Crew

The ISM Code requires a clear allocation of responsibilities between the shore organisation and the vessel. Three roles are central:

The Designated Person Ashore (DPA) is the key link between the vessel and company management. The DPA must have direct access to the highest level of management and is responsible for monitoring the safety and pollution-prevention aspects of each vessel. The DPA is not responsible for operational decisions — that responsibility remains with the Master — but is responsible for ensuring that adequate resources and shore-based support are available. The DPA must be named in the SMS and their contact details available on board at all times.

The Master has overriding authority on board and is responsible for implementing the SMS in practice. This includes ensuring that all crew are familiar with the SMS, that drills are conducted and recorded, and that non-conformities and hazardous occurrences are reported. The Master also has the authority — and the duty — to deviate from any procedure if safety requires it, provided that the DPA is informed.

The crew are not passive recipients of the SMS. Each crew member must be familiar with the procedures relevant to their duties, must participate in drills, and must know how to report safety concerns. Familiarisation on joining is an ISM requirement, not optional — and it must be documented.

Document Management Under ISM

The ISM Code requires that documents and data essential to the SMS are controlled. This means that crew on board must always be working from the current version of any procedure, and that obsolete documents are removed from use. In practice, document control is one of the most frequently cited deficiency areas — not because operators do not have procedures, but because version management breaks down over time.

Your SMS documentation framework typically includes:

• The Safety Management Manual (the core SMS document, issued to vessel and ashore)
• Vessel-specific procedures and instructions (may be part of the manual or a separate technical manual)
• Forms and checklists used to record SMS activities (drills, inspections, risk assessments, maintenance rounds)
• Records of completed activities (completed forms, drill reports, non-conformity reports, internal audit reports)
• Statutory certificates and endorsements (DOC, SMC, ISSC, Load Line, etc.)

Records must be retained for a period specified by the flag state — commonly at least two to three years — and must be available for inspection by Port State Control officers. The shift to digital record-keeping has significantly reduced the risk of version drift and lost records, provided the chosen system maintains an audit trail.

The Audit Cycle: Internal Audits, Flag State Audits, and Certificate Renewal

ISM compliance is not a one-time achievement. It requires a regular cycle of self-assessment and third-party verification.

Internal audits must be conducted at intervals not exceeding twelve months. The purpose is to verify that the SMS is being implemented as designed, that crew are familiar with procedures, and that records are being maintained correctly. Internal audits should be conducted by someone independent of the area being audited — typically the DPA or a nominated senior manager — and findings must be documented and followed up.

Flag state audits — conducted by the flag administration or an RO (Recognised Organisation) — take place at initial certification and then on a periodic and intermediate basis throughout the five-year certification cycle. An initial audit verifies that the SMS is in place and is being implemented. Periodic audits (typically every five years) renew the DOC and SMC. Intermediate audits (typically between the second and third year of the cycle) check that no major changes have occurred and that the SMS remains effective.

DOC and SMC renewal requires a successful periodic audit and the submission of renewal applications to the flag state. It is the DPA's responsibility to track expiry dates and initiate the process well in advance — most flag states and ROs recommend beginning preparation at least three to six months before expiry.

Common ISM Deficiencies Found During Port State Control

Port State Control (PSC) officers board vessels to check compliance with international conventions, and ISM is a primary area of focus. The most common ISM-related deficiencies seen during PSC inspections fall into a few recurring categories:

• Drills not conducted or not recorded. PSC officers will ask to see drill records. If fire, lifeboat, or abandon-ship drills are overdue — or if records are incomplete — this is a straightforward deficiency. Monthly and quarterly drill requirements must be tracked rigorously.
• Crew unfamiliar with emergency procedures. Officers will conduct verbal assessments of crew. Crew members who cannot describe the muster station process, emergency signals, or their own duties are a red flag — regardless of what the SMS manual says.
• Outdated or unchecked SMS manuals. If the manual on board is a different version from the one held ashore, or if amendments have not been distributed and acknowledged, the document control system has failed. This is one of the most common findings.
• Non-conformity reports not raised or closed. If defects and near-misses are occurring but no NCR system is in use, PSC will question whether the SMS is functional. Equally, open NCRs with no follow-up action are a compliance failure.
• DPA contact details not posted or not accessible. A minor but easily avoidable deficiency. DPA name and 24-hour contact must be posted on board and available to all crew.
• Certificates expired or not on board. DOC, SMC, and other statutory certificates must be valid and physically on board (or held in an accessible digital format acceptable to the port state).

Building and Maintaining a Living SMS

The most effective SMS documents are not static binders updated only before audits. A living SMS evolves continuously as the vessel's operations change, as new risks are identified, and as lessons are learned from non-conformities and incidents.

Practically, this means establishing a review cadence: DPAs should review each vessel's SMS at least annually, with more frequent reviews when there are changes in trading area, crew complement, operational profile, or applicable regulations. Management reviews — where DPA, Master, and senior management assess the overall effectiveness of the SMS — should be documented and their outcomes actioned.

Change management within the SMS must be controlled. When a procedure is updated, the revision must be distributed to the vessel, acknowledged by the Master, and old versions removed. This sounds straightforward but in practice — with crew rotations, multi-vessel fleets, and documents stored in multiple locations — it is one of the most common points of failure.

Training records are part of the living SMS too. Crew familiarisation on joining, STCW training, and vessel-specific training must all be documented and accessible. When PSC asks whether a recently joined engineer has been familiarised with emergency procedures, your answer must be supported by a signed record — not a verbal assurance.

Next Steps for Your SMS

ISM compliance is not a project with an end date — it is an ongoing operational discipline. The vessels that perform well at PSC inspections and sail through flag state audits are not the ones with the most elaborate manuals; they are the ones where the SMS is genuinely integrated into daily operations, where drills happen on schedule, where crew know their roles, and where deficiencies are reported and resolved as a matter of routine.

For DPAs and yacht managers, the practical priority is to remove the friction that makes compliance difficult: manual document distribution, paper drill forms, certificate expiry tracked in spreadsheets, and non-conformity reports that disappear into email threads. Each of these friction points is a gap between your SMS on paper and your SMS in practice — and it is those gaps that PSC and flag state auditors are trained to find.

If you are reviewing your current SMS framework, a useful starting point is to audit your records for the past twelve months: are drill records complete? Are all certificates current? Have any NCRs been raised and closed? The answers will tell you where your SMS is working and where it needs reinforcement.

Requirements vary by flag state; always confirm with your flag administration or recognised organisation.