Internal & External Audit of ISM

 Under the International Safety Management Code, audits are conducted to verify that the Safety Management System (SMS) is effectively implemented and maintained.

Internal Audit (Company Audit)

✅ What is it?

An audit conducted by the company itself to verify that ship and office comply with the SMS.

✅ Who Conducts?

• Company’s designated auditor

• Independent of the area being audited

• Appointed by company management

✅ Frequency

• At least once every year

• As per company SMS procedures

✅ Purpose

• Check compliance with SMS

• Identify non-conformities

• Improve safety system before external audit

• Prepare ship for external audit

✅ What is Checked?

• SMS implementation onboard

• Records & documentation

• Drill performance

• Maintenance system (PMS)

• Risk assessments

✅ Outcome

• Internal audit report

• Corrective actions raised

• Follow-up verification

👉 Internal audit is a self-check system.

External Audit

✅ What is it?

Audit conducted by Flag State Administration or Recognized Organization (RO) on behalf of flag.

✅ Based on

Verification under ISM Code requirements issued by the International Maritime Organization.

✅ Types

• Initial Audit

• Intermediate Audit

• Renewal Audit

• Additional Audit

✅ Purpose

• Verify compliance for issuing/renewing:

  • DOC (Document of Compliance) – for company

  • SMC (Safety Management Certificate) – for ship

✅ Outcome

• Issue or renewal of certificates

• Minor or Major Non-Conformities

• Possible detention if serious failure

👉 External audit is a regulatory compliance check.

Key Differences 

Internal Audit	External Audit
Done by company	Done by Flag/RO
Self-evaluation	Statutory verification
Annual	As per certification cycle
Improves system	Certifies system
No certificate issued	Leads to DOC/SMC issue

Internal audit is conducted by the company to verify effective implementation of the SMS and identify improvements. External audit is carried out by the Flag State or Recognized Organization to verify compliance with the ISM Code and to issue or renew statutory certificates like DOC and SMC.