A company can write a flawless SMS manual and still have no way of knowing whether it actually works — unless someone independently checks. That's what audits are for: internal audits catch gaps before an external auditor ever boards, and external audits are what keeps the DOC and SMC certificates themselves valid. This lesson covers both, and what real audit evidence actually looks like.
What You'll Learn in This Lesson
- The difference between an internal audit and an external audit, and why both exist
- The real DOC and SMC audit schedule — Initial, Annual/Intermediate, and Renewal
- What the full audit lifecycle looks like, from planning to verification
- What objective evidence actually looks like, in practice
- How to respond professionally when an auditor asks you to demonstrate something directly
Why Audits Exist in the ISM Code
The ISM Code doesn't just require a company to write an SMS — it requires ongoing, independent verification that the system is genuinely functioning. Section 1.4's sixth functional requirement (Lesson 2) specifically mandates procedures for internal audits and management review, and Section 13 governs the external certification audits that keep the DOC and SMC valid. Without both layers, a company could have perfect paperwork and no real evidence it reflects what happens on board.
Internal Audits
An internal audit is the company checking its own SMS, independently of the department being audited.
| Element | What It Means in Practice |
|---|---|
| Purpose | Catch SMS gaps before an external auditor does; verify the system is functioning, not just documented |
| Frequency | At intervals not exceeding 12 months |
| Independence | The auditor must not audit their own work — a deck officer shouldn't audit the deck department they run |
| Audit Planning | An annual audit plan or schedule, covering every SMS element across a defined cycle |
| Audit Checklist | A structured checklist mapped to SMS chapters and ISM functional requirements (Lesson 2) |
| Closing Meeting | Findings are presented to those audited before the auditor leaves — no surprises in the written report |
External Audits
External audits are conducted by the flag state or a Recognized Organization acting on its behalf, and they follow a defined certification schedule for each certificate:
| Certificate | Audit Type | Timing |
|---|---|---|
| DOC (company) | Initial Audit | Before the DOC is first issued |
| Annual Audit | Within ±3 months of the DOC anniversary date | |
| Renewal Audit | Every 5 years, before expiry | |
| SMC (vessel) | Initial Audit | Before the SMC is first issued |
| Intermediate Audit | Between the 2nd and 3rd anniversary of the SMC | |
| Renewal Audit | Every 5 years, before expiry |
An Additional Audit can also be triggered outside this schedule — for example, following a major incident, a change of Recognized Organization, or the addition of a new ship type to an existing DOC. And critically, per Lesson 4: if a Major Non-Conformity is raised during any of these audits, the SMC or DOC can be withdrawn until it's resolved.
Download the Internal Audit Checklist (PDF)
A structured checklist mapped to every ISM Code functional requirement, ready to adapt for your own internal audit programme.
We'll also send you one maritime compliance update per week. Unsubscribe anytime.
The Audit Timeline
Notice that Verification is the final step, not Findings — an audit isn't complete when a gap is found, it's complete once the fix is confirmed to actually work, echoing the Corrective Action Lifecycle from Lesson 4.
Objective Evidence: What Auditors Actually Ask to See
Objective evidence means information that can be verified — not a verbal assurance. In practice, that means:
Auditor Interview Examples
Every one of these asks for something demonstrable — a record, a walkthrough, a physical action — not a description of policy. That's the same "explain your reasoning" principle covered in SIRE 2.0's Human Factors lesson: auditors across regimes are testing whether the crew genuinely knows the process, not whether they can recite it.
Exercise: Would an Auditor Accept This Evidence?
Answer Accept or Reject for each scenario, then check your answers for an explanation.
1. The Chief Officer verbally confirms that all permits were reviewed this month, with no forms produced.
A verbal assurance isn't objective evidence — the completed permit forms themselves are what's needed.
2. A signed, dated enclosed space entry drill record from three weeks ago, matching the drill schedule.
This is exactly what objective evidence looks like — verifiable, dated, and matching the required schedule.
3. A crew training record listing only course titles, with no dates or signatures.
Without dates or signatures, this record can't actually be verified against when training happened or who received it.
4. A near-miss report, logged the same day, with a documented follow-up action and closure date.
Complete, timely, and traceable to closure — this is strong objective evidence.
5. A maintenance record showing a critical piece of equipment serviced two months after its scheduled date, with no explanation logged.
The record exists, but the unexplained delay itself is likely to generate a finding — evidence needs to demonstrate compliance, not just existence.
Preparing for an Upcoming DOC or SMC Audit?
Talk to an IMT compliance advisor about an independent pre-audit readiness review.
Contact an ExpertGet Certified in ISM Internal Auditing
IMT's ISM Internal Auditor Course covers the full audit lifecycle, evidence standards, and real interview scenarios in depth.
View the Course Talk to an AdvisorDownload Center
Everything from this article, in a format you can print, share, or file.
Frequently Asked Questions
How often must internal audits be conducted?
At intervals not exceeding 12 months, covering every element of the SMS across a defined audit cycle.
What's the DOC audit schedule?
An Initial Audit before first issue, an Annual Audit within ±3 months of the anniversary date, and a Renewal Audit every 5 years.
What's the SMC audit schedule?
An Initial Audit before first issue, an Intermediate Audit between the 2nd and 3rd anniversary, and a Renewal Audit every 5 years.
What counts as objective evidence?
Verifiable information — records, signed forms, dated logs — not a verbal assurance that a process was followed.
What happens if a Major Non-Conformity is found during an external audit?
The SMC or DOC can be withdrawn until the Major Non-Conformity is resolved.
Test Your Knowledge
5 questions · pass with 4/5 to unlock your Internal & External Audits certificate.
Congratulations!
Badge Earned — Internal & External Audits