An internal audit answers one question: is the SMS being followed? Management Review asks a different, harder one: is the SMS actually working? A company can pass every internal audit and still have an SMS that's quietly failing to prevent the same problems — Management Review is where top management is required to notice that, and do something about it.
What You'll Learn in This Lesson
- What ISM Code Section 12 actually requires of a Management Review
- The real difference between an internal audit and a Management Review
- Exactly what evidence should feed into a genuine Management Review
- How to tell a real Management Review from a paperwork formality
- What top management is required to do once a review identifies a gap
The Legal Basis: ISM Code Section 12
Section 12 — "Company Verification, Review and Evaluation" — covers both internal audits (Lesson 5) and Management Review, and it's worth noting the exact wording change the IMO made in 2010: the requirement used to say the company should evaluate the "efficiency" of the SMS; it now says effectiveness. That's not a small wording tweak. Efficiency asks whether the system runs smoothly; effectiveness asks whether it's actually achieving its stated aims — the same three objectives from Lesson 1 (safety at sea, preventing injury and loss of life, and protecting the environment and property).
Section 12 also requires that audit and review results be brought to the attention of everyone with responsibility in the relevant area, and that management personnel take timely corrective action on whatever the review finds — not "eventually," and not only when the next external audit forces the issue.
Internal Audit vs Management Review
| Dimension | Internal Audit (Lesson 5) | Management Review |
|---|---|---|
| Core Question | Is the SMS being followed? | Is the SMS actually working? |
| Conducted By | Trained internal auditors, independent of the area audited | Top management, using audit and performance data as input |
| Frequency | At intervals not exceeding 12 months | Periodically, per company procedure — typically annually |
| Output | Findings classified as Observation, NC, or Major NC | A judgement on overall SMS effectiveness, and decisions on what must change |
A company can pass every internal audit with no Major Non-Conformities and still have an SMS that isn't effective — for example, if the same category of near-miss keeps recurring across different vessels without anyone asking why at a strategic level. That's precisely the kind of pattern only a Management Review, looking across the whole fleet, is positioned to catch.
What Should Feed Into a Management Review
Per IMO guidance, a genuine Management Review takes into account, at minimum:
Notice that Master's Reviews from Lesson 3 aren't a separate, disconnected requirement — they're one of the direct inputs a proper Management Review is required to consider. A DPA who collects Master's Reviews but never feeds them into an actual management-level discussion has completed the paperwork but missed the point of Section 12 entirely.
Download the Management Review Log Template (DOCX)
A structured template covering every input Section 12 requires, ready to use for your next annual review.
We'll also send you one maritime compliance update per week. Unsubscribe anytime.
Case Study: The Review That Changed Nothing
Scenario: A company holds its annual Management Review. The meeting covers all six required inputs. No decisions are recorded, no actions are assigned, and the same review format is repeated the following year with the same unresolved recurring near-miss pattern still present.
An auditor who finds this pattern — a review that covers every input but never changes anything — is looking at exactly the kind of "management review as formality" gap that separates a company that merely complies with Section 12 from one that's genuinely using it to run a safer operation.
Self-Check: Is Your Management Review Actually Effective?
1. Does your review explicitly consider Master's Reviews, not just audit results?
2. Are decisions and assigned actions actually recorded from the meeting?
3. Does the review look for recurring patterns across the whole fleet, not just one vessel?
4. Are external findings (PSC, RO, flag state) included alongside internal ones?
5. Would last year's actions actually be visible and checked at this year's review?
Is Your Management Review Just a Formality?
Talk to an IMT compliance advisor about strengthening your Management Review process under Section 12.
Contact an ExpertGet Certified in ISM Internal Auditing
IMT's ISM Internal Auditor Course covers Management Review requirements alongside the full audit lifecycle.
View the Course Talk to an AdvisorDownload Center
Everything from this article, in a format you can print, share, or file.
Frequently Asked Questions
What does ISM Code Section 12 require regarding Management Review?
That the company periodically evaluate the effectiveness of the SMS, act on what that evaluation shows, and communicate results to everyone with relevant responsibility.
What's the real difference between an internal audit and a Management Review?
An internal audit checks whether the SMS is being followed; a Management Review evaluates whether it's actually effective at achieving its aims.
Do Master's Reviews feed into Management Review?
Yes — Master's Reviews are one of the specific inputs a genuine Management Review is expected to take into account, not a separate, standalone requirement.
Is it enough to simply discuss all the required inputs at the review meeting?
No — Section 12 also requires timely corrective action on what the review finds. Covering the inputs without acting on them is a review in form only.
How often should a Management Review take place?
The ISM Code requires it periodically, per company procedure — most companies run it annually, often alongside their internal audit cycle.
Test Your Knowledge
5 questions · pass with 4/5 to unlock your Management Review certificate.
Congratulations!
Badge Earned — Management Review