When operators complete a rationalisation exercise and turn to the question of ISM SMS structure, the conversation almost always focuses on the same debate: which organisational model should the system follow? Department-based, TMSA-element, or digital with search?
These are legitimate questions. But they address the secondary problem. The primary problem is coherence — and no structural model solves it automatically.
The three models in use
Most SMS documentation in the tanker and bulk sectors has been built on one of two traditional foundations, often combined within the same system. The first organises by department: bridge and deck procedures in one document, engine room procedures in another, with a parent policy manual above both. The second organises by work function: cargo handling procedures split by vessel or cargo type, environmental management plans, emergency contingency documents. In practice these coexist — the departmental spine carries the operational procedures, and the work-function documents branch off it for cargo-specific and statutory requirements.
A third model is gaining ground in the tanker sector. Operators facing repeated TMSA office audits are restructuring their SMS around the twelve TMSA elements, reasoning that if the vetting framework uses that structure, the SMS should mirror it. A DPA can navigate directly to the relevant element when an auditor asks. The logic is sound from an audit management perspective.
None of these models is wrong. Each reflects a coherent answer to a specific question about who the SMS is primarily for.
What digital SMS adds — and doesn’t solve
The growing adoption of digital SMS platforms, built on HTML-style architecture with keyword search, has introduced a fourth navigational layer. Instead of working through a document hierarchy, a user searches for a term and the system returns every instance across the entire SMS. The findability problem, which has always been real, appears to be solved.
What search does not solve is what happens when the results disagree with each other.
A keyword search returns every place a term appears in the system. It does not adjudicate between them. If the navigation manual and the parent safety manual contain different language on the same duty or procedure — which, across the fleets I have audited, occurs more often than operators realise — a search result surfaces both. The crew member now has two answers and must decide which one governs, without any indication from the system that a conflict exists.
A search function finds every place the word appears in your SMS. It doesn’t tell the officer which one to follow.
The coherence problem
Internal contradiction is the failure that most commonly creates operational risk, and it is the one that survives every reorganisation exercise if the content itself has not been audited for consistency.
The typical pattern is generational. A parent manual is written at fleet formation. Departmental procedures are developed later, sometimes by different authors, and revised over time in response to incidents, PSC findings, or vetting observations. Each revision is locally coherent — it addresses the specific issue that prompted it. But no one has checked whether the revised procedure now says something different from what the parent manual established years earlier.
The result, when I examine SMS documentation alongside VDR and audit evidence, is a recognisable pattern. The crew are following a procedure — consistently, without hesitation — but it is not quite the procedure the parent manual describes. It matches a departmental document that was revised at some point after the main manual was last reviewed. The two documents have quietly diverged. Neither the Master nor the DPA has noticed, because the ship is operating normally and nothing has gone wrong. The divergence only becomes visible when something does go wrong, or when a vetting inspector asks the officer to walk through the procedure and then checks it against the SMS.
What vetting frameworks now require
SIRE 2.0 has changed the nature of this risk for tanker operators. Under the previous inspection model, a vetting inspector largely verified the existence of procedures. Under SIRE 2.0, inspectors ask crew to explain how procedures work and whether day-to-day operations reflect them. The conversation moves from documentation to practice.
An SMS with internal contradictions does not fail this test abstractly — it fails it specifically. The officer explains a procedure as he understands it. The inspector checks the SMS. If what the officer describes matches one document but not another, the operator has a verifiable gap. The coherence problem, which previously sat quietly inside the system, is now a vetting exposure.
For bulk operators, RightShip’s RISQ 3.2 — updated in November 2025 — applies the same logic through a different mechanism. The questionnaire requires that the Master’s standing orders and bridge instructions be drafted to actively support and align with the SMS. Where they diverge, the inspector records a finding. This is a direct coherence test built into the inspection framework itself. Bulk operators are still adjusting to what RISQ 3.2 requires in practice, and the coherence gap — documents that have drifted apart over successive revisions — is precisely where that adjustment is most difficult.
What this means for your ISM SMS structure
The question worth asking before the structure debate is a simpler one: for any given topic in the SMS, is there one definitive source, and does every other document that touches that topic agree with it?
If the answer is no, the rationalisation work is not finished. Tidying the ISM SMS structure without resolving the content conflicts underneath it produces a well-organised system that cannot be trusted under operational pressure — which is precisely when it needs to be trusted most.
What I observe in audit is that crews on well-managed vessels do consult their SMS for non-routine situations. What distinguishes those vessels is not which structural model the operator chose. It is that when a crew member finds the relevant procedure, he finds one answer. No secondary document suggests something different. The system speaks with one voice.
Whichever model an operator uses — departmental, TMSA-element, or digital with search — that is the standard worth building towards.
One topic, one authoritative source, consistent throughout.
