The TMSA Safety Audit: What Element 9 Stage 4 Actually Requires

Most ship managers can show that safety meetings happen. Minutes are filed, inspection forms are signed, the permit-to-work system is in place. That is Stage 1 of Element 9. It is not a TMSA safety audit.

A TMSA safety audit — conducted properly, at Stage 3 or Stage 4 — goes looking for something else entirely. It asks whether the safety infrastructure your company has built is actually driving decisions, or whether it is generating records that sit in a folder until the next inspection.

The distinction matters. OCIMF reviewers are not checking whether the form exists. They are checking whether the form is connected to anything.

What Element 9 and Element 9A Actually Cover

Element 9 in TMSA 3 is labelled Safety Management. In practice it covers three separate things: the risk assessment framework, the permit-to-work system, and the contractor management process. Element 9A, which runs alongside it, covers the safety inspection programme, the safety meeting structure, stop work authority, safety culture measurement, and leading and lagging indicator analysis.

These two elements are assessed together but they are not the same. Element 9 is largely about the control framework — the procedures and approval chains that govern hazardous work. Element 9A is about the culture infrastructure — the mechanisms through which safety awareness is built, measured, and improved over time.

Stage 4 requires both to be functioning, and functioning in a way that produces evidence of continuous improvement rather than evidence of compliance activity.

Stage 1 and Stage 2: What the Records Have to Show

At Stage 1, TMSA 9.1.1 requires that shore management visits include a safety element, and that a report follows with recommendations. The risk assessment system is documented (9.1.3) and the permit-to-work system is in place (9.1.4).

Stage 2 tightens the requirements considerably. Risk assessments must now be used for routine tasks to develop safe working procedures — not just to document that a hazard was considered (9.2.1). Non-routine and unplanned tasks must have their own assessments, and those assessments must be reviewed by shore-based personnel to confirm they are fit for purpose (9.2.2). Mitigation measures must be confirmed as complete before work commences (9.2.4).

On the 9A side, Stage 1 and 2 require the safety officer inspection programme to be running (9A.1.1), safety meetings to be held monthly with minutes recorded (9A.1.3), daily work planning meetings to be in place (9A.1.4), and stop work authority and toolbox talks to be actively used (9A.2.1).

The audit at this level is largely a records review. Does the inspection form exist? Were the meetings held? Are the permits completed? A company that reaches Stage 2 consistently has functioning documentation. It does not necessarily have a functioning safety system.

Stage 3: The Loop Has to Close

The move from Stage 2 to Stage 3 is where most tanker operators stall, and where a TMSA safety audit finds the most useful material.

At Stage 3, TMSA 9.3.1 requires that shore management formally reviews all risk assessments periodically — not to confirm they were completed, but to confirm they remain relevant. The review has to consider whether new legislation or equipment changes have made an existing assessment obsolete, whether manning level changes affect the risk picture, and whether tasks originally treated as non-routine have become standard practice and should be incorporated into the baseline procedures.

TMSA 9.3.2 introduces proprietary safety tools — behaviour-based safety systems, unsafe act awareness programmes, concentrated safety campaigns. These are not optional extras at Stage 3. They are the mechanism through which the company moves from reactive to proactive safety management.

On the 9A side, Stage 3 introduces two requirements that most operators underestimate. TMSA 9A.3.1 requires that best practices submitted by vessel personnel are reviewed, circulated to the fleet, and where appropriate incorporated into revised procedures. The loop has to close — a best practice that gets submitted and acknowledged is not the same as a best practice that changes how something is done.

TMSA 9A.3.2 requires that the company measures and compares the strength of safety culture across the fleet. The metrics specified are: near-miss reports, behaviour-based safety observations, incident-free days, best practices identified, hazards identified, unsafe acts identified, and safety suggestions. Results must be circulated to the fleet.

This is the requirement that most cleanly separates Stage 2 from Stage 3. A company that files safety meeting minutes has Stage 2 evidence. A company that tracks near-miss submission rates per vessel, compares them across the fleet, and can show that outliers prompted targeted action has Stage 3 evidence.

Stage 4: Leading Indicators, Fleet Benchmarking, and the Safety Trainer

Stage 4 in Element 9A has two requirements that distinguish it from everything below.

TMSA 9A.4.1 requires that leading and lagging indicators of safety performance are analysed both across the fleet and on an individual vessel basis, and that this analysis is used to identify weaknesses, prioritise vessels for targeted training, generate safety campaigns, and feed the results into the management review.

The distinction between leading and lagging indicators is critical here. Lagging indicators — lost time incidents, near-miss counts, PSC deficiencies — tell you what has already gone wrong. Leading indicators — stop work interventions, toolbox talk participation, unsafe act observations submitted voluntarily — tell you something about what the safety culture is doing before an incident occurs. TMSA 9A.4.1 requires both to be in play, and requires the analysis to be vessel-specific, not fleet-average.

A fleet-average near-miss rate of four reports per vessel per month tells an auditor very little. A vessel-by-vessel breakdown that shows one vessel submitting twelve reports and another submitting none — and an intervention plan that followed from that finding — tells an auditor that the system is working.

TMSA 9A.4.2 goes further. It requires fleet safety trainers to sail with vessels. These trainers must be experienced seafarers who are conversant with the SMS and capable of assessing safety culture onboard directly. While on board, they assess the current level of safety culture, identify weaknesses, reinforce company safety initiatives, and provide training or mentoring as required. A detailed report follows every visit, and the company analyses these reports to identify areas for improvement.

This is not a superintendent visit with a safety agenda item. It is a dedicated programme with its own resource requirement, its own reporting structure, and its own contribution to the management review cycle.

The Number That Exposes Stage 2 Thinking

In a TMSA safety audit focused on Element 9/9A, one data set tends to be more revealing than any other: near-miss submission rates by vessel, tracked over twelve months.

A vessel that submits near-miss reports at a consistent rate, month after month, with the numbers neither rising after a safety campaign nor falling after a quiet passage, has probably reached a reporting equilibrium. Reports are being submitted because the procedure requires them. The question is whether anyone is asking why the number is what it is.

A vessel that submits no near-miss reports for three consecutive months has either experienced an unusually safe period or has a reporting culture problem. TMSA 9A.3.2 and 9A.4.1 together require the company to be able to distinguish between these two situations — and to show what they did about it.

Stop work authority usage is the other indicator worth examining. If the stop work procedure exists in the SMS but no stop work interventions have been recorded across the fleet in six months, the audit has to ask whether the procedure is real or decorative. Stage 4 requires evidence that it is real.

What a Stage 4 Safety Audit Looks Like in Practice

A TMSA safety audit targeting Stage 4 in Element 9/9A will typically examine the following:

The risk assessment review cycle — not whether assessments exist, but whether shore management has formally reviewed them within the required period and whether the review produced any changes to the assessments or the procedures they underpin.

The best practice loop — whether best practices submitted by vessels have been circulated fleet-wide, and whether any have been incorporated into SMS revisions with a traceable procedure change record.

The near-miss and leading indicator data — vessel by vessel, not fleet-wide averages, and with evidence that the analysis fed into a specific decision: a targeted training visit, a safety campaign, a procedure change, or a flag to senior management.

The safety trainer programme — whether it exists as a standalone function with its own scheduling, reporting, and follow-up process, or whether safety training is absorbed into superintendent visits and never separately recorded.

The management review input — whether Element 9/9A data appears in the management review record in a form that drove a specific action, not as a summary line confirming that safety meetings were held.

The gap between Stage 2 and Stage 4 in Element 9 is not a documentation gap. The documentation is usually there. It is a loop closure gap — the difference between a safety system that collects information and a safety system that uses it.

VragaMarine conducts TMSA preparation reviews that examine Element 9 and 9A at the level of detail your next submission requires. Contact us to discuss what Stage 4 evidence looks like for your fleet.

More from the HSEQ Series