The SMS Defensibility Gap: How Tribunals Assess Shore Management Control Against Shipboard Reality

A Safety Management System is not defensible simply because the procedure exists. It must also be realistic, applied on board, monitored ashore, and supported by an honest evidence trail.

1. Introduction: The Gap Between the Manual and the Operation

Following a grounding, collision, cargo incident, or machinery failure, the first attention normally falls on the vessel. Investigators examine the actions of the Master, the officer of the watch, the bridge team, or the officers responsible for the cargo operation. They review the VDR, ECDIS records, radar information, logbooks, permits, checklists, and the sequence of decisions immediately before the event.

As the investigation develops, however, the questions do not remain on board. Attention also moves ashore. What instructions had the company issued? Were they practical for the vessel and trade? What did the DPA and marine superintendent know? Were repeated warning signs identified? Did the office provide support when the Master reported an operational difficulty, or was the vessel simply expected to "make it work"?

This is the SMS defensibility gap: the distance between what the Safety Management System says should happen and what the company actually knows is happening on its ships.

From my own experience at sea and later in shore management, the problem is rarely the complete absence of a procedure. More often, the procedure exists, but it is too generic, too complicated, or disconnected from the real operation. The forms may be completed and the audit may be closed, while the underlying risk remains unchanged.

In a maritime dispute, that difference matters. A tribunal, court, insurer, P&I Club, or investigating authority may look beyond the signature on the checklist. The real question is whether the company exercised effective control and provided an SMS that could reasonably be followed under the actual conditions faced on board.

2. The Legal and Operational Context

The ISM Code requires the company to designate a person or persons ashore with direct access to the highest level of management. The DPA has an important monitoring and escalation role, including monitoring the safety and pollution-prevention aspects of ship operations and ensuring that adequate resources and shore-based support are provided when required.

This does not mean that every mistake made on board automatically becomes the personal act of the DPA or senior management. Questions concerning corporate knowledge, authority, causation, limitation of liability, seaworthiness, or the privity of the assured depend on the applicable law, the contract, the corporate structure, and the facts of the particular case.

For example, Article 4 of the Convention on Limitation of Liability for Maritime Claims applies a demanding test before a person loses the right to limit liability. A weak SMS or an ineffective audit may be highly relevant evidence, but it does not automatically satisfy every legal test in every dispute.

The practical point is simpler: once the company relies on its SMS as evidence of due diligence and proper management, the written procedure is open to examination. The reviewer may ask whether it was vessel-specific, workable, properly communicated, consistently monitored, and supported by action from ashore. A manual that looks satisfactory during an audit may become difficult to defend when it is compared with the vessel records and the actual conduct of the operation.

3. Where the SMS Defensibility Gap Develops

A. Generic procedures and administrative overload

Many systems grow by addition. A new incident occurs, a new checklist is introduced. An audit finding is raised, another form is added. A regulation changes, several pages are inserted into the manual. Over time, the SMS may become so large that officers cannot easily identify which controls are critical and which records are genuinely required.

This becomes more serious when the system is based on a generic template that has not been properly adjusted to the vessel type, equipment, manning level, and trading pattern. A procedure written for a tanker cannot simply be transferred to a bulk carrier or container vessel by changing the heading. The operational sequence, risk controls, responsible officers, and available resources may be completely different.

When the paperwork requires more time than the operation reasonably allows, crews start completing records after the event or copying previous entries. The signature remains, but the record no longer proves that the control was applied at the correct time. In a dispute, this may weaken the company position rather than protect it.

B. Written limits that do not match the trading reality

Under-keel clearance is a useful example. A company may establish a clear minimum UKC policy, which is necessary. The difficulty arises when the vessel is regularly ordered to ports or channels where compliance with the stated percentage is not possible without an agreed exception, a documented risk assessment, and defined additional controls.

The Master should not be placed in a position where the written SMS says one thing while the commercial expectation from ashore says another. Informal comments such as "the pilot does it every day" or "other vessels enter with the same draft" do not replace a proper assessment of chart accuracy, tide, squat, density, wave response, speed, manoeuvring margin, and local restrictions.

If the company accepts the trade, it must also provide a clear process for managing an operational condition outside the normal limit. Otherwise, after an incident, the written rule may appear to protect the office while the evidence shows that the vessel was routinely expected to operate differently.

C. Audits that verify documents but not practice

A navigation audit may find that the passage plan is signed, the familiarisation forms are complete, and the parallel-indexing requirement is written in the SMS. This is useful, but it is not enough if the audit never checks how the bridge team actually navigates.

A review of VDR data, radar trails, ECDIS history, position-fixing records, or the conduct of a live passage may show that parallel indexing was not used, safety settings were changed without control, or the bridge team relied mainly on a single source of position. The gap is not created by one missed tick. It is created when the same weak practice continues over time without being detected or corrected by the company monitoring process.

D. Treating human error as the end of the investigation

A poor decision by the Master or an officer must be examined, but it should not automatically end the analysis. The next questions are often more important: Was fatigue involved? Was the vessel short of competent personnel? Was the port rotation realistic? Had similar concerns been reported? Were previous findings closed only on paper? Did commercial pressure influence the decision?

The Master remains responsible for the safe conduct of the vessel, but the company also has responsibilities. A balanced investigation examines both. Blaming the individual without examining the system may produce a convenient conclusion, but it may leave the real cause in place.

4. What the Evidence Trail May Reveal

In a serious dispute, the SMS is rarely assessed in isolation. It is compared with the operational records created before, during, and after the event. The strength of the company position often depends on whether these records tell a consistent story.

A. VDR, ECDIS, radar, and bridge communications

The VDR can provide important evidence of bridge communications, alarms, orders, and the working relationship within the bridge team. ECDIS and radar information may show the vessel track, safety settings, use of parallel indexing, position monitoring, and the timing of alterations. These records do not always provide a complete picture, but they may confirm or contradict the written passage plan and the statements given after the event.

A company may state that it promotes challenge and closed-loop communication. If the recorded bridge environment shows that junior officers were consistently discouraged from speaking, the question becomes whether this was an isolated event or a wider condition that effective audits, appraisals, training, or onboard visits should have identified.

B. Non-conformities, near misses, and defect reporting

An empty non-conformity register is not necessarily proof of an excellent safety culture. In some cases, it may show that the reporting threshold is unclear, the crew does not trust the process, or reports are discouraged because they may create delay, cost, or additional work.

A defensible system does not require a fleet to appear perfect. It requires the company to identify problems, assess them honestly, provide resources, and verify that corrective action has worked. A reasonable number of well-managed reports may demonstrate stronger control than several years of records showing no meaningful operational findings at all.

C. Work and rest hours compared with the real operation

Work and rest-hour records are often examined against deck logs, engine-room logs, port logs, cargo records, pilot times, drills, meetings, permits, and communications. Where the operational timeline shows continuous attendance but the rest-hour record shows full compliance, the discrepancy requires explanation.

The shore office is not expected to detect every individual error immediately. However, repeated or obvious contradictions accepted month after month may suggest that the monitoring process was ineffective. The issue is not only whether the record was inaccurate, but also whether the company had a reasonable system to identify and address inaccurate records.

D. Emails, messages, and informal instructions

Important operational decisions are increasingly discussed through email, messaging applications, and telephone calls. These communications may show whether the Master requested support, raised a concern, or sought approval for an exception. They may also show whether the office gave a clear decision, asked for a proper risk assessment, provided resources, or applied pressure without leaving a formal record.

For this reason, a company should avoid managing safety-critical exceptions only through informal verbal instructions. Where a decision affects a stated SMS limit, the reasoning, controls, responsibilities, and approval should be properly recorded.

E. Corrective actions and evidence of closure

A corrective action is not complete because a form has been signed or a circular has been sent to the fleet. Closure should demonstrate that the cause was understood, the required action was taken, and the new control was checked in practice.

For a navigation finding, this may require a revised procedure, focused training, correction of the passage plan, and later verification through a follow-up review. For a maintenance finding, it may require spare parts, repair records, testing, and confirmation that the defect has not reappeared. The evidence of verification is often what distinguishes a working management system from a paper response.

5. The Practical Role of the DPA and Shore Management

The DPA cannot stand every bridge watch, supervise every cargo operation, or personally check every record produced by the fleet. Effective control does not mean continuous interference with the Master. It means establishing a reliable system for receiving information, recognising warning signs, escalating serious issues, and ensuring that the vessel receives the support and resources required.

The DPA should be able to distinguish between an isolated shipboard mistake and a repeated weakness that may exist across the fleet. Repeated PSC deficiencies, recurring navigation findings, unrealistic rest-hour patterns, delayed defect reports, and corrective actions repeatedly closed with the same wording are all indicators that may require closer examination.

The office must also respond properly when a Master raises a safety concern. The response should be timely, clear, and recorded. Where commercial and safety considerations conflict, the Master should not be left to carry the full responsibility for a decision that was materially shaped by instructions or expectations from ashore.

At the same time, the DPA should not become the routine decision-maker for matters that remain within the Master's command. The objective is not to weaken the Master's authority. It is to ensure that the Master has a workable system, clear limits, an effective escalation route, and genuine shore support when the situation requires it.

6. Building an SMS That Can Be Defended

Keep critical procedures concise and vessel-specific

Critical procedures should clearly identify the hazard, the minimum controls, the responsible person, the stop-work conditions, and the required evidence. Supporting guidance can remain available, but the officer carrying out the task should not have to search through several manuals to understand the essential steps.

Create a controlled route for operational exceptions

Marine operations are dynamic. Conditions will sometimes fall outside a normal company limit. The SMS should explain who must be informed, what assessment is required, who may approve the exception, what additional controls must be applied, and how the decision is recorded. A controlled exception is safer and more defensible than an unofficial practice that everyone knows but nobody documents.

Test the operation, not only the paperwork

Internal audits and superintendent visits should include practical verification. This may involve observing an operation, reviewing selected VDR or ECDIS data where appropriate, checking whether records match the operational timeline, interviewing junior officers, and following a previous corrective action through to actual completion.

Use data to identify repeated weaknesses

A single finding may be local. The same finding across several vessels may indicate a fleet-level problem. Shore management should be able to identify repeated deficiencies by subject, vessel type, responsible department, and root cause. This allows the company to correct the system rather than issuing the same reminder repeatedly.

Protect honest reporting

Masters and officers must be able to report defects, fatigue, unsafe pressure, and procedural difficulties without fearing automatic blame. This does not remove accountability. It improves the quality of the information available to management. A company cannot manage a risk that its own reporting culture keeps hidden.

Close the loop with verifiable evidence

Every significant corrective action should answer three questions: What was changed? Who verified the change? What evidence shows that the change worked? When these questions are answered properly, the SMS becomes stronger operationally and easier to explain if later examined in a dispute.

7. Conclusion

A Safety Management System is not judged only by the quality of its wording. Its real value is shown by what happens on board, how the office responds, and whether the records honestly reflect the operation.

The most defensible companies are not necessarily those with the largest manuals or the fewest reported problems. They are the companies that can show a clear connection between procedure, shipboard practice, shore monitoring, corrective action, and verification.

When an incident occurs, the question will not be limited to whether the Master or officer departed from a written instruction. The wider examination may include whether the instruction was workable, whether the company knew of recurring difficulties, whether adequate support was provided, and whether earlier warning signs were properly acted upon.

An SMS should work during the actual operation — at night, under commercial pressure, with limited time and imperfect conditions. If it works only during an audit, the gap between the manual and the vessel remains open. That is the gap that shore management must close before an incident, not attempt to explain afterwards.

About the Author

Capt. Georgios Giannakouris is a Master Mariner (Class A) with more than three decades of maritime experience, including command on tankers and LPG carriers, followed by senior shore-based responsibilities as a Designated Person Ashore, Marine Superintendent, and marine operations manager. He is the Founder and Managing Director of OMRA — Operational Maritime Risk Advisory and an Associate Member of the Chartered Institute of Arbitrators (ACIArb). His work focuses on maritime operational risk, evidence review, incident analysis, SMS implementation, navigation, and dispute support.

Contact: george@omra-advisory.com | www.omra-advisory.com

Disclaimer

This article provides general information from a maritime operational and safety-management perspective. It does not constitute legal advice, legal representation, or an opinion on any particular casualty, claim, or dispute. Legal advice should be obtained for the facts and applicable law of a specific matter.