Every commercial ship has a safety management system. Accidents still happen, and when they are investigated the system almost always turns out to have been in place, documented and audited. This is about the gap between a safety system that exists and one that works, and about the training that closes it.
What a safety management system is supposed to do
The requirement is straightforward in principle. A company must have a documented system that identifies the hazards of its operations, establishes procedures to control them, assigns responsibility, provides for emergency preparedness, requires reporting and analysis of incidents and near misses, and is audited internally and externally.
A designated person ashore provides a direct line between the ship and the highest level of management, deliberately bypassing the commercial chain so that a safety concern cannot be filtered on the way up.
It is a good design. The failures are not usually failures of the design.
The four ways systems fail
Procedures written for the auditor rather than the user. A procedure that is twelve pages long and written in legal register will not be read on a pitching deck at two in the morning. Crews then develop their own working method, which may be perfectly sound and is now undocumented and untrained. The gap between work as imagined and work as actually done is the single most useful concept in this field.
Near misses that are not reported. A system with no near miss reports is not a safe operation; it is one where people have concluded that reporting creates problems for them. The organisations with the highest reporting rates are usually the safest, which is counter-intuitive until you think about what a report is evidence of.
Audits that check for documents. It is possible to pass an audit with a complete set of records describing an operation that does not happen. An audit that asks a rating to explain what they would do, rather than asking to see the signed form, finds different things.
Commercial pressure that is never stated. Nobody writes down that a ship should sail with a defect to make a berth window. The pressure is conveyed in tone, in what gets questioned and what does not. A master who believes a delay will be held against them is operating under a constraint the system does not acknowledge.
Where incidents actually cluster
Investigation data is consistent across decades about where harm occurs.
Enclosed spaces kill with a grimly repetitive pattern: an atmosphere assumed to be safe, a casualty, and then rescuers who enter without equipment and become casualties themselves. More people die attempting rescue than in the initial event. Nothing in safety training is more worth internalising than the instruction not to enter.
Mooring operations produce severe injuries from line failure and snap-back. The hazard is well understood, the zones are marked, and people stand in them because the job is routine and the deck is congested.
Working at height and over the side, where fall protection is available and not used because the job will only take a minute.
Machinery space fires, overwhelmingly caused by oil spraying onto hot surfaces from a fitting disturbed during recent work.
Navigation incidents, where fatigue, single-person watchkeeping and distraction appear repeatedly.
The common thread is not ignorance. In almost every case the people involved knew the rule. Understanding why knowing was not enough is the actual subject.
Drills: the difference between practice and theatre
Required drills are frequently performed as a documented sequence that everyone knows in advance, in daylight, in good weather, with the full crew available.
Real emergencies happen at night, in weather, with people missing and equipment not where it should be. A drill that never varies trains the crew to perform a drill.
Useful drills introduce realistic constraint: a key person unavailable, a route blocked, equipment declared failed, poor visibility. They are harder to run, they expose problems, and exposing problems is the point. The organisations that do this find out about their weaknesses on a Tuesday rather than during a casualty.
The survival and emergency subjects are worth taking seriously rather than treating as a box to tick. The Coastal Survival Techniques Course and the Survival course on the high seas cover the practical realities, and the Diploma in Open Ocean Survival goes considerably deeper for people operating far from assistance.
Medical response: the capability nobody has until they need it
A ship is frequently days from definitive medical care. The onboard medical capability is a few people with limited training, a prescribed medical locker and radio advice.
That combination handles a great deal, and it fails predictably in two situations: a serious trauma case, and a time-critical medical emergency such as a cardiac event. In both, the quality of the first twenty minutes determines the outcome, and that depends entirely on preparation made beforehand.
The Basic First Aid Course and the Advanced First Aid Course cover the clinical side at two levels, and the First aid kit and medical equipment on board course addresses the medical locker and equipment, which matters more than people expect: a well-stocked locker that nobody has inventoried or can find in the dark is not a capability.
The Master’s in International Maritime Health Security covers health security at a management level, which has become a distinct discipline since the operational disruption of recent years.
Crisis management: the part that is not technical
When something major happens, the technical response is usually the easier half. The harder half is decision-making under uncertainty with incomplete information, managing people who are frightened, communicating with shore, and sustaining an effort over hours or days.
This is a trainable skill and it is distinct from operational competence. Good crisis management looks like deliberate pace, explicit prioritisation, delegation, and regular re-evaluation of assumptions. Poor crisis management looks like the senior person doing a task that someone else could do while nobody is thinking about the next hour.
The Master’s in Crisis Management and Decision Making in Emergency Situations is built around this, and the Master’s in Maritime Safety and Rescue covers the coordination side for people moving into response roles. For engineers, the Master’s in Emergency Offshore Repairs addresses the specific problem of effecting repairs under emergency conditions.
Communication in an emergency deserves its own mention. The Emergency Communication Course covers it, and the recurring investigation finding is that information existed and did not reach the person who needed it.
The newer categories of risk
Cyber. Ship systems are increasingly networked and increasingly connected ashore. The exposure is both operational, where navigation and machinery control systems are affected, and commercial, where cargo and financial systems are targeted. Treating it as an IT problem rather than a safety one is the common error. The Master’s in Maritime Cybersecurity addresses it as the operational risk it is.
Security. Port facilities and critical infrastructure carry their own regime, with assessments, plans and designated officers. The Master’s in Port Security and Critical Infrastructure Protection covers this at a management level.
Data-driven safety. Using fleet-wide operational data to identify risk patterns before incidents occur. This is a genuinely new discipline and a growing shore career. The Master’s in Machine Learning for Maritime Safety sits here.
What actually improves safety
Five things, consistently, across operators that get good results.
Procedures written with the people who use them, short enough to be read and specific enough to be followed.
Reporting that is genuinely consequence-free, demonstrated by what happens after a report rather than by what the policy says.
Drills with realistic constraint, debriefed honestly, including the parts that went badly.
Leadership that notices safety when nothing has gone wrong. Attention only after incidents teaches people that silence is success.
Commercial pressure acknowledged explicitly, with clear authority for the master to decide and visible support when they do.
None of this is expensive. All of it is cultural, which is why it is harder than buying equipment.
Study, and what it does not replace
The mandatory basic and advanced safety training required for seagoing certification comes from approved centres under your flag state’s requirements. Nothing here replaces it, and if you need a certificate of that kind you must obtain it from a centre approved to issue it.
What academic study adds is the management layer: why systems fail, how to design procedures people follow, how to run an investigation that finds causes rather than culprits, and how to lead a response. That is a different and complementary thing, and it is what distinguishes a safety manager from someone who holds safety certificates.
Investigating properly: finding causes, not culprits
Most onboard investigations stop at the first satisfying answer, which is almost always a person. Human error is where an investigation should begin, not where it should end.
A useful investigation keeps asking why until it reaches something the organisation controls. The rating entered the space without testing it. Why? The meter was in the bosun’s store and the key was with someone ashore. Why was that normal? Because the procedure assumed equipment that the ship does not practically have available at short notice. That last finding can be fixed. “Crew member failed to follow procedure” cannot.
Two habits distinguish investigations that change anything. Separate the investigation from any disciplinary process. If the two run together, people manage their exposure instead of explaining what happened, and the organisation learns nothing. Look for the conditions, not the moment. Fatigue, workload, equipment availability, time pressure and unclear responsibility are the conditions under which capable people make predictable mistakes.
The test of an investigation is simple: does it produce a corrective action that would have prevented the event, and could that action survive the person who proposed it leaving the company?
Fatigue: the factor in almost everything
Fatigue appears in a remarkable proportion of casualty reports and is the hardest factor to address, because the pressures that produce it are commercial and structural.
Reduced manning, intensive port rotations, administrative load, interrupted rest and watch patterns that fight human circadian rhythm all combine. The rest-hour regime exists to limit this and is widely acknowledged to produce records that are more optimistic than reality.
What makes fatigue insidious is that impaired people are poor judges of their own impairment, and the first capability to degrade is exactly the one needed to notice: situational awareness and the ability to anticipate. A fatigued watchkeeper does not feel incapable. They feel fine and respond late.
There is no training solution to a manning problem. There is, however, a real difference between an operator that treats rest hours as a record to be completed and one that treats them as a constraint on what can be scheduled.
Reporting culture, in practice
Every company says it wants near-miss reports. The crews decide whether that is true by watching what happens to the first person who files one.
If a report produces an investigation into the reporter, reporting stops within a month and does not restart. If it produces a visible change, a repaired item, an amended procedure, a hazard removed, reporting rises and keeps rising.
The practical measures that work are unremarkable: make reporting take two minutes rather than twenty, close the loop by telling the fleet what changed, and distinguish clearly between error, which is to be learned from, and deliberate violation, which is not. The last distinction is what makes a no-blame policy credible rather than naive.
One honest note on recognition
Recognition of a qualification depends on the programme completed and on the regulations of each country. The programmes referenced here are professional training; they are not statutory certificates of competency, and they do not replace one where a flag state or regulator requires it. If the role you want is gated by a specific certificate or professional body, check what that body requires before choosing a programme. Our recognition and accreditations page sets out more detail.
Where to go next
Fees and start dates are published on every programme page, and the course catalogue, diploma catalogue and master’s catalogue let you compare side by side. Study is online, and each programme page shows its next start date.
If you would rather talk it through, the application process starts with a short form and a conversation with an academic adviser, normally within 24 to 48 hours, at no cost and with no obligation.
Related reading: nine maritime careers you can move into from sea and decarbonising shipping: rules, levers and careers.