Risk management in the national system

On 1 June 2025, we are introducing new requirements for safety management systems (SMS).

These changes affect all domestic commercial vessels. Find out what you need to do.

The changes relate to fatigue management, drugs and alcohol, operational procedures and more.

Check if your vessel is eligible for the new, simplified SMS. 

If you're updating an existing SMS or developing a new SMS, follow the guidance below and the guidance about the changes so you comply on 1 June 2025.

The Marine Safety (Domestic Commercial Vessel) National Law Act 2012 (the national law) provides a single national framework for ensuring the safe operation, design, construction and equipping of domestic commercial vessels.

The national law imposes safety duty obligations on owners and masters of domestic commercial vessels to ‘so far is reasonably practicable’ ensure the safety of their vessels, marine safety equipment that relates to the vessel, and the operation of the vessel.

Domestic commercial vessels owners and masters must implement and maintain safety management systems on their vessels to comply with their statutory safety obligations.

Documented safety management systems are one way in which domestic commercial vessel owners can demonstrate that they comply with the safety management system requirements of the national law.

Contents

• Introduction
• Terms associated with risk management
• Consulting masters and crew
• The risk management process
• Step 1 – Identify hazards
• Step 2 – Consider the risks associated with the identified hazards
• Step 3 – Identify and implement ways to control the risks
• Step 4 – SMS/review
• Appendix A – Risk register examples
• Appendix B – Further example of risk assessment/control and the completed risk register

Introduction

The Marine Safety (Domestic Commercial Vessel) National Law Act 2012 (the National Law) provides a single national framework for ensuring the safe operation, design, construction and equipping of domestic commercial vessels (DCVs). The National Law imposes safety duty obligations on owners and masters of DCVs to ‘so far is reasonably practicable’ ensure the safety of their vessels, marine safety equipment that relates to the vessel, and the operation of the vessel. DCV owners and masters must implement and maintain Safety Management Systems (SMS) on their vessels to comply with their statutory safety obligations. Documented SMS are one way in which DCV owners can demonstrate that they comply with the SMS requirements of the National Law.

The Marine Order 504 (Certificates of operation and operation requirements — national law) – MO504 specifies the minimum requirements for the safe operation of DCVs. 

Marine Order 504 makes clear the owner’s responsibility to manage the risks associated with the operational safety of a DCV. Risk management is a key component in developing an effective SMS. 

Marine Order 504 requires that a risk assessment of the operation of any Class 1, 2, 3 & 4 vessels, be carried out which identify: 

• key daily tasks to be performed by all crew members
• any potential risks involved in the conduct of any task that may expose the vessel, operational environment, or persons on or near the vessel to unacceptable risk
• the appropriate crew for the vessel
• a person who is responsible for ensuring that actions needed to correct any identified potential risk is carried out.

One of the key responsibilities of a DCV owner is to ensure the risk management process is documented and kept up- to-date. The owner also needs to ensure that the risk assessment is prepared in consultation with the master and crew of the vessel. It’s equally important that a DCV owner regularly monitors and reviews the appropriateness and effectiveness of risk controls. The owner must prepare and review the risk assessment in consultation with the master and crew of the vessel.

Identified risks must be reassessed and risk controls revised as necessary if the vessel’s normal operation changes or if the master considers that the risk to the safe operation of the vessel has changed. These reviews ensure the risk management process remains relevant to the vessel’s ongoing operation and increases the capacity of those involved to effectively manage risk.

The master and crew of the vessel must be able to give AMSA or a marine safety inspector a copy of the risk assessment on request. This should include the appropriate crewing determination.

References

• AS/NZS ISO 31000
• IALA Guideline - G1138 The Use Of The Simplified IALA Risk Assessment Method (SIRA)
• SA/SNZ HB 436:2013, Risk management guidelines — Companion to AS/NZS ISO 31000:2009
• HB 158—2010, Delivering assurance based on ISO 31000:2009 Risk management — Principles and guidelines

Terms associated with risk assessment

Consequence 

The type and or severity of harm that a person could sustain if they came in contact with the hazard.

Hazard

A hazard has the potential to cause death, injury, illness or environmental damage, for example:

• the environment in which the vessel operates
• unsuitable vessel
• machinery plant and lifting devices
• inadequate safety systems

It's everyone’s responsibility to identify hazards.

Likelihood

The possibilities, high or low, that someone will come into contact with the hazard.

Risk

Risks arise from interactions with one or more hazards that may have a detrimental impact on safety.

Risk assessment

The process of evaluating the likelihood of an incident or injury:

• What could cause harm (hazard)?
• What could go wrong (risk)?
• How likely is it to happen (likelihood)?
• How bad will it be (consequences)?

Risk controls

Risk control is a risk modification process. It involves selecting and implementing one or more control options. Once a control has been implemented it assists with managing the risk. You have many control options.

Elimination or removal of hazards and their associated risks is always the best option. However this is not always feasible or possible. So in these circumstances, risk controls are used to reduce the risks to an acceptable level.

Examples of risk controls are: fire suppression systems, wearing lifejackets when on deck and thorough induction and training programs.

Risk rating

The result of using a likelihood and consequence matrix to determine the severity or rating of a risk.

Risk register

A risk register is a central point where all identified risks are listed. It includes all relevant information to the vessel’s risks and must be updated regularly.

Consulting masters and crew

You must consult your master and crew when you develop your risk assessments. You then need to ensure your risk assessments are always accessible to your master, crew and marine inspectors.

How can you engage with masters and crew?

How you engage with masters and crew will depend on a number of factors such as the size of the operation and workforce, multiple vessel locations and the diversity of operations they undertake.

Here are some examples of how you may choose to engage. You may have other ideas!

• Communicate directly with masters and crew about your safety management system and seek their input into the risk assessment. This could for example be by email or during ‘toolbox’ meetings.
• Using workplace health and safety committees where masters and crew elect their peers to canvass and represent their views on risk assessments to management. The outcomes of these meetings should be recorded and provided to masters and crew
• Using internal newsletters where you outline how and when masters and crew can provide input into reviews of risk assessments.
• For small vessel operators with only one or two crew, you might have a less formal process for reviewing the risk assessment. You could record that you have consulted in your vessel log, recording the time, date, purpose of meeting (e.g. risk assessment review), outcomes and who was there.

Making your risk assessment available

Owners have to make sure that the risk assessment, including the appropriate crewing determination, is readily available to masters and crew.

For example, you could email the risk assessment to masters and crew or keep a copy accessible onboard.

Owners must also give a copy of the risk assessment and appropriate crewing document to AMSA or a marine inspector upon request.

The risk management process

The following steps should be completed by vessel owners to effectively manage risk as part of the vessel’s Safety Management System (SMS). It is important to note that masters and crew must also be involved in all of the following four steps of the risk management process.

Step 1 – Identify hazards

Identify and document all hazards associated with the vessel and its operation. This should be the start of your risk register (examples at Appendix A). Every vessel operation is different and some hazards are likely to be unique to a particular operation.

There could be hazards associated with the:

• vessel’s machinery, plant and equipment
• the type of operation the vessel is involved in for example dive charter and fishing operations
• the daily activities of the crew such as fuelling, loading of stores and hauling nets
• passenger access and accommodation
• operating area and environment.

Example: A commercial fishing vessel owner, master and crew identify the trawl winch associated with fishing operations is a hazard that poses a potential threat to the safety of crew. The hazard is entered into the vessel’s risk register. (Refer Appendix A).

Step 2 – Consider the risks associated with the identified hazards

Once the hazards have been identified consideration needs to be given to the possible impact of these hazards on the safety of people who operate the winch.

In order to determine the potential impact of the hazard we need to consider the chance of someone being hurt which we will refer to as the likelihood. We also need to consider the possible harm that it could cause them which we will refer to as the consequence. This is known as the risk assessment phase.

The following tables are based on examples in Australian Standard 31000:2009 and help us to determine the likelihood and consequence.

The vessel owner, master and crew have decided it is likely that a crew member could be caught in the trawl winch so they have circled this on the table.

Likelihood table

The descriptors and value for the “likelihood” of an incident

Reference: IALA Guideline - G1138 The use of the simplified IALA risk assessment method (SIRA)

The vessel owner, master and crew have decided that injuries from the trawl winch could be fatal or very serious, so they assign a consequence rating of major as circled.

Consequence table

The likelihood and consequence matrix helps the vessel owner, master and crew to use the likelihood and consequence ratings that they’ve assigned to determine the risk rating. As you will see below, the risk rating for a crew member being caught in the trawl winch is extreme.

Likelihood and consequence matrix

Step 3 – Identify and implement ways to control the risks

Once the risks have been assessed they need to be controlled. Risks must be either eliminated or reduced to a level that is as low as is reasonably practicable. Risk controls are specific actions taken by vessel owners to eliminate risks or reduce risks to an acceptable level.

Here are some examples of risk controls:

• developing operational procedures
• training and inducting crew
• developing effective emergency response plans
• regular inspection and maintenance of the vessel, the machinery onboard and the equipment
• use of effective personal protective equipment.

The hierarchy of controls as outlined in the table below is part of a globally recognised tool that helps vessel owners, masters and crew to determine the most appropriate approach to control risks. While elimination of the hazard is always the preferred option, it is not always feasible or possible. If a hazard cannot be eliminated steps must be taken to implement a range of risk controls to reduce the risks to an acceptable level.

Hierarchy of controls

The type of risk controls that can applied will depend on a number of factors that will vary on a case by case basis. Here are some of the factors:

• nature of the hazard
• any limitations or constraints imposed by the design of the vessel, machinery or plant
• competency of crew who interact with the hazard
• cost of control options by comparison with the likelihood and possible consequence of the risk occurrence

Once suitable risk controls are identified, including when a lifejacket must be worn by any person on board, they need to be implemented as soon as possible to help manage the risk.

Once suitable risk controls are applied, it is useful to re-assess the risk to see if the risk rating has changed. In many cases the likelihood of a risk occurring will reduce when effective risk controls are in place.

The vessel owner, master and crew re-assess the risks associated with the trawl winch once all of the proposed risk controls have been implemented. This time they find that the likelihood has been reduced from likely to unlikely and that the possible consequence has been reduced from major to moderate. 

The overall risk rating has therefore dropped from an extreme risk to a moderate risk (see risk matrix below). The details are all captured in the vessel’s risk register (see appendix A).

Step 4 – Safety management system review

Once risk controls have been put in place for all identified risks they should form part of the operation’s SMS and be monitored and reviewed to verify their effectiveness. The outcomes of the review and verification process should be documented. If the monitoring and review process identifies a short coming or failure in the risk control measures, the risk assessment process should be revisited.

The Marine Order 504 requires the SMS and therefore the risk management process upon which it is based to be reviewed at least annually. In addition, another trigger for reviewing the risk register could be as a result of a near miss, incident or accident.

The review of the SMS and risk management process ensures their currency and relevance through the DCV owner, master, and crew/s commitment to continuous improvement. Continuous improvement ensures DCV owners, masters and crew are actively involved in the ongoing maintenance of the SMS and risk management process and this is essential to the development of a safety culture.

Appendix A – Risk register examples

Risk registers come in various formats. The following examples are provided as a guide for vessel owners to assist them with the risk assessment and control process, vessel owners have the flexibility to determine which type of risk register best suits their needs. The first entry in the example below shows how the outcomes of the trawl winch risk assessment and control process have been recorded. 

Download and print Have you considered all the risks

Example No. 1

Example No. 2

Here is an example of a simplified risk register, one that might be found on a small commercial fishing vessel. It is important to note, that while not shown in the example the owner/skipper and crew have considered the likelihood and consequence of the risks that have been identified.

Example no. 3

Example no. 4

This table gives you an example of a risk assessment tool.