Mastering the Ship-Shore Safety Checklist
The ISGOTT ship-shore safety checklist is not a form. It is a negotiation between two organisations that do not work for each other, conducted in about an hour, with the shared goal of not blowing something up. Every senior tanker officer has watched it degrade into box-ticking: the terminal representative reads questions at speed, the chief officer initials without walking the manifold, and both parties sign a joint declaration neither has truly verified. That is precisely when accidents happen — during the routine transfers where everyone is confident. This article is written for masters, chief officers, and cargo officers who run the pre-transfer conference. It explains what the checklist sections are actually trying to protect — mooring integrity, emergency shutdown readiness, communication channels, cargo containment, and fire-fighting readiness — and how the coded questions (re-check items, agreement items, permission items) are supposed to drive behaviour after signing, not just before. It covers the practical discipline that separates a living checklist from a dead one: physically walking the interface together, agreeing the re-check interval and sticking to it, handling disagreements over items like emergency towing-off wires, and knowing when an answer of "no" means stop, not negotiate. It also addresses the repetitive checks that happen during the transfer itself, when the cargo officer on watch is tired, the terminal wants rate, and the temptation to pencil-whip the hourly verification is strongest. If you run tanker transfers, this is the meeting where you earn your salary.
The ship-shore safety checklist is the only document in a tanker call where the ship and the terminal formally agree, in writing, that the interface between them is safe to use. Both parties sign a joint declaration. That signature means two separate safety management systems — yours and theirs — have agreed on the condition of every critical link in the chain. Treat it with the weight that deserves.
Why box-ticking kills the point
The checklist was designed after transfer incidents where ship and shore each assumed the other had checked something. Its entire purpose is to force a shared verification of the interface: moorings, communications, cargo arms or hoses, emergency shutdown, fire-fighting readiness, containment. When a senior officer reads through the questions in the terminal office, initials every box in ninety seconds, and signs, the document still exists but the verification never happened. You now carry legal and moral responsibility for checks nobody made.
ISGOTT structures the checklist into a general bulk liquid section plus additional sections for chemicals and liquefied gas as applicable. The questions are coded. Items marked for re-check at agreed intervals are not one-time confirmations — they are a commitment to verify again during the operation. Items coded as agreement items mean the ship and terminal must settle a procedure between them, not merely confirm a fact. Items coded for permission mean one party is formally granting the other authority to proceed. If your officers do not know which is which, they cannot run the checklist properly.
Running the pre-transfer conference
The conference is a working meeting, not a ceremony. Run it deliberately:
- Walk the interface together. Manifold, drip trays, blank flanges, spill containment, insulating flange, gangway, emergency towing-off wires, fire wires, and the mooring pattern. The checklist questions about these are answered by looking, not by reciting.
- Agree the communication plan. Primary and backup channels, the agreed stop-work word or signal, and who on each side has authority to stop the transfer. Test the backup channel before you need it.
- Agree the shutdown sequence. Normal shutdown, emergency shutdown, and the rate ramp-down that protects the shore line from surge. Both sides must state the agreed signal and response in their own words.
- Fix the re-check interval in writing. Moorings, communications, and watch arrangements are verified again at the agreed interval for the whole transfer. Write the interval down where both watches can see it.
- Resolve disagreements before signing. If the terminal cannot accept a ship requirement, or you cannot accept theirs, the operation waits. A pencilled compromise in the margin is how incidents get investigated later.
A hard rule worth enforcing on your own ship: any checklist item answered "no" on a critical point means the transfer does not start until it becomes "yes". There is no halfway answer on emergency shutdown or containment.
After the signature: the repetitive checks
The joint declaration is valid only while conditions remain as checked. That is what the re-check items exist for. In practice this means the cargo officer on watch physically verifies moorings, communications, and watch manning at the agreed interval, and records it. The failure mode is always the same: a long steady transfer, a comfortable rate, a tired watchkeeper, and a re-check logged from the cargo control room chair. When the weather freshens at 0300 or the terminal changes watchkeepers without notice, the logged checks and the actual condition diverge.
Set the standard explicitly in your standing orders: re-checks are done on deck, initialled at the time they were done, and any change of condition — wind, swell, shore personnel, cargo plan — triggers a fresh verification, not just a continuation of the old one.
The senior officer's real job
The terminal representative will sometimes be in a hurry, under commercial pressure, or simply less experienced than you. None of that changes your obligation. You are the final barrier between your ship and a transfer incident, and the checklist is your tool — but only if the answers are true. Slow the conference down. Walk everything. Make the junior officers watch you do it. The day you sign a joint declaration you have not verified, you have transferred the risk from the terminal onto your own licence.