External audits for obtaining and renewing a TSMS certificate are conducted through a TPO and must include both management and vessels as follows:

(a) Management audits. (1) Prior to the issuance of an owner or managing operator's initial TSMS certificate, or subsequent renewals, an external management audit must be conducted by an auditor from a TPO.

(2) A mid-period external management audit must be conducted between the 27th and 33rd month of the certificate's period of validity.

(b) Vessel audits. (1) An external audit must be conducted prior to the issuance of the initial COI for vessels subject to an owner or managing operator's TSMS that have been owned or operated for 6 or more months prior to receiving the initial COI.

(2) An external audit must be conducted no later than 6 months after the issuance of the initial COI for vessels subject to the owner or managing operator's TSMS that have been owned or operated for fewer than 6 months prior to receiving the initial COI.

(3) An external audit of all vessels covered by a TSMS certificate must be conducted during the 5-year period of validity of the TSMS certificate. The vessels must be selected randomly and distributed as evenly as possible.

(4) External audits may include the use of objective evidence which may be available at the owner or managing operator's corporate office. Some portions of this audit require visiting each vessel at some point during the 5-year period of validity of the TSMS certificate.

(c) Documentation. The results of the external audit must be documented and maintained for a period of 5 years and made available to the Coast Guard or the external auditor upon request.