Audit Procedure - 公司内部审计流程(英文).docVIP

Page PAGE 2 of NUMPAGES 4 Internal Audit Procedure Purpose of this procedure To ensure that the contract department continually operates in accordance with the specified policies, procedures and external requirements in meeting company goals and objectives in relation to information security. Scope This procedure includes planning, execution, reporting and follow–up of CMS internal audits and applies to all departments and business units within scope of the organization’s CMS. R?les and responsibilities Lead Auditor (VCW, HPY) Prepares an Audit Plan/Notification as a basis for planning the audit and for disseminating information about the audit. Leads the CMS internal audit activities Co-ordinates the audit schedule with concerned department/section heads Plans the audit, prepares the working documents and briefs the audit team. Consolidates all audit findings and observations and prepares internal audit report. Reports critical non-conformities to the auditee immediately. Report to the auditee the audit results clearly and without delay. Conducts the opening and closing meeting. Auditee (WWJ, XYX, PDW, HPY, ZMY, GTY,) Receives, considers and discusses the audit report. Determines, resources, drives and completes corrective actions as necessary. Is and remains accountable for protecting information assets. Procedure General This audit programme shall be created that contains all scheduled and potential audits for the whole calendar year. This shall include schedule of internal audits, audits of suppliers as appropriate. Internal audits shall be scheduled twice a year or as the need arises. Only competent personnel who are truly independent of the subject area shall perform audits. An Audit Notification Memo is sent to the department/section to be audited at least three working days in advance of the audit. Planning and Preparing the Audit Based on the audit programme, the Lead Auditor shall prepare the respective audit plans. The Audit Plan/Notification shall