Discussion on the Effectiveness of Internal Audit in HSE Management System

　　The HSE management system is one of the effective methods for enterprises to standardize safety and environmental management, especially widely promoted and applied in the petroleum and petrochemical industry. According to statistics, among the 43 petroleum and petrochemical companies in the Fortune Global 500, 40 have adopted the HSE management system, accounting for 93%; the top 5 domestic petroleum and petrochemical companies have all established HSE management systems, and even most contractors of petroleum and petrochemical companies have established HSE management systems. This shows the importance of the HSE management system in the petroleum and petrochemical industry.

　　So, how enterprises can effectively utilize the HSE management system after its establishment to reduce HSE risks has become a key focus. The author discusses how to effectively conduct internal audits and promote the effective operation of the system.

　　1. What is internal audit effectiveness?

　　When mentioning internal audit effectiveness, it is first necessary to understand what internal audit is. According to GB/T19011-2021 "Guidelines for Management System Auditing," an audit is "a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled." Internal audit is a means for an organization to conduct self-assessment, monitor and improve the conformity and effectiveness of its management system, and serves as the "eyes" of top management.

　　Some enterprises conduct internal audits merely as a process where auditors compare criteria with evidence according to the audit plan, limited to verifying conformity with audit criteria. As the maturity of system operation in enterprises improves, system audits inevitably shift from conformity to effectiveness. Because enterprises not only need to standardize their business process management through the system but also continuously improve management efficiency. Although internal audit is not equivalent to the entire effectiveness of system operation, it can effectively promote continuous system improvement.

　　According to the definition in GB/T19000, effectiveness refers to: "the extent to which planned activities are completed and planned results are achieved." Extending this to "internal audit effectiveness," it means initiating audits from performance objectives, completing internal audit planning activities, comprehensively identifying problems and making improvements, thereby promoting the achievement of performance objectives. The "internal audit objective" ultimately evaluates the adequacy, suitability, and effectiveness of the system, timely identifies problems and weaknesses in management work, provides information for managers to adjust and improve management, and becomes a mechanism for self-improvement and enhancement.

　　2. Main reasons for insufficient internal audit effectiveness

　　(1) Insufficient effectiveness of audit planning

　　Effective internal audit planning is the foundation for the effective conduct of internal audits. If internal audit planning is inappropriate, problems cannot be fully identified, and improvement suggestions cannot be made, resulting in a formalistic internal audit. Common deficiencies in internal audit planning include:

　　1. Internal audit plans are not comprehensive. They only consider audit clauses and system document requirements, neglecting management improvement implementation, historical nonconformity rectification, management weaknesses, and stakeholder requirements;

　　2. Internal audit resource allocation is unreasonable. Audit time is evenly distributed without increasing audit time for key elements or areas;

　　3. Sampling and audit "required actions" are not clearly defined. Auditors arbitrarily conduct audits based on their understanding or expertise, sampling quantities are inconsistent, and "required actions" are done perfunctorily, resulting in insufficient objective evidence;

　　4. Auditors auditing processes related to their own business responsibilities cannot objectively identify problems.

　　(2) Insufficient attention

　　1. Internal audit team member arrangements are unreasonable. Auditors are mostly part-time business personnel who cannot fully devote themselves to audit work due to their primary job responsibilities, or audit time and energy are not guaranteed;

　　2. Arrangements for personnel receiving audits are unreasonable. Due to insufficient attention to internal audits or the influence of primary job duties, professionals cannot fully cooperate throughout the audit process, arbitrarily assigning others to receive audits. Because they do not fully understand the overall business management, the evidence provided is inaccurate or incomplete.

　　(3) Insufficient auditor capability

　　1. Auditors are mostly part-time business personnel without systematic training, lacking audit knowledge and skills, and with insufficient audit experience;

　　2. Auditors lack sufficient professional knowledge and skills, are unfamiliar with specific business audits, and cannot conduct effective and in-depth audits;

　　3. Lack of appropriate tools and methods, audit focus is relatively single, only concentrating on surface issues, unable to identify deeper problems; poor analysis and summarization skills, making it difficult to identify systemic issues.

　　(4) Insufficient effectiveness of problem rectification

　　1. The issues raised belong to internal enterprise behavior, especially some personnel believe that the audit authority of peer departments is weak, resulting in insufficient rectification progress and intensity. Some problems are not even recognized or accepted by the audited units, making rectification impossible. If rectification cannot gain strong support from enterprise leadership, it will seriously affect internal audit effectiveness;

　　2. Some enterprise leaders, although valuing internal audits, face problems where rectification personnel cannot learn from one issue to solve related problems or trace audits, treating symptoms rather than root causes, leading to repeated problems.

　　3. Measures to improve internal audit effectiveness

　　To improve internal audit effectiveness, work can be carried out from several aspects including leadership awareness, standardized procedures, building an internal auditor team, and enhancing problem identification and rectification capabilities:

　　(1) Enhance leadership awareness and increase attention

　　Leadership attention is key to improving internal audit effectiveness. The core role of leadership is evident from the system model diagram. Only with strong promotion from top management can the PDCA cycle operate effectively.

　　Currently, most leaders in petroleum and petrochemical enterprises recognize the importance of the system and can basically play a leadership role, driving all employees to change their mindset and understanding. However, there are still slight deficiencies in reasonably arranging auditors and allocating sufficient resources. Especially when business and internal audit compete for resources, internal audit, as a "temporary task," is often neglected. Therefore, enhancing leadership attention is an important means to improve HSE internal audit effectiveness.

　　During internal audit planning, leaders should reasonably arrange auditors and, if necessary, hire external experts to participate, improving audit authority and capability;

　　Leaders should reasonably arrange work to ensure personnel receiving audits understand the overall business process management and can fully accept the audit;

　　Provide sufficient resource support to ensure adequate internal audit time and audit authority so that the internal audit process can be implemented as planned.

　　(2) Standardize internal audit procedures and refine work processes

　　Standardized work processes guarantee improved internal audit effectiveness.

　　Develop detailed internal audit plans, clarifying audit objectives, scope, plans, and "required actions." The internal audit scope should include not only system elements but also verification of past problem rectifications and implementation of management improvements;

　　According to the focus points of internal audit, reasonably allocate audit time to ensure that key areas and elements receive sufficient audit, avoiding issues such as insufficient audit granularity and omissions.

　　Based on the work content and professional knowledge of internal auditors, reasonably allocate audit projects to avoid auditing unfamiliar fields and businesses with responsibility relationships.

　　Clarify the principles of audit sampling and audit record requirements to ensure that audit record information is comprehensive, consistent, and accurate.

　　(3) Strengthen the construction of the internal auditor team and improve the capabilities of internal auditors.

　　Internal auditors are an important organizational force to promote the effective operation and maintenance of the enterprise system. To do a good job, one must first sharpen one's tools. The effectiveness of internal audits largely depends on the capabilities of internal auditors, which in turn depend greatly on whether internal auditors can correctly understand and master the process approach, accurately comprehend and grasp standard requirements, skillfully use audit tools and methods, and have certain abilities to identify problems and conduct audit traceability. Therefore, building a team of capable, skilled, and professional internal auditors is essential.

　　Plan the construction of the internal auditor team, propose requirements for the number, personnel composition, professional knowledge, and skill levels of internal auditors, and select and develop suitable internal auditors.

　　Develop reasonable training plans, including training on audit capabilities and professional skills.

　　Regularly conduct discussions on audit case studies, analysis, and sharing, exchanging and summarizing audit methods, skills, and precautions. Especially learning and using some appropriate tools and methods can greatly improve the audit capabilities of internal auditors.

　　Experienced internal auditors with extensive practice lead and guide new internal auditors in audits. Hiring external experts to assist in audits is also a common method used by enterprises. External experts teach during the audit process, imparting audit experience, methods, and skills to internal auditors.

　　(4) Improve the ability to identify problems during audits.

　　First, members of the enterprise leadership team should take the lead in participating in internal audits, controlling the process, and abandoning the mistaken idea of treating internal auditors as "bearers of bad news." Fully identify problems and analyze systemic issues from them for continuous improvement. Adhere to the principle of seeking truth from facts, base on facts, carefully observe the site conditions during the audit process, do not overlook any detail, ask several "whys," and think from different perspectives to provide more valuable suggestions.

　　Audits identify point issues, which is the purpose of hazard identification or safety inspections. The difference with system audits is that the latter aims to find gaps in the enterprise's systematic management by comparing with system evaluation criteria and best management practices, evaluating the conformity and effectiveness of system operation. Audits identify systemic issues in the system, not just "point" issues. Effective audit conclusions are made based on systematic analysis, evaluating "lines" and "surfaces."

　　1. Deep problem tracking to improve the quality of "point" issues.

　　To ensure the discovery of high-quality "point" issues during the audit process, base on risk thinking and follow the "5WHY" approach to track possible risk outcomes caused by the problem, while also finding the root cause of the problem to discover deeper issues.

　　Problem tracking considers the consequences and direct causes of the problem, mainly following the process approach, tracking from multiple dimensions such as technical and management causes. Trace backward to check whether the root cause of the anomaly still exists; trace forward to check whether risk control measures have failed.

　　2. Walkthrough inspection to identify systemic "line" issues.

　　During the audit, based on discovering enough and quality "point" issues, conduct walkthrough inspections according to "business" or "elements" to form "line" analysis results and identify systemic issues.

　　"Walkthrough inspection" is a method based on auditing a certain business or element, then inspecting other businesses or elements. When auditing departments, walkthrough inspections should be based on system elements; when auditing system elements, walkthrough inspections should cover various businesses; during on-site inspections, conduct walkthrough inspections based on problem tracking results. Finally, combine audit traceability to form "line" analysis results.

　　3. Audit traceability to identify management causes.

　　The HSE management system ultimately targets management, with the main goal of improving the enterprise's management level. To achieve this, after identifying systemic "line" issues, conduct "audit traceability" to find root causes, tracing problems back to deficiencies or shortcomings in responsibilities, systems, capabilities, resources, assessments, and other management aspects. Through targeted special management improvements, promote the enhancement of management system performance.

　　(5) Improve the effectiveness of problem rectification.

　　Internal audit work is not only about finding problems but more importantly about effectively rectifying them for continuous improvement. This is the ultimate goal of internal audits. Tracking and verifying the effectiveness of problem rectification is an important part of the effective operation of the HSE management system. To improve rectification effectiveness, the following tasks should be done:

　　1. Attention and support from leaders at all levels of the enterprise, including recognition of audit findings, provision of rectification resources, and coordination among different departments.

　　2. The problem rectification departments should consider the overall enterprise situation and actively carry out rectification, not just focus on their own areas. According to audit traceability results, problems found in Department A may require rectification by Department B, so relevant personnel must have system awareness.

　　3. Clarify responsible persons and time nodes for rectification, track rectification progress and effectiveness of measures.

　　4. Master reasonable methods to conduct thorough inspections and prevent recurrence of similar problems.

　　5. For systemic problems found through audit traceability, develop special management improvement plans and assign professional departments to supervise rectification.

　　6. Establish reasonable assessment mechanisms to promote rectification enthusiasm.

　　Effectively conducting system internal audits is a key to improving enterprise system management levels. For top management who truly want to use management systems to enhance performance, they should fully recognize the importance of internal audits, make good use of internal auditors, use correct tools and methods, fully identify problems, and effectively rectify them. Only in this way can internal audits be used to evaluate system maturity and lead enterprises to healthy management development!