Title: Corporate SE Manager Date: 01/04/2012 Title: Head HSE Corporate Planning Date: 31/3/2012 Corporate HSE Auditor Date: 27/3/2012 Revision History The following is a brief summary of the four most recent revisions to this document. Details of all revisions prior to these are held on file by the Document Custodian. Version No. Month & Year Author’s Name and Title Scope / Remarks 1.0 Jan 2012 Younis Hinai Corporate HSE Auditor New Corporate Audit procedure Issued 1.1 March 2012 Younis Hinai Corporate HSE Auditor Minor text edits Drop of use of Risk Assessment Matrix Inclusion of action close-out time-frame in table 3 User Notes: The requirements of this document are mandatory. Non-compliance shall only be authorised by a designated authority through STEP-OUT approval as described in this document. A controlled copy of the current version of this document is on PDO's live link. Before making reference to this document, it is the user's responsibility to ensure that any hard copy, or electronic copy, is current. For assistance, contact the Document Custodian. Users are encouraged to participate in the ongoing improvement of this document by providing constructive feedback. Related Business Processes & CMF Documents Related Business Processes Code Document Title
Procedure Overview Level 1, Level 2 and Level 3 Audits are carried out to: Determine whether or not the elements and activities of PDO’s HSE Management System conform to the planned arrangements and are being implemented effectively. Determine whether or not PDO’s HSE Management System is fulfilling the Company’s HSE policy, objectives and performance criteria. Determine whether or not PDO’s HSE Management System complies with the relevant legislative and regulatory requirements. Identify areas for improvement in PDO’s HSE Management System, with the aim of progressively improving the HSE Management System. Enable management to ensure that potential or actual flaws in the system are remedied through effective follow-up action. Develop Audit Program All business processes should be periodically audited, with the frequency and depth of HSE auditing being determined based on: The level of risk for the process/activity. How critical the process or activity is, in relation to PDO’s business objectives. The statutory, regulatory and contractual requirements. The contribution or potential contribution of the activity concerned to PDO’s overall HSE performance. The results of previous audits. All business processes activities and assets should be audited within the audit cycle. The audit cycle should not be longer than five years, as it is likely that major changes (such as asset, staff, mode of operations, organization, etc) may have taken place during that time. Level 1 HSE Audits Includes HSE audits conducted on behalf of PDO’s IAC and BAC as part of the Integrated Audit Program, and also includes independent audits carried out by external bodies such as ISO 14001 certification audits. ACTION RESPONSIBILITY Identify HSE Audit Units (assets, services, projects and functions) that have a risk potential to affect the Company’s HSE objectives) Audit Manager Prepare yearly and five-yearly Level 1 HSE Audit program based on the risk potentials Audit Manager Review and approve Level 1 HSE Audit Program IAC & BAC Direct and review the development and implementation of the Corporate HSE Audit Program Corporate Safety and Environmental Manager Incorporate the Level 1 HSE Audit Program into Corporate HSE Business Plan Audit Manager Provide resources to manage the audit and lead the plan execution Corporate Safety and Environmental Manager Implement level 1 HSE audit program Audit Manager Report level 1 HSE audit and action status to IAC/BAC Audit Manager Monitor level 1 audits and actions IAC & BAC Table 1: Level 1 HSE audits program
The following terminology and scale are to be used for the Controls Assessments: Colour Category Definition Guidance Impact on Business Objectives Follow-up Controls Acceptable None, or a few Low and/or Medium rated findings are reported which indicate that a “once-off” rather than process or system structural weaknesses is present or that general enhancement of the controls, process or system framework is not needed. Less than three Medium findings. The expectation is that the entity will meet its Business Objectives. No follow-up is required by the next level of management. Controls Need Improvement Some Medium and / or one or more High rated findings are reported which indicate a weakness in key controls / barriers or in a part of the process or system structural framework. 1-2 High findings or 3-or-more Medium findings. The expectation is that the entity will not meet all its Business Objectives. The next level of management should be advised of and review the actions being taken to enhance the framework. Controls Need Major Improvement Three or more High and/or one or more Serious rated findings are reported indicating failures in key controls / barriers or across a significant part of the process or system structural framework. Any Serious finding or High findings. The next level of management should monitor the of agreed actions/ Table 4: Controls assessments color coding Conduct Closing Presentation to the Auditee that includes, as a minimum: Terms of Reference Summary of Audit findings and ratings Risk area Control Acceptability Actions expected from the Auditee Prepare Audit Report The Audit Lead shall prepare the Audit report from the audit team inputs. As a minimum the Audit report shall contain: Terms of Reference Audit findings Significance of findings Recommendations