Procurement Audit and Internal Audit Pages on Changzhou Manufacturer Websites: How Should They Be Accepted?

Direct answer: A procurement audit/internal audit page is not a line saying "audit a few transactions". The website page should state: audit types (compliance, price/cost, process, special investigation, follow-up, supplier audit); annual planning and risk ranking; independence (leadership, reporting line, no participation in procurement decisions/execution); sampling and evidence (population, sampling method, sample size, full testing of high-risk items, data analytics, interviews, site visits, confirmations, evidence chain); audit procedures (notice, entry meeting, documents, walkthrough, testing, exceptions, working papers, findings, report, management response); finding grading (condition, criteria, cause, effect, risk, recommendation, owner, deadline); remediation/follow-up/accountability; reporting and communication; working papers/confidentiality/data; and what must not be public. On the law: the Measures for the Administration of Internal Audit Work (Audit Office Order No. 11 of 2018) Article 3 defines internal audit as independent, objective supervision, evaluation and advice on the unit's financial revenue/expenditure, economic activities, internal control and risk management; Article 5 requires independence, objectivity, fairness and confidentiality and prohibits participation in work that may affect independence; Article 6 sets the leadership structure (for state-owned enterprises, under the party organisation/board or main person in charge, reporting to them); Article 12 sets duties; Article 16 requires procedures under internal audit professional standards and company rules; Article 20 provides for coordination with discipline inspection/supervision, inspection and organisation/personnel, and uses audit results and remediation as a basis for assessment/appointment/reward/decision; Article 21 requires referral of major discipline/law violation leads. Accounting Law Article 27 requires the internal accounting supervision system to define and separate approval/handling/custody/recording duties. Information is current to 2026-11-08. This is a review of public rules and page practice, not legal, audit or internal-control advice; the law, internal audit standards, company policy and audit committee's requirements control.

This guide is for procurement, finance, internal control, internal audit, legal, IT and website teams at equipment, electronics/electrical, automotive, medical device, hardware, chemical, packaging and export manufacturers in Changzhou and nearby areas. This page most often misses independence, sampling, evidence chain, remediation closure, accountability and the public boundary, ending up as "audit procurement periodically".

How does this page relate to requisition approval, three-way match, procurement archive, supplier audit and financial risk pages?

The procurement audit page answers "who audits independently, what is audited, how to sample/collect evidence, and how findings are remediated/accounted for"; the requisition approval (PR-to-PO) page answers "ex-ante budget/authority/segregation"; the three-way match/reconciliation page answers "PO/receipt/invoice matching"; the procurement archive/retention page answers "what to keep and for how long"; the supplier audit (second-party audit) page answers "supplier quality/capability/site audit"; the financial risk page answers "early warning/exposure/contingency". Procurement audit is "independent supervision + evaluation + remediation"; a second-party audit or three-way match cannot replace it.

Common breakpoints: audit reports to the procurement head; audit participates in award/approval; only documents are checked, not data/site; sampling is arbitrary/too small; evidence is only a screenshot; findings lack criteria/cause/effect; remediation has no owner/deadline; repeat findings are not escalated; the report does not reach the audit committee; working papers are lost; the public page discloses specific findings/suppliers. Separate "independence—plan—sampling—evidence—finding—remediation—accountability—public boundary"; then procurement, finance and internal audit share one playbook.

This page map is editorial; the law, internal audit standards and company policy control.

How should audit types and scope be defined?

Common types: compliance audit (rules/authority/sourcing/contract); price/cost audit (quote composition, comparison, sole source, price adjustment); process audit (PR-to-PO-to-GR-to-payment); special investigation (whistleblowing, fraud, conflict of interest); follow-up audit (remediation/project); supplier audit (contract/performance/risk, distinct from second-party quality audit). Scope follows risk/amount/category/supplier/anomaly/whistleblowing/management request; the annual plan should cover high-risk areas, not only small transactions. The objective should state "what is audited, what is not, and which criteria apply".

Acceptance checks: type; scope; objective; criteria; risk; coverage; frequency; approval. Common gaps: compliance only; documents only; no price/sole-source review; no conflict review; scope too broad/narrow; no criteria; no plan; ad hoc assignment without record.

This type/scope is editorial; risk, management requirements and the annual audit plan control.

How should independence and reporting lines be set?

Internal audit should be independent, objective, fair and confidential, and must not participate in work that may affect independence (e.g., procurement award, contract approval, payment execution). Article 6 of the Internal Audit Measures: for state-owned enterprises, the internal audit function is under the party organisation/board (or main person in charge) and reports to it; other companies may refer to an audit committee/board/main person in charge. The reporting line should reach the audit committee/board directly, not be controlled by procurement/finance; budget/staff/performance should be independent; audit findings involving senior management/procurement heads require recusal/escalation; external audit/discipline inspection/legal cooperate but roles are separate.

Acceptance checks: leadership; reporting line; budget/staff; performance; recusal; escalation; external cooperation; no decision-making. Common gaps: reports to procurement; audit participates in award; procurement controls budget; findings suppressed; no recusal for senior management; external audit replaces internal audit.

This independence requirement follows the Internal Audit Measures; corporate governance/audit committee rules control.

How should the annual plan and risk ranking work?

Every year/rolling, assess risk: procurement amount/category importance, sole source/designated supplier, price volatility, supplier concentration, abnormal payment/account changes, whistleblowing/penalties/litigation, prior findings/remediation, system access/data anomalies, new projects/plants. Rank by risk score and form an annual audit plan (project/scope/time/staff/budget), approved by the audit committee/board; ad hoc projects need approval and adjustment records. High-risk areas should be covered annually; low-risk areas can be rotated/data-monitored; reserve resources for whistleblowing/special projects.

Acceptance checks: risk assessment; scoring; plan; coverage; resources; approval; adjustment; high-risk frequency; whistleblowing reserve. Common gaps: arbitrary; only easy areas; high-risk not covered; no approval; no ad hoc record; insufficient resources; no review.

This planning/risk ranking is editorial; company risk, audit resources and audit committee requirements control.

How should sampling and evidence be accepted?

Define the population (period/entity/category/supplier/amount/documents), then choose the method: full testing for high-risk/large/anomalous items; statistical/judgment sampling for homogeneous populations; sample size based on confidence/tolerable error/population size—there is no universal number; use data analytics to screen splitting, frequent price changes, supplier concentration, account changes, duplicate payments, holiday/late-night approvals. Evidence must be reproducible: system export + original documents + interview notes + site photos + confirmations/reconciliation + emails/minutes; document source/time/extractor/custody; keep original electronic media/logs; working papers indexed/reviewed.

Acceptance checks: population; method; sample size; high-risk full testing; data analytics; original evidence; interview/site; confirmation; evidence chain; working paper review. Common gaps: unclear population; only small items; too few samples; no anomaly screening; screenshot without source; unsigned interview; no working paper review; no original electronic media.

This sampling/evidence is editorial; internal audit standards, company policy and project risk control.

How should the audit procedure run?

Suggested: annual plan → project initiation/authority → audit notice (scope/time/documents/contacts) → entry meeting → process understanding/walkthrough → data extraction/sampling → substantive testing (contract/PO/receipt/invoice/payment/comparison/sole source/authority) → exceptions/interviews/site → working papers/review → findings summary/grading → management response → report (condition/criteria/cause/effect/recommendation) → remediation plan → follow-up/verification → closure/archive. Major/whistleblowing projects require confidentiality, restricted access and evidence preservation; coordinate with discipline inspection/legal/external audit as needed.

Acceptance checks: initiation; notice; entry; walkthrough; data; testing; exceptions; working papers; findings; response; report; remediation; follow-up; archive. Common gaps: no initiation; unannounced without authority; incomplete testing; exceptions not pursued; incomplete working papers; no criteria; no management response; no follow-up; no archive.

This procedure is editorial; internal audit standards, company policy and project authority control.

How should findings be graded and written?

Each finding should state: condition (who/when/where/amount/documents/system); criteria (law/policy/contract/authority); cause (control gap/bypass/system/people); effect/risk (amount/compliance/fraud/reputation); recommendation (actionable); owner; deadline; management response. Grade by risk/amount/nature (major/important/general/observation); major/fraud/legal leads must be escalated/referred. Do not write only "management is non-standard"; separate fact from inference; give the auditee an opportunity to respond/supplement evidence.

Acceptance checks: condition; criteria; cause; effect; recommendation; owner; deadline; response; grading; rebuttal; evidence. Common gaps: no criteria; unclear facts; superficial cause; unquantified effect; vague recommendation; no owner; no deadline; no response; arbitrary grading; no rebuttal.

This finding format is editorial; internal audit standards and the company's reporting template control.

How should remediation, follow-up and accountability close the loop?

The remediation plan should state: issue, action, owner, deadline, resources, evidence, verification method; audit follows up with reminders, verifies evidence and closes/approves extensions; major/repeat/false remediation should be escalated to the audit committee/board and, where appropriate, linked to assessment/appointment/reward (Article 20 of the Internal Audit Measures); discipline/law violation leads are referred to discipline inspection/judicial authorities under Article 21; remediation results feed policy/process/system improvements and annual review. "The report is done" is not closure; "a meeting/training was held" is not remediation evidence.

Acceptance checks: plan; owner; deadline; resources; evidence; verification; closure; extension; escalation; assessment; referral; review. Common gaps: no plan; unclear owner; no deadline; no evidence; no verification; arbitrary closure; repeat findings not escalated; no accountability; no review.

This remediation/accountability is editorial; internal audit rules, company policy and audit committee requirements control.

How should reporting, communication and confidentiality be accepted?

Audit reports should be distributed by tier: audit committee/board, management, auditee, relevant functions; major/sensitive reports are restricted; the report states condition/criteria/effect/recommendation/response; findings involving individuals/suppliers/prices/fraud are confidential; communication with discipline inspection/legal/external audit/regulators needs a consistent position and authority; whistleblower protection/confidentiality; external disclosure/website only policy/scope/whistleblowing channel, not specific findings/cases. Working papers/evidence are retained under archive policy, access-controlled, encrypted and logged.

Acceptance checks: recipients; tiering; content; response; confidentiality; communication line; whistleblower protection; working paper retention; data access. Common gaps: broad distribution; no tiering; unclear facts; no response; leak; inconsistent external line; whistleblower exposed; lost working papers; over-broad access.

This reporting/confidentiality is editorial; internal audit rules, company policy and information security requirements control.

How should the website page be written, and what must not be public?

Suggested content: (1) audit scope/types/annual planning principles; (2) independence/reporting line/duties; (3) audit procedure/sampling/evidence/remediation; (4) whistleblowing/complaint channel and protection; (5) cooperation with discipline inspection/legal/external audit; (6) contact/version/update date. The public page explains "policy, scope and whistleblowing"; it should not publish specific audit findings, supplier/employee names, prices/contracts, fraud investigations, working papers, pending cases or internal reports; after login, whistleblowing/remediation evidence can be submitted.

Use consistent English terms (internal audit, procurement audit, independence, audit plan, risk assessment, sampling, evidence, working papers, finding, root cause, remediation, follow-up, accountability, whistleblowing) and state the review date. Link to requisition approval, three-way match and procurement archive pages, but do not turn the audit page into a supplier second-party audit page.

This structure is editorial; external statements must be truthful and verifiable, per the law, internal audit standards and company policy.

What must not be written?

High-risk claims: "audit means checking accounts" (it also covers compliance/price/process/fraud/remediation); "audit reports to the procurement head" (independence impaired); "audit can participate in award/approval" (independence impaired); "sample a few transactions" (population/method/sample/high-risk needed); "write 'management is non-standard'" (condition/criteria/cause/effect needed); "a meeting is remediation" (evidence/verification/closure needed); "repeat findings need no escalation" (escalation/accountability needed); "publish audit findings/suppliers/prices" (sensitive). These are inaccurate or misstate independence, evidence, remediation or the public boundary.

Safer wording: "This page applies to [procurement audit type]; the audit is conducted independently under the [audit committee/board/main person in charge] and does not participate in procurement decisions/execution; the annual risk plan covers [scope/frequency]; [full/statistical/judgment sampling + data analytics] is used, with evidence [documents/system/interviews/site/confirmations]; findings state [condition/criteria/cause/effect/recommendation/owner/deadline]; remediation [plan/verification/closure/escalation/accountability]; whistleblowing [channel/confidentiality/non-retaliation]; public [policy/scope/channel], not specific findings. The law, internal audit standards and company policy control."

Go-live acceptance checklist

Ten checks: independence/reporting line; annual plan/risk; scope/types; sampling/evidence; procedure/working papers; finding grading/writing; remediation/follow-up/accountability; reporting/confidentiality; whistleblowing/cooperation; public boundary and version. Each needs an owner, evidence and review date. The pass condition is not "the page says audit periodically", but that procurement, finance and internal audit can stay independent, plan, sample, collect evidence, report, remediate, hold accountable and explain the boundary.

Before go-live, run one real (anonymised) procurement project through: risk → plan → notice → walkthrough → sampling → evidence → finding → response → remediation → verification → closure. Then simulate a whistleblowing/conflict case and an overdue remediation to see whether independence/escalation/accountability works. Any step that fails is a gap in the page or the process.

This checklist is editorial; the law, internal audit standards and company policy control.

Who should read this, who should not, and what decisions does it support?

It suits procurement, finance, internal control, internal audit, legal, IT and website teams at equipment, electronics/electrical, automotive, medical device, hardware, chemical, packaging and export manufacturers in Changzhou and nearby areas; also companies building a procurement audit programme or facing "audit not independent, arbitrary sampling, findings not closed, whistleblowing/fraud". It does not suit teams that do not audit procurement or have no internal audit, or want one page to replace legal/audit advice.

Read it if you are building a procurement audit page; audit reports to procurement; audit participates in award/approval; documents only; arbitrary sampling; findings lack criteria; remediation not tracked; repeat findings not escalated; reports do not reach the audit committee; the public page discloses findings. Skip it if you treat "checking accounts" as audit, "a meeting" as remediation, "second-party audit" as internal audit, or want to publish findings/suppliers. It supports self-review of independence, planning, scope, sampling, evidence, findings, remediation, accountability and page wording.

FAQ

What is the difference between procurement audit, supplier audit, three-way match and requisition approval?

Supplier audit is a second-party quality/capability/site audit; three-way match is PO/receipt/invoice reconciliation; requisition approval is ex-ante budget/authority/segregation; procurement audit is independent supervision and evaluation covering rules, process, data, contracts, prices, fraud, remediation and accountability. They are complementary and cannot replace each other.

Can audit check a buyer's WeChat/email/system logs?

Follow policy/authority, personal information protection and data security: minimum necessity, approval, confidentiality and scope. System logs/work emails may be checked under authority; personal devices/private chats require caution and cannot be searched at will; fraud/legal leads may be referred to discipline inspection/judicial authorities. The page should say "lawful, authorised, minimum necessary, confidential", not "search freely".

How should sampling be done and how large should the sample be?

Define the population, then choose full testing or statistical/judgment sampling based on risk/amount/category/anomaly; high-risk/large/sole-source/anomalous transactions should be fully tested; sample size depends on confidence/tolerable error/population size and is not universal; use data analytics to screen splitting, price changes, concentration, account changes and duplicate payments. Keep the sampling plan, basis and working papers.

How are findings and remediation closed?

Findings state condition/criteria/cause/effect/recommendation/owner/deadline; management responds in writing; remediation plan, reminders, evidence, verification, closure/extension approval; major/repeat/false remediation is escalated to the audit committee/board and may be linked to assessment/appointment/reward; discipline/law violation leads are referred. "The report is done" is not closure.

Can internal audit participate in procurement decisions?

It should not participate in award, approval or payment execution, as this impairs independence; it may provide advice, process assessment and recommendations but not take management responsibility. If participation is unavoidable, use independence safeguards/recusal/disclosure and obtain audit committee/board approval.

Should the website publish audit findings/supplier lists?

Usually not specific findings, supplier/employee names, prices/contracts, fraud investigations, working papers, pending cases or internal reports. The public page can explain scope, independence, process, whistleblowing channel and confidentiality commitment; detailed reports are distributed under control or submitted after login.

One-sentence takeaway

A Changzhou manufacturer's procurement audit/internal audit page is not about "checking accounts periodically". It should turn independence/reporting line, annual plan/risk, scope/types, sampling/evidence, procedure/working papers, finding grading, remediation/follow-up/accountability, reporting/confidentiality, whistleblowing/cooperation and the public boundary into a reviewable checklist—so procurement, finance and internal audit can stay independent, plan, sample, collect evidence, report, remediate and hold accountable.

Method and limitations

This is a review of public rules and page practice, not legal, audit or internal-control advice. No undisclosed audit findings, supplier/employee information, prices/contracts, fraud investigations or working papers were used; types, tables and acceptance items are editorial, not legal/audit conclusions. The Measures for the Administration of Internal Audit Work (Audit Office Order No. 11 of 2018) Article 3 definition, Article 5 independence/confidentiality, Article 6 leadership, Article 12 duties, Article 16 procedures, Article 20 results/cooperation, Article 21 referral; Accounting Law Article 27 internal accounting supervision/segregation; Audit Law (2021 amendment) as an audit-principle reference (applies to audit institutions; corporate internal audit is directly governed by the Audit Office's internal audit measures); the law, internal audit standards, company policy and audit committee's requirements control. This article does not determine whether a specific audit project/finding/remediation is compliant; companies should review item by item.

Sources and scope

Information is current to 2026-11-08. The following are official pages; their text controls.

1. Measures for the Administration of Internal Audit Work (Audit Office Order No. 11, promulgated 12 January 2018, effective 1 March 2018): The State Council of China. Definition (Article 3), independence/confidentiality (Article 5), leadership (Article 6), duties (Article 12), procedures (Article 16), results/cooperation (Article 20), referral (Article 21).
2. Accounting Law of the People's Republic of China (amended 28 June 2024, effective 1 July 2024): National Database of Laws and Regulations. Article 27 internal accounting supervision system, clear and mutually separated/constrained approval/handling/custody/recording duties.
3. Audit Law of the People's Republic of China (amended 23 October 2021, effective 1 January 2022): National Database of Laws and Regulations. Audit principles/procedure reference (applies to audit institutions; corporate internal audit is directly governed by the Audit Office's internal audit measures).