內部稽核（Self-Audit）

Self-Audits

During the period in which the CA issues Certificates, the CA SHALL monitor adherence to its Certificate Policy, Certification Practice Statement and these Requirements and strictly control its service quality by performing self audits on at least a quarterly basis against a randomly selected sample of the greater of one certificate or at least three percent of the Certificates issued by it during the period commencing immediately after the previous self-audit sample was taken.

於憑證機構（Certification Authority，CA）簽發憑證期間，CA 應（SHALL）監督其憑證政策（CP）、憑證實務作業基準（CPS）及本文件要求規定之遵循情形，並至少每季自前次內部稽核樣本抽取範圍之後立即起算之期間內所簽發之憑證中，隨機抽取一張憑證或至少 3% 數量之憑證（以數量較多者為準）作為樣本進行一次內部稽核（Self-Audit），以嚴格管控其服務品質。

Effective 2025-03-15, the CA SHOULD use a Linting process to verify the technical accuracy of Certificates within the selected sample set independently of previous linting performed on the same Certificates.

自 2025-03-15 起，CA 宜（SHOULD）採用 Linting 流程，對選定之樣本集中的憑證進行技術準確度驗證，並與先前對同一張憑證所進行之 Linting 作業相互獨立。

Except for Delegated Third Parties that undergo an annual audit that meets the criteria specified in Section 8.4, the CA SHALL strictly control the service quality of Certificates issued or containing information verified by a Delegated Third Party by having a Validation Specialist employed by the CA perform ongoing quarterly audits against a randomly selected sample of at least the greater of one certificate or three percent of the Certificates verified by the Delegated Third Party in the period beginning immediately after the last sample was taken. The CA SHALL review each Delegated Third Party’s practices and procedures to ensure that the Delegated Third Party is in compliance with these Requirements and the relevant Certificate Policy and/or Certification Practice Statement.

除每年接受符合第 8.4 節所定準則之稽核的受委任第三方外，CA 應（SHALL）由其所僱用之驗證專員（Validation Specialist），持續按季自前次樣本抽取範圍之後的受委任第三方所驗證之憑證中，隨機抽取至少一張憑證或 3% 數量之憑證（以數量較多者為準）作為樣本進行稽核，以嚴格管控由受委任第三方簽發，或含有經受委任第三方驗證之資訊的憑證之服務品質。CA 應（SHALL）審查每一個受委任第三方之實務作業及程序，以確保該受委任第三方遵循本文件要求規定及相關憑證政策（CP）及／或憑證實務作業基準（CPS）。

The CA SHALL internally audit each Delegated Third Party’s compliance with these Requirements on an annual basis.

CA 應（SHALL）每年對每一個受委任第三方遵循本文件要求規定之情形進行內部稽核。

During the period in which a Technically Constrained Subordinate CA issues Certificates, the CA which signed the Subordinate CA SHALL monitor adherence to the CA’s Certificate Policy and the Subordinate CA’s Certification Practice Statement. On at least a quarterly basis, against a randomly selected sample of the greater of one certificate or at least three percent of the Certificates issued by the Subordinate CA, during the period commencing immediately after the previous audit sample was taken, the CA shall ensure all applicable CP are met.

於受技術約束之下屬憑證機構（Technically Constrained Subordinate CA）簽發憑證期間，簽章該下屬憑證機構憑證之 CA 應（SHALL）監督該 CA 之憑證政策（CP）及該下屬憑證機構之憑證實務作業基準（CPS）的遵循情形。該 CA 應至少每季自前次稽核樣本抽取範圍之後立即起算之期間內該下屬憑證機構所簽發之憑證中，隨機抽取一張憑證或至少 3% 數量之憑證（以數量較多者為準）作為樣本，以確保所有適用之憑證政策（CP）均獲遵循。