In March 2020, the AICPA launched SOC for Supply Chain, a risk reporting framework designed for organizations involved in producing, manufacturing, or distributing goods. The framework is part of the AICPA’s broader System and Organization Controls (SOC) suite, which also includes SOC 1, SOC 2, SOC 3, and SOC for Cybersecurity. Organizations evaluating these reporting options can explore LBMC’s SOC audit services to better understand which type of SOC examination aligns with their systems, risks, and stakeholder requirements.
What is SOC for Supply Chain?
Today, in large part due to technology innovations, supply chains are quite complex and include interdependence and connections between organizations that manufacture or produce goods or products and their suppliers, distributors, and business partners. The existence of multiple entities within the supply chain comes with an inherent level of risk. Some examples include:
- Products may be provided that do not meet defined product performance specifications.
- Delivery and quality commitment requirements may not be met.
- Production, manufacturing, or distribution commitment requirements may not be met.
The new SOC for Supply Chain framework is designed to identify, assess, and address these supply chain risks.
Who is interested in this report?
Any entity in the supply chain can benefit from the SOC for Supply Chain assessment. Companies that produce, manufacture, or distribute products, as well as their suppliers, can utilize the report to demonstrate how they have addressed risk in their environment. The SOC for Supply Chain report communicates useful information about a company’s systems and the controls within the systems to customers, business partners, and prospective customers and business partners.
Why is a CPA involved in this report?
Like the other SOC reporting frameworks, SOC for Supply Chain assessments are completed by a CPA firm. Because the CPA firm is required to follow all guidance issued by both the AICPA and individual state boards of accountancy, the consumer of the report gains a higher level of assurance and reliability from the final report. Additionally, many CPA firms, like LBMC, provide information security and cybersecurity services and the inclusion of SOC for Supply Chain assessments is a natural extension of existing expertise and experience. Additionally, LBMC’s team of assessors has significant experience with evaluating the effectiveness of controls relevant to security, availability, processing integrity, confidentiality, and privacy.
What information does the report consist of?
Similar to SOC 2 reporting, SOC for Supply Chain is based on the AICPA’s Trust Services Criteria (TSC): Security, Availability, Confidentiality, Processing Integrity, and Privacy.
| Criteria | Criteria Objectives |
| Security | Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to meet its objectives. |
| Availability | Information and systems are available for operation and use to meet the entity’s objectives. |
| Confidentiality | Information designated as confidential is protected to meet the entity’s objectives. |
| Processing Integrity | System processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives. |
| Privacy | Personal information is collected, used, retained, disclosed, and disposed to meet the entity’s objectives. |
As the Security category is foundational to the TSC, it is required in every SOC for Supply Chain assessment. Organizations can choose to also include any combination of the other four criteria, according to the needs and relevance of each to their customers.
Because SOC for Supply Chain and SOC 2 use the Trust Services Criteria, organizations preparing for an assessment should evaluate whether their existing controls are sufficiently designed, documented, and consistently performed. Reviewing common SOC 2 compliance gaps can help teams identify weaknesses in their control environment before those issues surface during formal testing.
Preparation is especially important because the examination requires coordination between management, control owners, and the independent auditor. Understanding common SOC audit challenges can help organizations anticipate issues involving documentation, evidence collection, control ownership, and audit readiness before fieldwork begins.
The examination is generally performed on the organization’s system(s) that produce, manufacture, or distribute products. The SOC for Supply Chain report consists of the following components:
Section I: The independent auditor’s opinion
The independent auditor defines the scope of what was examined as part of the assessment and provides an opinion on Management’s description of the system (as detailed in Section III below) as well as the design and operating effectiveness of the controls stated in the description.
Section II: Management’s assertion
Management provides a written assertion that the description of the system (as detailed in Section III below) is presented accurately and in accordance with the AICPA’s description criteria and the controls identified to support the achievement of its principal system objectives were effective based on the applicable TSC.
Section III: Management’s description
Management prepares a narrative description of the production, manufacturing, or distribution system used for producing a good or set of related goods (i.e., the system that is being evaluated). The description of the system is to be presented in accordance with the AICPA’s description criteria. While the criteria used for the SOC for Supply Chain assessment are the same as those used for the SOC 2, specific description criteria were defined to focus on information applicable to supply chain risks.
Section IV: The independent auditor’s test of controls and results
The independent auditor provides a description of the testing procedures performed to evaluate the design and operating effectiveness of controls management has identified to support the achievement of its principal system objectives. Further, the results of the testing procedures used to support the opinion stated in Section I are detailed.
Use of the SOC for Supply Chain report is restricted, meaning it is limited in its distribution and is not for public or general use.
Prepare for a SOC for Supply Chain Assessment
For manufacturers, distributors, and other organizations operating within complex supply chains, demonstrating effective controls can provide customers and business partners with greater confidence in how supply chain risks are managed.
LBMC’s SOC audit services can help organizations determine the appropriate reporting approach and navigate the assessment process, from defining scope and applicable Trust Services Criteria through control testing and reporting.
Organizations with broader financial reporting, risk, and assurance needs can also explore LBMC’s audit and assurance services.
Ready to evaluate whether SOC for Supply Chain is right for your organization? Contact LBMC to discuss your reporting requirements and next steps.
Content provided by LBMC cybersecurity professional, Richard Beard.
