Definition
SOC for Supply Chain is part of the AICPA SOC suite, introduced in 2020. The engagement is an examination of a production, manufacturing or distribution system. Management's description of that system is evaluated against DC section 300, and the controls are evaluated against the trust services criteria for the categories in scope. The report helps customers and others assess risks from a supplier's production and distribution processes.
Why it matters in an audit or review
Auditors meet it less often than SOC 1 or SOC 2 because it is aimed at supply chain risk, not financial reporting controls. It can inform an understanding of how a key supplier's system operates, for example when inventory purchases come from a single dominant supplier.
Example
Illustrative: a medical device maker asks its component supplier for a SOC for Supply Chain report covering security and processing integrity of the supplier's production and shipping system, in addition to the supplier's financial statement audit.
Common mistakes
- Using it as a substitute for a SOC 1 when the user auditor needs controls over transactions affecting financial statements.
- Assuming it follows the SOC 2 description criteria. It uses DC 300.
Sources
- AICPA, DC Section 300, 2020 Description Criteria for a Description of an Entity's Production, Manufacturing, or Distribution System in a SOC for Supply Chain Report
- AICPA, Guide: SOC for Supply Chain
- AICPA, SOC suite overview, https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error