SOC for Supply Chain

Appendix EIllustrative SOC for Supply Chain Report (Including Entity Management's Assertion, Accountant's Report, and Illustrative Description of the System)

This appendix is nonauthoritative and is included for informational purposes only.

Note to Readers: In the following illustrative SOC for Supply Chain report, Company X has engaged the practitioner to examine and report on the description of the system that manufactures and distributes widgets and the effectiveness of controls therein, which are necessary to provide reasonable assurance that the company's principal system objectives were achieved based on the applicable trust services criteria relevant to security and availability.

This illustrative report assumes that, as discussed in the description in section 3, the components received from Company Y are a critical part of Company X's manufacture of its widgets. Company X management has decided to use the carve‐out method for Company Y, and the assertion and report include certain disclosures related to Company Y and the complementary supplier controls that it is expected to have in place.

Report on Company X's Description of Its Widget Manufacturing and Distribution System and on the Effectiveness of Its Controls Relevant to Security and Availability Throughout the Period January 1, 20X1, to December 31, 20X1

CONTENTS

• Section 1 — Assertion of Company X's Management
• Section 2 — Independent Accountant's Report
• Section 3 — Company X's Description of Its Widget ...