book

SOC for Supply Chain

Name: SOC for Supply Chain
Author: AICPA
ISBN: 9781948306959

by AICPA

June 2020

Intermediate to advanced

368 pages

12h 4m

English

Wiley

Read now

Unlock full access

Cover
Preface
About AICPA GuidesPurpose and ApplicabilityTerms Used to Define Professional Responsibilities in This AICPA GuideReferences to Professional StandardsExaminations of System and Organization Controls: SOC Suite of ServicesDescription Criteria for a Description of an Entity's System in a SOC for Supply Chain ReportTrust Services CriteriaApplicability of Quality Control StandardsRecognitionAICPA.org WebsiteNotes
Chapter 1: Introduction and Background
IntroductionIntended Users of a SOC for Supply Chain ReportOverview of a SOC for Supply Chain ExaminationContents of the SOC for Supply Chain ReportDefining the System to Be ExaminedOther Engagement ConsiderationsMatters Not Addressed by a SOC for Supply Chain ExaminationCriteria for a SOC for Supply Chain ExaminationThe Practitioner's Opinion in a SOC for Supply Chain ExaminationOther Types of SOC Examinations: SOC Suite of ServicesProfessional StandardsDefinitionsNotes
Chapter 2: Accepting and Planning a SOC for Supply Chain Examination
IntroductionUnderstanding Entity Management's ResponsibilitiesResponsibilities of the PractitionerEngagement Acceptance and ContinuanceIndependenceCompetence of Engagement Team MembersPreconditions of the EngagementRequesting a Written Assertion and Representations From Entity ManagementAgreeing on the Terms of the EngagementEstablishing an Overall Examination Strategy for and Planning the ExaminationPerforming Risk Assessment ProceduresConsidering Entity‐Level ControlsUnderstanding the Internal Audit FunctionPlanning to Use the Work of a Practitioner's SpecialistIdentifying Customer Responsibilities and Complementary Customer ControlsIdentifying Suppliers and Complementary Supplier ControlsPlanning to Use the Work of an Other PractitionerNotes
Chapter 3: Performing the SOC for Supply Chain Examination
IntroductionDesigning Overall Responses to the Risk AssessmentDesigning and Performing ProceduresObtaining Evidence About Whether the Description Presents the System That Was Designed and Implemented in Accordance With the Description CriteriaEvaluating Description Misstatements Identified During the ExaminationConsidering Whether the Description Is Misstated or Otherwise MisleadingObtaining Evidence About the Suitability of the Design of ControlsEvaluating Deficiencies in the Suitability of Design of ControlsObtaining Evidence About the Operating Effectiveness of ControlsNature of Tests of ControlsTiming of Tests of ControlsExtent of Tests of ControlsTesting Superseded ControlsUsing Sampling to Select Items to Be TestedAdditional Risk Considerations Related to Suppliers and Business PartnersConsidering Controls That Did Not Need to Operate During the Period Covered by the ExaminationIdentifying and Evaluating Deviations in the Effectiveness of ControlsMateriality Considerations When Evaluating Deficiencies in the Effectiveness of ControlsUsing the Work of the Internal Audit FunctionUsing the Work of a Practitioner's SpecialistRevising the Risk AssessmentResponding to and Communicating Known and Suspected Fraud, Noncompliance With Laws or Regulations, Uncorrected Misstatements, and Deficiencies in the Effectiveness of ControlsObtaining Written RepresentationsSubsequent Events and Subsequently Discovered FactsDocumentationConsidering Whether Entity Management Should Modify Its AssertionNotes
Chapter 4: Forming the Opinion and Preparing the Practitioner's Report
Responsibilities of the PractitionerForming the Practitioner's OpinionDescribing Tests of Controls and Results of Tests in the Practitioner's ReportPreparing the Practitioner's SOC for Supply Chain ReportReporting When the Practitioner Assumes Responsibility for the Work of an Other PractitionerModifications to the Practitioner's OpinionReport Paragraphs Describing the Matter Giving Rise to the ModificationOther Matters Related to the Practitioner's ReportPractitioner's Recommendations for Improving ControlsOther Information Not Covered by the Practitioner's ReportIllustrative ReportPreparing a SOC for Supply Chain Report in a Design‐Only ExaminationNotes
Supplement A: Supplement A2020 Description Criteria for a Description of an Entity’s Production, Manufacturing, or Distribution System in a SOC for Supply Chain Report 2020 Description Criteria for a Description of an Entity’s Production, Manufacturing, or Distribution System in a SOC for Supply Chain Report
Notes
Supplement B: Supplement B2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy
Notes
Appendix A: Information for Entity Management
Introduction and BackgroundIntended Users of a SOC for Supply Chain ReportOverview of a SOC for Supply Chain ExaminationContents of the SOC for Supply Chain ReportDescription Criteria for Preparation of the Description of an Entity's SystemThe Trust Services Criteria for Evaluation of Control EffectivenessThe Entity's System Objectives and Principal System ObjectivesMatters Not Addressed by a SOC for Supply Chain ExaminationEntity Management Responsibilities Prior to Engaging the PractitionerDefining the System to Be ExaminedSelecting the Trust Services Category or Categories to Be Addressed by the ExaminationIdentifying Customer Responsibilities and Complementary Customer ControlsIdentifying Suppliers and Complementary Supplier ControlsAgreeing on the Terms of the EngagementEntity Management Responsibilities During the ExaminationPreparing the Description of the Service Organization's SystemMateriality Considerations When Preparing the Description in Accordance With the Description CriteriaProviding a Written AssertionEntity Management's Responsibilities During Engagement CompletionModifying the AssertionOther Types of SOC Examinations: SOC Suite of ServicesNotes
Appendix B: Comparison of SOC for Supply Chain, SOC 2®, and SOC for Cybersecurity Examinations and Related Reports

Appendix C: Illustrative Management Assertion in a SOC for Supply Chain Examination
Note
Appendix D: Illustrative Accountant's Report for a SOC for Supply Chain Examination
Notes
Appendix E: Illustrative SOC for Supply Chain Report (Including Entity Management's Assertion, Accountant's Report, and Illustrative Description of the System)
Report on Company X's Description of Its Widget Manufacturing and Distribution System and on the Effectiveness of Its Controls Relevant to Security and Availability Throughout the Period January 1, 20X1, to December 31, 20X1Section 1 — Assertion of Company X's ManagementSection 2 — Independent Accountant's ReportSection 3 — Company X's Description of Its Widget Manufacturing and Distribution SystemSection 4 — Trust Services Categories, Criteria, Related Controls, and Tests of ControlsSection 5 — Other Information Provided by Company X Management That Is Not Covered by the Accountant's Report
Appendix F: Definitions
Appendix G: Overview of Statements on Quality Control Standards
Communication of Quality Control Policies and ProceduresElements of a System of Quality ControlLeadership Responsibilities for Quality Within the Firm (the “Tone at the Top”)Relevant Ethical RequirementsAcceptance and Continuance of Client Relationships and Specific EngagementsHuman ResourcesEngagement PerformanceMonitoringDocumentation of Quality Control Policies and ProceduresNotes
Index of Pronouncements and Other Technical Guidance
Subject Index
End User License Agreement

Content preview from SOC for Supply Chain

Preface

(As of March 1, 2020)

About AICPA Guides

This AICPA Guide, Reporting on an Examination of Controls Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy in a Production, Manufacturing, or Distribution System, has been developed by members of the SOC for Supply Chain Working Group of the AICPA Assurance Services Executive Committee (ASEC) in conjunction with members of the Auditing Standards Board (ASB).

The purpose of the guide is to assist practitioners engaged to examine and report on a system that produces, manufactures, or distributes products, including controls over one or more of the following:

The security of the entity's system
The availability of the entity's system
The processing integrity of the entity's system
The confidentiality of the information that the entity's system processes or maintains for customers and business partners
The privacy of personal information that the entity's system collects, uses, retains, discloses, and disposes of for customers and business partners

An AICPA Guide containing attestation guidance is recognized as an interpretive publication as described in AT‐C section 105, Concepts Common to All Attestation Engagements.¹ Interpretative publications are recommendations on the application of Statements on Standards for Attestation Engagements (SSAEs) in specific circumstances, including engagements for entities in specialized industries. Interpretive publications are issued under the authority ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Technology in Supply Chain Management and Logistics

Publisher Resources

ISBN: 9781948306959Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

SOC for Supply Chain

by AICPA

Preface

About AICPA Guides

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.