Transparency in the supply chain creates lasting confidence

Risks travel round the globe

The world of products and services is thoroughly globalised. The internet of things, digitalisation and automation of processes have made the manufacture and distribution of goods increasingly interconnected. This has brought manufacturing, supplying and retailing companies closer together and closer to their customers. Which is why supply chains have become more fragile.

This fragility becomes evident when the supply chain is disrupted, for example during the global lockdowns following the outbreak of the pandemic in the spring of 2020 or when the Suez Canal was blocked by the container ship Ever Given in the spring of 2021. On 17 March 2000, a lightning strike knocked out a fabrication line of silicon wafers at Royal Philips Electronics in New Mexico. Chip manufacture for thousands of smartphones was affected, which pushed one of the market leaders at the time out of the market.

Events such as these shine a light on risks in the supply chain that were previously thought to be unimportant. Such events lengthen supply lead times and it usually takes a period of 6 to 12 months for the system to stabilise again. Virtually overnight there are shortages of raw materials, semi-manufactured goods, components and spare parts or there is no alternative to a monopoly supplier. Procurement bottlenecks are still widespread. At least in the coming months they will likely continue to pose a challenge, especially to companies with international supply chains.

Further risks from cyberspace

The pandemic-induced leap forward in digitalisation has also brought virtual risks into play, for example from cyber attacks, including the theft of business-sensitive information on production cycles, company offices, transactions and sales or – worse still – the misuse of sensitive customer information. Moreover, distributed production is increasingly common in product manufacturing. Businesses have become much more aware of supply chain risks and thus of the need for greater transparency in the supply chain since the outbreak of the pandemic.

Standard setters forcing the pace

The American Institute of Certified Public Accountants (AICPA) has responded to these challenges and published a framework for reporting on the risk management of supply chains: System and Organisation Controls (SOC) for Supply Chain. This standard gives both the manufacturing and retail industry and their customers a practical tool to communicate the processes, structures, risks and controls of supply chains in a more transparent way.

New report with tried-and-tested criteria

The SOC supply chain report works in the same way as the established report types¹ SOC 1, SOC 2 and SOC 3. The reporting entities are required to describe the control processes and structures in their supply chains based on the detailed description criteria DC300. Companies must also demonstrate that the internal controls are effective on the basis of the trust services criteria (TSC). These criteria document how the risks of security, availability, integrity, confidentiality and/or data privacy can be mitigated. Auditors also apply TSC criteria in an SOC 2 examination.

Benefits in practice

The SOC report for the supply chain is an effective instrument for manufacturing, sales and supplier organisations and their clientele in several different ways. 

• An SOC report for the supply chain demonstrates that processes and internal control mechanisms have been put in place to identify, evaluate, address and mitigate supply chain risks. 
• The one-off assessment can be used for multiple reporting. Thus, a company can respond quickly to numerous separate queries from current or future customers and avoid the company itself or a supply chain partner having to be audited multiple times.
• An SOC report provides assurance that products and information within the supply chain are secure and available. As a central communication instrument, it strengthens the trust of supply chain partners and dialogue groups – and has a positive and confidence-building impact on a company’s image.

But? 

To date very few SOC reports for the supply chain are being requested and thus corresponding assurance engagements performed. This is surprising, since both the market environment and standard setters have made clear that supply chain risks are becoming more pressing and companies can no longer ignore them, as the examples we have mentioned demonstrate.

¹The SOC 1 report type examines the controls at a service organisation relevant to internal controls over financial reporting (ICFR). A type I report is a report as of a specified date, while a type II report examines the effectiveness of controls throughout a specified period. An SOC 2 report provides information on internal controls relevant to security, availability, processing integrity, confidentiality and/or privacy. The report can be in either type I or type II format. As with SOC 2, the SOC 3 report type relates to internal controls of security, availability, integrity and confidentiality and/or privacy. An SOC 3 report does not contain any information on the individual controls that were examined and the results. This report type is usually intended for general use by a variety of different addressees.