Guide Reporting On An Examination of Controls Relevant To Security Availability Processing Integrity Confidentiality or Privacy in A Production Manufacturing or Distribution System Aicpa Full Chapter

Guide: Reporting on an Examination of
Controls Relevant to Security,

Availability, Processing Integrity,
Confidentiality, or Privacy in a
Production, Manufacturing, or
Distribution System Aicpa
Visit to download the full and correct content document:
https://ebookmass.com/product/guide-reporting-on-an-examination-of-controls-releva
nt-to-security-availability-processing-integrity-confidentiality-or-privacy-in-a-production
-manufacturing-or-distribution-system-aicpa/
Guide
Reporting on an Examination of Controls Relevant
to Security, Availability, Processing Integrity,
Confidentiality, or Privacy in a Production,
Manufacturing, or Distribution System
SOC for Supply Chain March 1, 2020
1910-75488
© 2020 American Institute of Certified Public Accountants. All rights reserved.
For information about the procedure for requesting permission to make copies of
any part of this work, please email Copyright-Permissions@aicpa-cima.com with your
request. Otherwise, requests should be written and mailed to Permissions Department,
220 Leigh Farm Road, Durham, NC 27707-8110 USA.
1 2 3 4 5 6 7 8 9 0 AAP 2 9 8 7 6 5 4 3 2 1 0
ISBN 978-1-94830-695-9 (Print)
ISBN 978-1-119-72340-0 (ePDF)
ISBN 978-1-948306-96-6 (ePub)
ISBN 978-1-119-72344-8 (oBook)
iii
Preface
(As of March 1, 2020)
About AICPA Guides

This AICPA Guide, Reporting on an Examination of Controls Relevant to Secu-
rity, Availability, Processing Integrity, Confidentiality, or Privacy in a Produc-
tion, Manufacturing, or Distribution System, has been developed by members of
the SOC for Supply Chain Working Group of the AICPA Assurance Services Ex-
ecutive Committee (ASEC) in conjunction with members of the Auditing Stan-
dards Board (ASB).
The purpose of the guide is to assist practitioners engaged to examine and re-
port on a system that produces, manufactures, or distributes products, includ-
ing controls over one or more of the following:
a. The security of the entity's system
b. The availability of the entity's system
c. The processing integrity of the entity's system
d. The confidentiality of the information that the entity's system pro-
cesses or maintains for customers and business partners
e. The privacy of personal information that the entity's system col-
lects, uses, retains, discloses, and disposes of for customers and
business partners
An AICPA Guide containing attestation guidance is recognized as an interpre-
tive publication as described in AT-C section 105, Concepts Common to All Attes-
tation Engagements.1 Interpretative publications are recommendations on the
application of Statements on Standards for Attestation Engagements (SSAEs)
in specific circumstances, including engagements for entities in specialized in-
dustries. Interpretive publications are issued under the authority of the ASB.
The members of the ASB have found the attestation guidance in this guide to
be consistent with existing SSAEs.
A practitioner should be aware of and consider the guidance in this guide ap-
plicable to his or her attestation engagement. If the practitioner does not apply
the attestation guidance included in an applicable interpretive publication, the
practitioner should document how the requirements of the SSAEs were com-
plied with in the circumstances addressed by such attestation guidance.
Any attestation guidance in a guide appendix or exhibit (whether a chapter
or back matter appendix or exhibit), though not authoritative, is considered
an other attestation publication. In applying such guidance, the practitioner
should, exercising professional judgment, assess the relevance and appropri-
ateness of such guidance to the circumstances of the engagement. Although
the practitioner determines the relevance of other attestation guidance, such
guidance in a guide appendix or exhibit has been reviewed by the AICPA Audit
and Attest Standards staff, and the practitioner may presume that it is appro-
priate.
The ASB and the Accounting and Review Services Committee (ARSC) are the
designated senior committees of the AICPA authorized to speak for the AICPA
1 All AT-C sections can be found in AICPA Professional Standards.
©2020, AICPA AAG-SSC

iv
on all matters related to attestation in their respective areas of responsibil-
ity. Conforming changes made to the attestation guidance contained in this
guide are approved by the ASB chair (or his or her designee) and the director of
the AICPA Audit and Attest Standards staff. Updates made to the attestation
guidance in this guide exceeding that of conforming changes are issued after
all ASB members have been provided an opportunity to consider and comment
on whether the guide is consistent with the SSAEs.
AICPA Guides may include certain content presented as a "supplement," "ap-
pendix," or "exhibit." A supplement is a reproduction, in whole or in part, of
authoritative guidance originally issued by a standard-setting body (includ-
ing regulatory bodies) and is applicable to entities or engagements within the
purview of that standard setter, independent of the authoritative status of the
applicable AICPA Guide. Appendixes and exhibits are included for informa-
tional purposes and have no authoritative status.
Purpose and Applicability

As previously discussed, this guide provides guidance to practitioners engaged
to examine and report on a system an entity uses to produce, manufacture, or
distribute products.
In April 2016, the ASB issued SSAE No. 18, Attestation Standards: Clarification
and Recodification, which includes AT-C section 105, AT-C section 205, Exam-
ination Engagements, and AT-C section 320, Reporting on an Examination of
Controls at a Service Organization Relevant to User Entities' Internal Control
Over Financial Reporting. AT-C sections 105 and 205 establish requirements
and application guidance for reporting on an entity's controls over its system
relevant to security, availability, processing integrity, confidentiality, or privacy.
AT-C section 320 includes requirements and application guidance that may be
relevant for reporting on an entity's controls over its system relevant to se-
curity, availability, processing integrity, confidentiality, or privacy because cer-
tain underlying circumstances of the subject matter addressed in this guide are
analogous to circumstances addressed in AT-C section 320.
The attestation standards enable a practitioner to report on subject matter
other than historical financial statements. A practitioner may be engaged to
examine and report on controls at an entity related to various types of subject
matter (for example, controls that affect customers' financial reporting or the
privacy of information processed for customers' customers).
Terms Used to Define Professional Responsibilities in

This AICPA Guide
Any requirements described in this guide are normally referenced to the ap-
plicable standards or regulations from which they are derived. Generally, the
terms used in this guide describing the professional requirements of the refer-
enced standard setter (for example, the ASB) are the same as those used in the
applicable standards or regulations (for example, "must" or "should").
Readers should refer to the applicable standards and regulations for more in-
formation on the requirements imposed by the use of the various terms used
to define professional requirements in the context of the standards and regula-
tions in which they appear.
AAG-SSC ©2020, AICPA

v
Certain exceptions apply to these general rules, particularly in circumstances
in which the guide describes prevailing or preferred industry practices for the
application of a standard or regulation. In these circumstances, the applica-
ble senior committee responsible for reviewing the guide's content believes the
guidance contained herein is appropriate for the circumstances.
References to Professional Standards

In citing attestation standards and their related interpretations, references to
standards that have been codified use section numbers within the codification
of currently effective SSAEs and not the original statement number.
Examinations of System and Organization Controls:

SOC Suite of Services
In 2017, the AICPA introduced the term system and organization controls
(SOC) to refer to the suite of services practitioners may provide relating to
system-level controls of an entity or system- or entity-level controls of other or-
ganizations. Formerly, SOC referred to service organization controls, and such
reports addressed controls around systems used to provide services. By redefin-
ing that acronym, the AICPA enables the introduction of new internal control
examinations that may be performed (a) for other types of organizations, in
addition to service organizations, and (b) on either system-level or entity-level
controls of such organizations. This guide provides interpretive guidance for
the relevant attestation standards used to report on the security, availability,
or processing integrity of a system or the confidentiality or privacy of the in-
formation processed by the system. The engagement discussed in this guide is
referred to as a SOC for Supply Chain examination. Other SOC engagements
include the following:
a. SOC 1® — SOC for Service Organizations: ICFR. Service organi-
zations may provide services that are relevant to their customers'
internal control over financial reporting and, therefore, to the au-
dit of financial statements. The requirements and guidance for
performing and reporting on such controls is provided in AT-C
sections 105 and 320. AICPA Guide Reporting on an Examina-
tion of Controls at an Entity Relevant to Customers' Internal Con-
trol Over Financial Reporting (SOC 1® ) provides relevant inter-
pretive guidance for the relevant standards to assist practitioners
engaged to examine and report on controls at service organizations
that are likely to be relevant to customers' internal control over
financial reporting.
b. SOC 2® — SOC for Service Organizations: Trust Services Criteria.
Some service organizations provide services that are relevant to
controls other than internal control over financial reporting, for
example, controls relevant to the security of a system or to the
privacy of information processed by a system for customers. The
requirements and guidance for performing and reporting on such
engagements are provided in AT-C sections 105, 205, and 320.
AICPA Guide SOC 2® Reporting on an Examination of Controls at a
Service Organization Relevant to Security, Availability, Processing
Integrity, Confidentiality, or Privacy provides interpretive guidance

vi
for the relevant attestation standards to assist practitioners en-
gaged to examine and report on the security, availability, or pro-
cessing integrity of a system or the confidentiality or privacy of the
information processed by the system.
c. SOC 3® — SOC for Service Organizations: Trust Services Crite-
ria for General Use Report. Although the requirements and guid-
ance for performing a SOC 3® examination are similar to those for
a SOC 2® examination, the reporting requirements are different.
Because of the different reporting requirements, a SOC 2® report
is appropriate only for specified parties with sufficient knowledge
and understanding of the entity and the system, whereas a SOC
3® report is ordinarily appropriate for general use. AICPA Guide
SOC 2® Reporting on an Examination of Controls at a Service Or-
ganization Relevant to Security, Availability, Processing Integrity,
Confidentiality, or Privacy provides guidance to assist practition-
ers engaged to examine and report on the security, availability, or
processing integrity of a system or the confidentiality or privacy of
the information processed by the system.
d. SOC for Cybersecurity. As part of an entity's cybersecurity risk
management program, an entity designs, implements, and operates
cybersecurity controls. An engagement to examine and report on a
description of the entity's cybersecurity risk management program
and the effectiveness of controls within that program is a cybersecu-
rity risk management examination. The requirements and guidance
for performing a cybersecurity risk management examination and
reporting on the results thereof are provided in AT-C sections 105,
205, and 320. AICPA Guide Reporting on an Entity's Cybersecu-
rity Risk Management Program and Controls provides interpretive
guidance for the relevant attestation standards to assist practition-
ers engaged to examine and report on the description of an entity's
cybersecurity risk management program and the effectiveness of
controls within that program.
This guide focuses on SOC for Supply Chain examinations. To help practition-
ers understand how this examination differs from several of the other SOC
examinations, appendix B, "Comparison of SOC for Supply Chain Examina-
tion With a SOC 2® Examination and a SOC for Cybersecurity Examination
and Related Reports," includes a table that compares the features of the three
types of engagements.
Description Criteria for a Description of an Entity’s System

in a SOC for Supply Chain Report
In March 2020, ASEC issued description criteria for a description of an entity's
system in a SOC for Supply Chain report. The criteria are codified in DC sec-
tion 300, 2020 Description Criteria for a Description of an Entity's Production,
Manufacturing, or Distribution System in a SOC for Supply Chain Report (de-
scription criteria),2 which are presented in supplement A.
In establishing and developing these criteria, ASEC followed due process pro-
cedures, including exposure of criteria for public comment. BL section 360R,
2 All DC sections can be found in AICPA Description Criteria.

vii
Implementing Resolutions Under Section 3.6 Committees,3 designates ASEC
as a senior technical committee with the authority to make public statements
without clearance from the AICPA council or the board of directors. Paragraph
.A44 of AT-C section 105 indicates that criteria promulgated by a body des-
ignated by the Council of the AICPA under the AICPA Code of Professional
Conduct are, by definition, considered suitable. Accordingly, these criteria are
suitable criteria for preparing and evaluating a description of a system in a
SOC for Supply Chain examination. ASEC has also published the description
criteria and made them available to users. Therefore, the description criteria
meet the requirements in paragraph .25bii of AT-C section 105 for criteria that
are both suitable and available for use in an attestation engagement.
Trust Services Criteria

Codified as TSP section 100, 2017 Trust Services Criteria for Security, Avail-
ability, Processing Integrity, Confidentiality, and Privacy (2017 trust services
criteria),4 the trust services criteria were established by ASEC for use by prac-
titioners when providing attestation or consulting services to evaluate controls
relevant to the security, availability, or processing integrity of one or more sys-
tems, or the confidentiality or privacy of information processed by one or more
systems, used by an entity. Entity management may also use the trust services
criteria to evaluate the suitability of design and operating effectiveness of such
controls.
In establishing and developing these criteria, ASEC followed due process pro-
cedures, including exposure of criteria for public comment. BL section 360R
designates ASEC as a senior technical committee with the authority to make
public statements without clearance from the AICPA council or the board of di-
rectors. Paragraph .A44 of AT-C section 105 indicates that criteria promulgated
by a body designated by the Council of the AICPA under the AICPA Code of
Professional Conduct are, by definition, considered suitable. Accordingly, these
criteria are suitable criteria for evaluating controls in a SOC for Supply Chain
examination. ASEC has also published the trust services criteria and made
them available to users. Therefore, the trust services criteria meet the require-
ments in paragraph .25bii of AT-C section 105 for criteria that are both suitable
and available for use in an attestation engagement.
Applicability of Quality Control Standards

QC section 10, A Firm's System of Quality Control,5 addresses a CPA firm's
responsibilities for its system of quality control for its accounting and audit-
ing practice. A system of quality control consists of policies that a firm estab-
lishes and maintains to provide it with reasonable assurance that the firm
and its personnel comply with professional standards, as well as applicable
legal and regulatory requirements. The policies also provide the firm with
reasonable assurance that reports issued by the firm are appropriate in the
circumstances.
3 All BL sections can be found in AICPA Professional Standards.

4 All TSP sections can be found in AICPA Trust Services Criteria.
5 The QC sections can be found in AICPA Professional Standards.

viii
QC section 10 applies to all CPA firms with respect to engagements in their
accounting and auditing practice. In paragraph .13 of QC section 10, an ac-
counting and auditing practice is defined as
a practice that performs engagements covered by this section, which
are audit, attestation, compilation, review, and any other services
for which standards have been promulgated by the AICPA Auditing
Standards Board (ASB) or the AICPA Accounting and Review Ser-
vices Committee (ARSC) under the "General Standards Rule" (ET
sec. 1.300.001) or the "Compliance With Standards Rule" (ET sec.
1.310.001) of the AICPA Code of Professional Conduct. Although stan-
dards for other engagements may be promulgated by other AICPA
technical committees, engagements performed in accordance with
those standards are not encompassed in the definition of an accounting
and auditing practice.6
In addition to the provisions of QC section 10, readers should be aware of other
sections within AICPA Professional Standards that address quality control con-
siderations, including the following provisions that address engagement-level
quality control matters for various types of engagements that an accounting
and auditing practice might perform:
• AU-C section 220, Quality Control for an Engagement Conducted
in Accordance With Generally Accepted Auditing Standards7
• AT-C section 105
Because of the importance of engagement quality, this guide includes an ap-
pendix, "Overview of Statements on Quality Control Standards." This appendix
summarizes key aspects of the quality control standard. This summarization
should be read in conjunction with QC section 10, AU-C section 220, AT-C sec-
tion 105, and the quality control standards issued by the PCAOB, as applicable.
Recognition
Auditing Standards Board (2018–2019)
Michael J. Santay, Chair
Monique Booker
Jay Brodish
Dora Burzenski
Joseph S. Cascio
Lawrence Gill
Audrey A. Gramling
Gaylen R. Hansen
Tracy Harding
Jan Herringer
Ilene Kassman
Kristen A. Kociolek
Alan Long
Sara Lord
Marcia L. Marien
6 All ET sections can be found in AICPA Professional Standards.

7 All AU-C sections can be found in AICPA Professional Standards.

ix
Richard Miller
Daniel D. Montgomery
Jere G. Shawver
Chad Singletary
This guide was approved by a majority of ASB members.
Assurance Services Executive Committee
(2018–2019)
Jim Burton, Chair
Bradley Ames
Christine M. Anderson
Mary Grace Davenport
Chris Halterman
Jennifer Haskell
Elaine Howle
Bryan Martin
Brad Muniz
Dyan K. Rohal
Miklos Vasarhelyi
SOC for Supply Chain Working Group
Chris Halterman, Chair
Neal Beggan
Mark Burnette
Jacqueline Easton
Forrest Frazier
Tom Haberman
Jackie Hensgen
Kim Koch
Chris Kradjan
Lev Lesokhin
Heather Paquette
Binita Pradhan
Soma Sinha
Rod Smith
Jeff Trent
Greg Witte
David Wood
AICPA Staff
Robert Dohrer
Chief Auditor
Audit and Attestation Standards
Amy Pawlicki
Vice President
Assurance and Advisory Innovation
Mimi Blanco-Best
Associate Director — Attestation Methodology and Guidance
Assurance and Advisory Innovation
Nisha Gordhan
Lead Manager
Product Management and Development

x
AICPA.org Website
The AICPA encourages you to visit its website at aicpa.org and the Financial
Reporting Center at www.aicpa.org/frc. The Financial Reporting Center sup-
ports members in the execution of high-quality financial reporting. Whether
you are a financial statement preparer or a member in public practice, this cen-
ter provides exclusive member-only resources for the entire financial reporting
process and provides timely and relevant news, guidance, and examples sup-
porting the financial reporting process. Another important focus of the Finan-
cial Reporting Center is keeping those in public practice up to date on issues
pertaining to preparation, compilation, review, audit, attestation, assurance,
and advisory engagements. Certain content on the AICPA's websites referenced
in this guide may be restricted to AICPA members only.

Table of Contents xi
TABLE OF CONTENTS
Chapter Paragraph
1 Introduction and Background .01-.75
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .01-.09
Intended Users of a SOC for Supply Chain Report . . . . . . . . . . . .10-.16
Overview of a SOC for Supply Chain Examination . . . . . . . . . . .17-.19
Contents of the SOC for Supply Chain Report . . . . . . . . . . . . . . . .20-.21
Defining the System to Be Examined . . . . . . . . . . . . . . . . . . . . . . . . . .22-.34
The Entity’s System Objectives and Principal System
Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27-.28
Selecting the Trust Services Category or Categories
to Be Addressed by the Examination . . . . . . . . . . . . . . . . . . . .29-.33
Determining the Time Frame for the Examination . . . . . . . . . . . .34
Other Engagement Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . .35-.41
Considerations for Entities That Distribute Products . . . . . . . . .35-.38
Considerations for Entities That Bundle Services With
Their Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39-.40
Considerations for a Design-Only Examination . . . . . . . . . . . . .41
Matters Not Addressed by a SOC for Supply Chain
Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42-.43
Criteria for a SOC for Supply Chain Examination . . . . . . . . . . . . .44-.62
Description Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45-.47
Trust Services Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48-.58
Evaluating the Entity’s Principal System Objectives . . . . . . . . . .59-.62
The Practitioner’s Opinion in a SOC for Supply Chain
Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63-.65
Other Types of SOC Examinations: SOC Suite of Services . . . .66
Professional Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .67-.74
Attestation Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68-.70
Code of Professional Conduct . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71
Quality in the SOC for Supply Chain Examination . . . . . . . . . .72-.74
Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75
2 Accepting and Planning a SOC for Supply Chain Examination .01-.154

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .01-.02
Understanding Entity Management’s Responsibilities . . . . . . . . . .03-.10
Entity Management’s Responsibilities Prior to
Engaging the Practitioner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .04-.07
Entity Management’s Responsibilities During the
Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .08-.09
Entity Management’s Responsibilities During
Engagement Completion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
Responsibilities of the Practitioner . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
Engagement Acceptance and Continuance . . . . . . . . . . . . . . . . . . .12-.15
Independence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16-.19
©2020, AICPA Contents

xii Table of Contents
Chapter Paragraph
2 Accepting and Planning a SOC for Supply Chain
Examination — continued
Competence of Engagement Team Members . . . . . . . . . . . . . . . . . .20-.24
Preconditions of the Engagement . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25-.49
Determining the Appropriateness of the Subject Matter . . . . .26-.27
Identifying the Components of the System to be
Examined . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28-.30
Determining the Boundaries of the System Being
Examined . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31-.38
Determining Whether Entity Management Is Likely to
Have a Reasonable Basis for Its Assertion . . . . . . . . . . . . . . .39-.43
Assessing the Suitability and Availability of Criteria . . . . . . . .44
Determining Whether the Entity’s Principal System
Objectives Are Reasonable in the Circumstances . . . . . . . .45-.49
Requesting a Written Assertion and Representations From
Entity Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50-.54
Agreeing on the Terms of the Engagement . . . . . . . . . . . . . . . . . . . .55-.64
Accepting a Change in the Terms of the Examination . . . . . .60-.64
Establishing an Overall Examination Strategy for and
Planning the Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65-.69
Performing Risk Assessment Procedures . . . . . . . . . . . . . . . . . . . . . .70-.106
Obtaining an Understanding of the Description of the
Entity’s System and Control Effectiveness . . . . . . . . . . . . . . .71-.83
Assessing the Risks of Material Misstatement . . . . . . . . . . . . . . .84-.95
Considering Materiality During Planning . . . . . . . . . . . . . . . . . . .96-.106
Considering Entity-Level Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107-.111
Understanding the Internal Audit Function . . . . . . . . . . . . . . . . . . . .112-.119
Planning to Use the Work of a Practitioner’s Specialist . . . . . . . .120-.126
Identifying Customer Responsibilities and Complementary
Customer Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .127-.133
Identifying Suppliers and Complementary Supplier
Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .134-.150
Suppliers Whose Controls Are Necessary for the
Entity to Achieve Its Principal System Objectives . . . . . . . . .134-.135
Complementary Supplier Controls . . . . . . . . . . . . . . . . . . . . . . . . . .136-.141
Using the Inclusive Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .142-.150
Planning to Use the Work of an Other Practitioner . . . . . . . . . . . .151-.154
3 Performing the SOC for Supply Chain Examination .01-.199

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .01
Designing Overall Responses to the Risk Assessment . . . . . . . . . .02-.03
Designing and Performing Procedures . . . . . . . . . . . . . . . . . . . . . . . .04
Obtaining Evidence About Whether the Description Presents
the System That Was Designed and Implemented
in Accordance With the Description Criteria . . . . . . . . . . . . . . .05-.59
Disclosures Related to the Types of Goods Produced,
Manufactured, or Distributed . . . . . . . . . . . . . . . . . . . . . . . . . . .17-.18
Contents ©2020, AICPA

Table of Contents xiii
Chapter Paragraph
3 Performing the SOC for Supply Chain Examination — continued
Disclosures About the Entity’s Principal System
Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19-.24
Disclosures About System Incidents . . . . . . . . . . . . . . . . . . . . . . . . .25-.28
Disclosures About Risks That May Have a Significant
Effect on the Entity’s Production, Manufacturing,
or Distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29-.30
Disclosures About Inputs to and Components of
the System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31-.32
Disclosures About Individual Controls and the Applicable
Trust Services Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33-.41
Disclosures About Complementary Customer
Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42-.43
Disclosures Related to Complementary Supplier Controls . . . .44-.56
Disclosures About Nonrelevant Criteria . . . . . . . . . . . . . . . . . . . . .57
Disclosures About Significant Changes to the System
During the Period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58-.59
Evaluating Description Misstatements Identified During
the Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60-.67
Considering Whether the Description Is Misstated or
Otherwise Misleading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68-.69
Obtaining Evidence About the Suitability of the Design
of Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70-.85
Multiple Controls Are Necessary to Address an
Applicable Trust Services Criterion . . . . . . . . . . . . . . . . . . . . . .77-.78
More Than One Control Addresses a Particular Risk . . . . . . . .79
Procedures to Obtain Evidence About the Suitability of
Design of Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80-.85
Evaluating Deficiencies in the Suitability of Design of
Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86-.88
Obtaining Evidence About the Operating Effectiveness
of Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89-.94
Designing and Performing Tests of Controls . . . . . . . . . . . . . . . . .91-.94
Nature of Tests of Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95-.110
Testing Review Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101-.102
Evaluating the Reliability of Information Produced by
the Entity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .103-.110
Timing of Tests of Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111-.112
Extent of Tests of Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .113-.118
Testing Superseded Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119-.120
Using Sampling to Select Items to Be Tested . . . . . . . . . . . . . . . . . . .121-.125
Selecting Items to Be Tested . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .124-.125
Additional Risk Considerations Related to Suppliers and
Business Partners . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .126-.136
Controls That Suppliers Expect the Entity to Implement . . . . . .126-.131
Entity Controls for Addressing Supplier Risks . . . . . . . . . . . . . . .132-.133
Complementary Supplier Controls . . . . . . . . . . . . . . . . . . . . . . . . . .134-.136

xiv Table of Contents
Chapter Paragraph
3 Performing the SOC for Supply Chain Examination — continued
Considering Controls That Did Not Need to Operate
During the Period Covered by the Examination . . . . . . . . . . . .137
Identifying and Evaluating Deviations in the Effectiveness
of Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138-.142
Materiality Considerations When Evaluating Deficiencies
in the Effectiveness of Controls . . . . . . . . . . . . . . . . . . . . . . . . . . .143-.146
Using the Work of the Internal Audit Function . . . . . . . . . . . . . . . . .147-.153
Using the Work of a Practitioner’s Specialist . . . . . . . . . . . . . . . . . .154-.157
Revising the Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .158-.162
Evaluating the Sufficiency and Appropriateness
of Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .159-.160
Evaluating the Results of Procedures . . . . . . . . . . . . . . . . . . . . . . . .161-.162
Responding to and Communicating Known and
Suspected Fraud, Noncompliance With Laws or
Regulations, Uncorrected Misstatements,
and Deficiencies in the Effectiveness of
Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .163-.169
Known or Suspected Fraud or Noncompliance With
Laws or Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .163-.165
Communicating Incidents of Known or Suspected Fraud,
Noncompliance With Laws or Regulations,
Uncorrected Misstatements, or Internal Control
Deficiencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .166-.169
Obtaining Written Representations . . . . . . . . . . . . . . . . . . . . . . . . . . .170-.183
Requested Written Representations Not Provided or
Not Reliable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .180-.181
Engaging Party Is Not the Responsible Party . . . . . . . . . . . . . . . .182
Representations From the Engaging Party When It Is Not
the Responsible Party . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .183
Subsequent Events and Subsequently Discovered Facts . . . . . . .184-.191
Subsequent Events Unlikely to Have an Effect on
the Practitioner’s Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192-.196
Considering Whether Entity Management Should Modify
Its Assertion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197-.199
4 Forming the Opinion and Preparing the Practitioner’s Report .01-.91

Responsibilities of the Practitioner . . . . . . . . . . . . . . . . . . . . . . . . . . . .01-.05
Forming the Practitioner’s Opinion . . . . . . . . . . . . . . . . . . . . . . . . . . .06-.15
Concluding on the Sufficiency and Appropriateness
of Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .08-.13
Expressing an Opinion on Each of the Subject Matters
in the SOC for Supply Chain Examination . . . . . . . . . . . . . . .14-.15
Describing Tests of Controls and Results of Tests in
the Practitioner’s Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16-.28
Describing Tests of Controls and Results When Using
the Internal Audit Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24-.26

Table of Contents xv
Chapter Paragraph
4 Forming the Opinion and Preparing the Practitioner’s
Report — continued
Describing Tests of the Reliability of Information Produced
by the Entity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27-.28
Preparing the Practitioner’s SOC for Supply Chain Report . . . . .29-.40
Elements of the Practitioner’s Report . . . . . . . . . . . . . . . . . . . . . . . .29
Restricting the Use of the Practitioner’s Report . . . . . . . . . . . . . . .30-.31
Reporting When There Are Complementary Customer
Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32-.35
Reporting When There Are Complementary Supplier
Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36-.40
Reporting When the Practitioner Assumes Responsibility
for the Work of an Other Practitioner . . . . . . . . . . . . . . . . . . . . . .41
Modifications to the Practitioner’s Opinion . . . . . . . . . . . . . . . . . . . .42-.67
Qualified Opinion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50-.51
Adverse Opinion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52-.56
Scope Limitation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57-.61
Disclaimer of Opinion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62-.67
Report Paragraphs Describing the Matter Giving Rise to
the Modification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68-.76
Illustrative Separate Paragraphs When There Are Material
Misstatements in the Description . . . . . . . . . . . . . . . . . . . . . . . .68-.73
Illustrative Separate Paragraph: Material Deficiencies in
the Effectiveness of Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . .74-.76
Other Matters Related to the Practitioner’s Report . . . . . . . . . . . . .77-.80
Emphasis-of-Matter Paragraphs and Other-Matter
Paragraphs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77-.78
Distribution of the Report by Management . . . . . . . . . . . . . . . . . .79-.80
Practitioner’s Recommendations for Improving Controls . . . . . . .81
Other Information Not Covered by the Practitioner’s
Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82-.86
Illustrative Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87-.88
Preparing a SOC for Supply Chain Report in a Design-Only
Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89-.91
Supplement
A 2020 Description Criteria for a Description of an Entity’s Production,
Manufacturing, or Distribution System in a SOC for Supply
Chain Report
B 2017 Trust Services Criteria for Security, Availability, Processing Integrity,
Confidentiality, and Privacy
Appendix
A Information for Entity Management
B Comparison of SOC for Supply Chain, SOC 2® , and SOC for

Cybersecurity Examinations and Related Reports

xvi Table of Contents
C Illustrative Management Assertion in a SOC for Supply Chain

Examination
D Illustrative Accountant’s Report for a SOC for Supply Chain
Examination
E Illustrative SOC for Supply Chain Report (Including Entity
Management’s Assertion, Accountant’s Report, and Illustrative
Description of the System)
F Definitions
G Overview of Statements on Quality Control Standards
Index of Pronouncements and Other Technical Guidance
Subject Index

Introduction and Background 1
Chapter 1
Introduction and Background
This chapter explains the relationship between an entity1 that produces, man-
ufactures, or distributes products and its suppliers, customers, and business
partners; provides examples of such entities and the products they produce,
manufacture, or distribute; explains the relationship between the products
and the system that produces, manufactures, or distributes them; describes
the components of the system and its boundaries; identifies the criteria used
to evaluate a description of an entity's system (description criteria); and iden-
tifies the criteria (applicable trust services criteria) used to evaluate whether
controls stated in the description, which are necessary to provide reasonable
assurance that an entity achieved its principal system objectives, were effec-
tive. This chapter also provides an overview of a SOC for Supply Chain ex-
amination and the standards under which the examination is performed. In
addition, it provides an overview of other SOC services.
Introduction
1.01 Manufacturing is the production of goods or products2 for use or sale
using labor and machines, tools, chemical and biological processing, or formula-
tion. The term manufacturing is most commonly applied to industrial produc-
tion, in which inputs such as raw materials and components are transformed
into finished goods on a large scale. Finished goods may be sold directly to
(a) end users (for example, medical devices sold to health systems); (b) other
manufacturers who produce other, more complex products (for example, air-
craft, household appliances, furniture, sports equipment, or automobiles); or (c)
wholesalers, who in turn sell the goods to retailers, who then sell them to end
users and consumers.
1.02 A manufacturing (or production) process refers to the steps through
which inputs are transformed into a finished good. The manufacturing pro-
cess begins with the product design and materials specification from which the
product is made. The raw materials (including components) are then modified
through manufacturing processes to become the finished good.
1.03 Once the goods are manufactured or produced, entities may use sys-
tems to distribute the products to customers (for example, an entity3 that dis-
tributes feature films or game DVDs). In contrast, entities may contract with a
third-party logistics company to manage the distribution of their products (for
example, an air bag manufacturer that contracts with a company to manage its
inventory shipment of replacement airbag components to auto repair shops).4
1 Terms defined in appendix F, "Definitions," are italicized on first mention within the text of
this guide.
2 Throughout this guide, the terms goods and products are used interchangeably.
3 As used in this guide, an entity produces or manufactures goods or provides distribution ser-
vices for goods.

4 Paragraph 1.35 provides considerations to help a practitioner determine whether to use the
guidance in this guide or that in AICPA Guide SOC 2® Reporting on an Examination of Controls
at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or
Privacy when engaged to examine and opine on a system and controls of a distributor.
©2020, AICPA AAG-SSC 1.03

2 SOC for Supply Chain
1.04 Distribution companies are entities that use systems to distribute

goods produced or manufactured by others. In some cases, they may repackage
goods produced or manufactured by others before transporting them to the final
customers. In other cases, they may only provide transportation services for
products manufactured or produced by others (for example, an express shipping
company).
1.05 Examples of entities that may produce, manufacture, or distribute
products include the following:
• Producers. Producers include entities that extract raw materials
through operations that remove metals, minerals, and aggregates
from the earth (such as oil and gas extraction, mining, dredging,
and quarrying); produce food, feed, fiber, and other products by
the cultivation of certain plants and the raising of domesticated
animals (livestock); and develop software for on-site installation.
• Manufacturers. Manufacturers include entities that transform
raw materials or components into other components or finished
goods for use or sale using labor and machines, tools, chemical and
biological processes, fabrication, or formulation. The components
or finished goods may be sold to other manufacturers for the pro-
duction of other products such as aircraft, computers or computer
parts, household appliances, furniture, sports equipment, or auto-
mobiles. In other cases, the finished goods may be sold to whole-
salers that, in turn, sell them to retailers that then sell them to
end users and consumers. Manufacturers include contract manu-
facturers that outsource manufacturing for other entities.
• Commercial software developers. Commercial software developers
are entities that develop and sell commercial software. Commer-
cial software developers are distinguished from software devel-
opment service providers that are engaged to create, modify, and
implement software to meet a particular entity's needs based on
a contract for services. The system that provides software devel-
opment services is best addressed by a SOC 2® examination.
• Distribution companies. Distribution companies include entities
that provide or manage all or a significant part of another entity's
logistics, including one or a combination of the following: inbound
freight, customs, warehousing, inventory management, order ful-
fillment (including picking and repackaging of items), distribu-
tion, or outbound freight. Such companies include third-party lo-
gistics (3PL or TPL) companies.
1.06 Due to rapid technological advancement, the production, manufactur-
ing, or distribution of products often involves a high level of interdependence
and connectivity between the entity and (a) organizations that supply raw ma-
terials or components for the manufacturing process (suppliers)5 and (b) its
customers and business partners. These relationships are often considered part
of the supply chain. A supply chain is a system of organizations, people, activ-
ities, information, and resources involved in moving a product from supplier
5 In this guide, a supplier is an individual or business (and its employees) that provides products
(such as raw materials, components, or other goods) or services to a producer, manufacturer, or dis-
tributor (an entity). A service provider, for example, is a specific type of supplier that provides services
to an entity.
AAG-SSC 1.04 ©2020, AICPA

to customer. Supply chain activities involve the transformation of natural re-
sources, raw materials, and components into finished goods. In sophisticated
supply chain systems, used products may reenter the supply chain at any point
where residual value is recyclable.
1.07 Although these relationships may increase revenues, expand market
opportunities, and reduce costs for the entity, they also result in additional risks
to the suppliers, customers, and business partners with whom the entity does
business. Accordingly, those suppliers, customers, and business partners are
responsible for identifying, evaluating, and addressing those additional risks as
part of their supply chain risk management programs. Such risks may threaten
the entity's ability to do the following:
• Provide products that meet the principal product performance

specifications.
• Meet delivery and quality commitments and other requirements.
• Meet production, manufacturing, or distribution commitments
and requirements.
1.08 For that reason, suppliers, customers and business partners expect
entity management to establish operational and compliance objectives. Such
objectives, which are referred to within this guide as system objectives, may also
change over time because of changing risks and changing laws and regulations.
1.09 To identify, assess, and address the risks arising from interactions be-
tween the entity and the system it uses to produce, manufacture, or distribute
products, suppliers, customers, and business partners usually need information
about the design, operation, and effectiveness of controls6,7 within the system.
To support their risk assessments, suppliers, customers, or business partners
may request an attestation report from the entity. Such a report is the result of
an attestation engagement in which a practitioner examines and opines on (a)
whether the description of the entity's system that produces, manufactures, or
distributes products (the description of the system or description) presents the
system that was designed and implemented in accordance with the description
criteria8 and (b) whether the controls stated in the description, which are nec-
essary to provide reasonable assurance that the entity achieved its principal
system objectives,9 were effective throughout the period, based on the applica-
ble trust services criteria.10 This examination, referred to as a SOC for Supply
Chain examination, or the examination, is the subject of this guide.
6 In this guide, controls are policies and procedures that are part of the entity's system. The
objective of an entity's system is to provide reasonable assurance that system objectives are achieved.
System objectives are discussed further beginning at paragraph 1.59.
7 Throughout this guide, the term effectiveness (as it relates to controls) encompasses both the
suitability of design and the operating effectiveness of controls to provide reasonable assurance that
system objectives are achieved.
8 The description criteria are discussed further beginning at paragraph 1.44.
9 The objective of an entity's system is to provide reasonable assurance that the entity's system
objectives are achieved. System objectives are discussed further beginning at paragraph 1.59.
10 Supplement B of this guide presents an excerpt from TSP section 100, 2017 Trust Services
Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (the 2017 trust
services criteria), which includes the criteria used to evaluate the effectiveness of controls relevant to
the trust services category or categories included within the scope of a specific examination. The use
of these criteria, referred to as the applicable trust services criteria, is discussed further beginning in
paragraph 1.44.
All TSP sections can be found in AICPA Trust Services Criteria.

Intended Users of a SOC for Supply Chain Report

1.10 A SOC for Supply Chain report is designed to provide intended users
with information about a system an entity uses to produce, manufacture, or
distribute products and the effectiveness of controls within that system (that
is, controls related to one or more of the applicable trust services categories —
security, availability, processing integrity, confidentiality, or privacy) to provide
reasonable assurance that the entity's principal system objectives are achieved
based on the applicable trust services criteria. The report is also designed to
provide intended users with information they may use to identify, assess, and
manage the risks that arise from their relationships with the entity.
1.11 A SOC for Supply Chain report is intended for use by those who have
sufficient knowledge and understanding of the entity; the products it produces,
manufactures, or distributes; and the system that produces, manufactures, or
distributes them. The expected knowledge of intended users ordinarily includes
the following:
a. The nature of the goods produced, manufactured, or distributed by
the entity
b. Internal control and its limitations
c. The applicable trust services criteria
d. The risks that may threaten the achievement of the entity's princi-
pal system objectives and how controls address those risks
1.12 Without such knowledge, intended users are likely to misunderstand

the content of the report, the assertions made by entity management, and the
practitioner's opinion, all of which are included in the SOC for Supply Chain
report. For that reason, the practitioner's report is required to be restricted to
intended users who possess that knowledge. Restricting the use of a practi-
tioner's report in a SOC for Supply Chain examination is discussed beginning
in paragraph 4.30. In addition, entity management and the practitioner ordi-
narily would agree on the intended users of the report.
1.13 In a SOC for Supply Chain report, the following intended users are
presumed to have the knowledge identified in paragraph 1.11:
a. Business customers, including immediate customers or similar
business entities further down the supply chain, that do the fol-
lowing:
i. Use the system's products as components of their produc-
tion and manufacturing systems (for example, production
machinery)
ii. Use the system's products as inputs to their products (for
example, computers used in automobiles)
iii. Use the system's products as a part of their service delivery
(for example, IV bags used by a hospital)
iv. Resell the products
v. Rely on a physical distribution system for products used
as inputs to products

Business customers need information about the entity's system, in-
cluding the nature and effectiveness of controls within that system,
to understand the entity's controls and to determine whether those
controls, in addition to their own controls, are sufficient to mitigate
their business risks.
b. Business partners that
i. are dependent on the entity for sales of the business part-
ners' goods or
ii. license the use of the business partners' intellectual prop-
erty to the entity.
Business partners may include affiliated organizations that are
customers or suppliers of the entity. Business partners need infor-
mation about the entity's system and the controls within that sys-
tem to manage and assess the risks associated with doing business
with the entity.
1.14 Intended users may also include entity personnel, practitioners pro-
viding services to the entity's customers and business partners, and regulators
who have sufficient knowledge and understanding as discussed in paragraph
1.11.
1.15 Parties other than those identified in paragraphs 1.13–.14 may also
have the requisite knowledge and understanding identified in paragraph 1.11.
For example, prospective customers and business partners may have gained
such knowledge while performing their supplier selection processes or while
assessing a supplier's compliance with regulatory requirements. In addition,
nonregulatory standard-setting bodies consisting of business customers or
business partners that represent their membership (for example, industry con-
sortiums) may also have the requisite knowledge. If they have the requisite
knowledge, prospective customers and business partners and nonregulatory
standard-setting bodies may be intended users of the report.
1.16 As previously discussed, the SOC for Supply Chain report has been
designed to meet the common information needs of intended users described in
this section. However, nothing precludes the practitioner from restricting the
use of the practitioner's report to a smaller subset of intended users.
Overview of a SOC for Supply Chain Examination

1.17 The practitioner performs a SOC for Supply Chain examination in
accordance with AT-C section 105, Concepts Common to All Attestation Engage-
ments, and AT-C section 205, Examination Engagements.11 Those standards es-
tablish performance and reporting requirements for the examination. Accord-
ing to those standards, an attestation examination is predicated on the concept
that a party other than the practitioner (the responsible party) makes an as-
sertion about whether the subject matter is measured or evaluated in accor-
dance with suitable criteria. An assertion is any declaration or set of declara-
tions about whether the subject matter is in accordance with, or based on, the
criteria.
11 All AT-C sections can be found in AICPA Professional Standards.

1.18 In a SOC for Supply Chain examination, entity management is usu-

ally the responsible party. However, in certain situations, there may be other re-
sponsible parties.12 As the responsible party, entity management prepares the
description of the entity's system that is included in the SOC for Supply Chain
report. In addition, the practitioner should request from entity management
a written assertion about the measurement or evaluation of the subject mat-
ter against the criteria.13 Management's written assertion, which is included in
the SOC for Supply Chain report, addresses whether (a) the description of the
entity's system is presented in accordance with the description criteria and (b)
the controls stated in the description, which are necessary to provide reason-
able assurance that the entity achieved its principal system objectives, were
effective throughout the period based on the applicable trust services criteria.
1.19 The practitioner designs and performs procedures to obtain sufficient
appropriate evidence to support an opinion about whether (a) the description
presents the system that was designed and implemented in accordance with
the description criteria and (b) the controls stated in the description, which are
necessary to provide reasonable assurance that the entity achieved its principal
system objectives, were effective throughout the period based on the applicable
trust services criteria. As discussed beginning in paragraph 1.20, the practi-
tioner also presents, in a separate section of the report, a description of the
practitioner's tests of controls and the results thereof.
Contents of the SOC for Supply Chain Report

1.20 A SOC for Supply Chain examination results in the issuance of a
SOC for Supply Chain report. The SOC for Supply Chain report includes four
key components:
1. Entity management's description of the system the entity uses to
produce, manufacture, or distribute products in accordance with
the description criteria
2. Entity management's assertion about whether, in all material re-
spects,
a. the description of the entity's system is presented in accor-
dance with the description criteria and
b. the controls stated in the description, which are necessary
to provide reasonable assurance that the entity achieved
its principal system objectives, were effective throughout
the period, based on the applicable trust services criteria
3. The practitioner's opinion about whether, in all material respects,
a. the description of the entity's system is presented in accor-
dance with the description criteria and
b. the controls stated in the description, which are necessary
to provide reasonable assurance that the entity achieved
its principal system objectives, were effective throughout
the period, based on the applicable trust services criteria
12 If the entity uses a supplier and elects to use the inclusive method for preparing the descrip-
tion, supplier management is also a responsible party. Entity management's and the practitioner's
responsibilities when the entity uses one or more suppliers and elects to use the inclusive method are
discussed further in chapter 2, "Accepting and Planning a SOC for Supply Chain Examination."
13 See paragraph .10 of AT-C section 205, Examination Engagements.

4. The practitioner's description of the procedures performed and the
results thereof14,15
1.21 The practitioner's opinion is discussed beginning in paragraph 1.63,
and the criteria used in the examination are discussed beginning in paragraph
1.44.
Defining the System to Be Examined

1.22 The subject matter of the examination discussed in this guide re-
volves around the system and related controls that the entity has designed,
implemented, and operated to manufacture, produce, or distribute goods. The
examination is flexible in terms of addressing any of the following:
• A system and controls that an entity uses to produce, manufac-
ture, or distribute a physical (for example, an airplane engine)
or intangible product (for example, a commercial off-the-shelf
[COTS] application)
• Systems and controls that an entity uses to operate a production
line
• Systems and controls that an entity uses to produce, manufacture,
or distribute goods produced or manufactured within a specific
facility or physical plant
1.23 Entity management is responsible for identifying the specific subject
matter to be examined, which includes identifying the components of the sys-
tem and the boundaries of the system to be examined. Entity management is
also responsible for establishing its principal system objectives and selecting
the trust services category or categories to be addressed by the examination, as
well as selecting the period of time to be addressed. The following paragraphs
provide a brief overview of each of these factors and how they might affect the
subject matter of the engagement.
1.24 A system is defined as the infrastructure, software, procedures, and
data that are designed, implemented, and operated by people to achieve one
or more of the organization's specific objectives (for example, objectives that
address the production or delivery of goods) in accordance with management-
specified requirements. System components can be classified into the following
five categories: (1) infrastructure, (2) software, (3) people, (4) data, and (5) pro-
cedures. For a manufacturing or production system, for instance, infrastructure
would include the components of the manufacturing system and the processes
by which they operate. Although inputs, such as raw materials, are not a com-
ponent of the system, they are often necessary for a product to be produced or
manufactured. For that reason, raw materials and other inputs (for example,
purchased components) that are important in the production or manufacturing
process are often disclosed in the description in addition to the components of
the system.
14 According to paragraph .A85 of AT-C section 205, the addition of procedures performed and
the results thereof in a separate section of an examination report may increase the potential for the
report to be misunderstood when taken out of the context of the knowledge of the requesting parties.
For that reason, a practitioner's report that contains a description of procedures and results is usually
restricted to intended users who are likely to understand it.
15 A description of procedures performed and results thereof would not be included in a design-
only examination. A design-only examination is discussed beginning at paragraph 1.41.

1.25 Determining the functions or processes that are outside the bound-
aries of the system being examined, and describing them in the description, is
also necessary to prevent intended users from misunderstanding the descrip-
tion of the system and the practitioner's opinion. Therefore, if there is a risk that
intended users might be confused about whether a specific function or process
is part of the system being examined, the description needs to clarify which
processes or functions are within the scope of the examination and which are
not.
1.26 Understanding the components of the system to be examined and
the boundaries thereof is also important to the practitioner because it affects
how the subject matter will be evaluated against the criteria, the nature of the
practitioner's examination procedures, and other matters. Describing the sys-
tem to be examined is discussed in further detail beginning at paragraph 2.28;
discussing the boundaries of the system is addressed beginning at paragraph
2.31. The following paragraphs provide guidance on other matters that might
affect the subject matter of a specific engagement.
The Entity’s System Objectives and Principal System Objectives

1.27 An entity adopts a mission and vision, sets strategies, and estab-
lishes objectives to help it meet its mission and vision based on its strate-
gies. Management designs and implements individual production, manufac-
turing, or distribution systems to achieve certain specific objectives (referred
to as system objectives) and designs and implements controls within the sys-
tem to mitigate the risks that would prevent the entity from achieving those
objectives.
1.28 A SOC for Supply Chain examination addresses the system objec-
tives that could reasonably be expected to influence the relevant decisions of
intended users. These system objectives, referred to as principal system objec-
tives, typically relate to the category or categories addressed by the examination
and to achieving commitments, specifications, or requirements. Management
discloses its principal system objectives in the system description.
Selecting the Trust Services Category or Categories to Be

Addressed by the Examination
1.29 In addition to identifying the components of the system, it is also
necessary to consider which trust services category or categories are to be ad-
dressed by the examination. As discussed in paragraph 1.48, the trust services
criteria are used to measure the effectiveness of controls in a SOC for Sup-
ply Chain examination. The examination can address any or all of the trust
services categories of security, availability, processing integrity, confidentiality,
or privacy. In most cases, the examination would address the category or cat-
egories that would best meet the information needs of intended users. Which
category or categories are addressed in the description is often determined by
considering the commitments the entity makes to its customers and business
partners.
1.30 Because of increased dependence on technology and concerns about
cybersecurity risks, security is likely to be addressed in most examinations per-
formed using the trust services criteria. Often, customers and business partners
of an entity are also interested in the effectiveness of controls over availability

because such controls may be integral to meeting their commitments. For in-
stance, a customer that relies on airbags manufactured by the entity is likely to
want information about the processes and controls the entity has designed and
implemented and operates to achieve the availability commitments it makes
to its customers. For those reasons, a SOC for Supply Chain examination that
addresses both security and availability is likely to meet the information needs
of intended users as a group.
1.31 In some cases, intended users may also be interested in the processing
integrity of the system the entity uses to produce, manufacture, or distribute
goods, including the processing integrity of the components of that system (for
example, hardware, tooling, software, and information). Processing integrity
addresses system controls that mitigate the risk that the entity's system objec-
tives will not be achieved because of failures in the production process. Assume
that a product contains embedded logic (for example, firmware of an embedded
computer) necessary to achieve one or more of the entity's principal system ob-
jectives, and the embedded logic is the subject of ongoing service commitments
the entity makes to its customers and business partners. In that case, intended
users may be interested in the process and controls the entity has designed
and implemented and operates to achieve the processing integrity of the sys-
tem, which includes the parts of the production system that are part of the
products themselves (for example, microcode in a CPU chip). In that situation,
an examination that addresses processing integrity, in addition to security and
availability, may best meet the needs of those intended users.
1.32 When an entity uses proprietary customer information or personal

information in the production process, intended users may also be interested in
controls over that information. In this case, an examination that also addresses
confidentiality or privacy may best meet users' needs.
1.33 In other situations, the omission of a category that is likely to be

important to report users may result in a misleading report. For example,
the practitioner may become aware that report users are primarily concerned
about cybersecurity risks arising from the interconnection of the entity's sys-
tem with users' systems. If entity management asked for a report addressing
only the availability category, such a report could be misunderstood by users,
who would expect the examination to address controls designed, implemented
and operated by the entity to mitigate its cybersecurity risks, not only those
that threaten the achievement of the entity's availability commitments. In this
situation, the practitioner might conclude that an examination addressing only
the availability category is likely to be misleading to report users and decide to
decline the engagement.
Determining the Time Frame for the Examination

1.34 Paragraph .A1 of AT-C section 105 states that the subject matter of
an attestation examination may be "as of a point in time" or "for a period of
time." Entity management is responsible for determining the time frame to be
addressed by the examination. Generally, a SOC for Supply Chain examina-
tion addresses the effectiveness of controls over a specified period of time. In
addition, the guidance in this guide is based on the assumption that the period
of time over which the effectiveness of controls will be evaluated is the same
period of time addressed by the description of the entity's system.

Other Engagement Considerations
Considerations for Entities That Distribute Products

1.35 When an entity distributes products, professional judgment is neces-
sary to determine whether the system and controls over the distribution pro-
cess would be best addressed by the examination described in this guide or by a
SOC 2® examination.16 Perhaps the most important consideration when mak-
ing this determination is whether the physical distribution of the products is
in any way transformative.
1.36 As an example, consider a wholesaler that receives products from
multiple manufacturers, assembles the products into surgical kits, and dis-
tributes them to hospitals for use in specific types of surgeries. In this example,
the wholesaler has transformed those products prior to distribution, and the
system controls over the receipt, storage, repackaging, and transportation of
the products are likely to have more in common with controls within a manu-
facturer's system than with controls within a service provider's system. There-
fore, in this example, the system that distributes the products would ordinarily
be better addressed by a SOC for Supply Chain examination than by a SOC 2®
examination. This approach is also more likely to meet the information needs
of report users, who are likely to benefit more from SOC for Supply Chain re-
ports from producers, manufacturers, and distribution companies when making
decisions related to users' supply chain risk management programs.
1.37 In other situations, a distributor may provide only transportation
and delivery of goods produced or manufactured by others or may electronically
distribute manufactured software produced by others. In these situations, the
system and controls used to provide the distribution services are likely to have
more in common with the systems and controls used by a service provider than
the systems and controls used to produce or manufacture products. Therefore,
a SOC 2® examination may better address the system and controls used to
provide the distribution services.
1.38 When making this decision, entity management and the practitioner
would carefully consider the facts and circumstances of the engagement, the
type of distribution services provided by the entity, the transformative nature
of such services, and the information needs of intended users before deciding
whether to examine and report on such systems and controls in accordance
with the guidance in this guide or in accordance with the guidance for a SOC 2®
examination. Appendix B, "Comparison of SOC for Supply Chain, SOC 2® , and
SOC for Cybersecurity Examinations and Related Reports," compares certain
characteristics of the three examinations and related reports.
Considerations for Entities That Bundle Services With

Their Products
1.39 Many entities that produce, manufacture, or distribute products bun-
dle services with the sales of those products. In such situations, it may not
16 AICPA Guide SOC 2® Reporting on an Examination of Controls at a Service Organization
Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy provides guidance

to practitioners engaged to examine and opine on a description of a system and related controls of a
service provider.

be practical to perform separate examinations of system controls relevant to
the production, manufacturing, or distribution of products and system controls
used to provide the bundled services. In that case, the responsible party and
the practitioner may agree to include the systems and controls within those
bundled services within the scope of the SOC for Supply Chain examination.
1.40 When determining whether to include the bundled services within
the scope of the examination, practitioners may consider the following exam-
ples:
More Likely to Include the More Likely to Include the

Bundled Services in a SOC for Bundled Services in a SOC 2®
Supply Chain Examination Examination
The services relate to the physical The services relate to data or
good produced (for example, intangible goods produced (for
maintenance services provided in example, health care claims or
connection with sales of an airplane contract coding).
engine).
The physical good is incidental to the
provision of the bundled service. (In
this case, a stand-alone report on the
service or services may be more
useful to intended users.)
Considerations for a Design-Only Examination

1.41 There may be circumstances in which entity management may not be
prepared to make an assertion about whether the controls within the entity's
system were effective to achieve the entity's principal system objectives. In such
circumstances, rather than making an assertion about whether controls were
effective to achieve the entity's principal system objectives over a period of time,
entity management makes an assertion only about the suitability of the design
of implemented controls as of a point in time. In this guide, such an examina-
tion is referred to as a design-only examination and includes consideration of
the following as of a point in time: (1) whether the description of the entity's sys-
tem was presented in accordance with the description criteria and (2) whether
controls stated in the description were suitably designed and implemented to
achieve the entity's principal system objectives, if the controls operated effec-
tively. A design-only examination may be useful to intended users who want
to obtain an understanding of the entity's system and the controls the entity
has implemented to achieve its principal system objectives. However, it would
not provide intended users with sufficient information to assess the operating
effectiveness of controls within the entity's system. Paragraph 4.89 discusses
how the practitioner's report presented in table 4-3 could be tailored to refer
specifically to the subject matters addressed in a design-only examination.
Matters Not Addressed by a SOC for Supply

Chain Examination
1.42 As discussed beginning at paragraph 1.29, an examination described
in this guide may address one or more of the trust services categories. When

the examination addresses processing integrity, the practitioner's opinion ad-

dresses, among other things, whether system controls were effective to pro-
vide reasonable assurance that goods produced or manufactured will meet their
product performance specifications.
1.43 However, the practitioner's opinion does not address whether the
goods produced by the system are free from defect or whether they will function
as designed. In other words, the practitioner's opinion is not a warranty or guar-
antee that the goods produced will meet product performance specifications or
other commitments made to customers. Therefore, the practitioner does not ex-
press a conclusion on the products' fitness for purpose or on the merchantability
of the products.
Criteria for a SOC for Supply Chain Examination

1.44 The following two types of criteria support the SOC for Supply Chain
examination:
a. Description criteria. Supplement A of this guide presents an excerpt
from DC section 300, 2020 Description Criteria for a Description of
an Entity's Production, Manufacturing, or Distribution System in a
SOC for Supply Chain Report,17 which includes the criteria used to
prepare and evaluate the description of the entity's system. The use
of these criteria, referred to as the description criteria, is discussed
further beginning in paragraph 1.45.
b. Trust services criteria. Supplement B of this guide presents an ex-
cerpt from TSP section 100, 2017 Trust Services Criteria for Secu-
rity, Availability, Processing Integrity, Confidentiality, and Privacy
(the 2017 trust services criteria), which includes the criteria used
to evaluate the effectiveness of controls relevant to the trust ser-
vices category or categories included within the scope of a specific
examination. The use of these criteria, referred to as the applica-
ble trust services criteria, is discussed further beginning in para-
graph 1.48.
Description Criteria
1.45 The description criteria are used by entity management when prepar-
ing the description of the entity's system and by the practitioner when evalu-
ating the description. Applying the description criteria in actual situations re-
quires judgment. Therefore, in addition to the description criteria, supplement
A presents implementation guidance for each criterion. The implementation
guidance presents factors to consider when making judgments about the na-
ture and extent of disclosures called for by each criterion. The implementation
guidance does not address all possible situations; therefore, users may need to
consider the facts and circumstances of the entity and its environment when
applying the description criteria.
1.46 The description criteria in supplement A were promulgated by the
Assurance Services Executive Committee (ASEC). In establishing and develop-
ing these criteria, ASEC followed due process procedures, including exposure
17 All DC sections can be found in AICPA Description Criteria.

Another random document with
no related content on Scribd:
IX
THE DAWN OF INTELLIGENCE
The sixth month, though it lay between two great development

periods,—that of learning to use the senses, and that of learning to
carry the body,—was not in itself a period of suspended
development. It is true that its progress, being more purely mental,
could not be so continuously traced as that which came before and
after, but rather cropped up to the surface every now and then in a
more or less broken way; still, no doubt, it really went on in the same
gradual method, one thread and another knitting together into the
fabric of new powers.
It was to this month, as I said in closing the last chapter, that the
beginnings of adaptive intelligence belonged; and this alone marks it
a great epoch.
There is a great deal of discussion about the use of the words
“intelligence,” “reason,” “instinct,” “judgment,” “inference,” and the
like: what these faculties and acts really are, how they come about,
where the line is to be drawn between their manifestations (in the
minds of animals and of man, for instance), and many other
problems. But I think that all agree upon recognizing two types of
action that come under the discussion: one, that which shows merely
the ability to adapt means to ends, to use one’s own wit in novel
circumstances; the other, that which rests on the higher, abstract
reasoning power, such as is hardly possible without carrying on a
train of thought in words. Whether these two types are to be called
intelligence and reason, as Professor Lloyd Morgan calls them, or
whether both come under the head of reason, lower and higher, we
need not trouble to decide. If we call them adaptive intelligence and
higher or abstract reason, we are safe enough.
Even if it be true that any glimmer of the higher reason penetrates
back into the grades of life below the attainment of speech, it must
be only into those just below, and is not to be looked for in our baby
for a long time yet. But the mere practical intelligence that I am now
speaking of seems to appear in babies close on the completion of a
fair mastery of their senses, about the middle of the first year, and it
goes pretty far down in the animal kingdom. Darwin thought the
lowest example of it he knew was in the crab, who would remove
shells that were thrown near the mouth of his burrow, apparently
realizing that they might fall in.
Recent psychologists have shown strong reason for thinking that
such acts as this are at bottom only the same old hit and miss trick
that we have seen from the first, of repeating lucky movements; only
in a higher stage, as the associations that guide the movements
become more delicate and complicated, and memory and
imagination enter in. However this may be as a matter of theoretic
analysis, there is in practice a clear test of difference between the
unintelligent earlier type of actions and those that all agree in calling
intelligent: I have indicated it above, in saying that in intelligent action
one’s own wit must be used “in novel circumstances.” The case must
be such that one cannot fall back on race instinct nor on his own
previous habit.
Our baby, for instance, first used her intelligence to steer her toe into
her mouth, and the way she did it, compared with the way she slowly
settled on the proper movements for getting her rattle into her mouth,
shows clearly the practical difference between unintelligent and
intelligent action, even if both are at bottom made of the same
psychological stuff.
It was just before the sixth month began that the baby accomplished
this feat, but it belongs with the developments of that month. She
was already fond of playing with her toes; and sitting unclad that
evening in her mother’s lap, she first tried to pull them straight to her
mouth. This was, of course, the mere repetition of a frequent
movement, learned by simple association. But when it failed—for the
toes would kick away, just as her arms used to do, carrying the
thumb from her lips—the little one put her mind on corralling them.
She took them in one hand, clasped the other hand about her instep,
and so brought the foot safely up. Still it escaped, and at last she
clasped ankle and heel firmly, one with each hand, and after several
attempts brought the elusive toe triumphantly into her mouth. It is
true that by looking up to us for sympathy in her success, and
relaxing attention, she promptly lost it once more; but she recaptured
it, and from this time on, for weeks, had immense satisfaction in it
every time she was undressed.
There may have been a certain element of instinct in this—getting
the toe to the mouth is so persistent a habit with babies that it seems
as if there must be some inheritance about it; but inheritance could
hardly have given the special devices for managing the
insubordinate foot; there was clearly some use of individual
intelligence. All through the process of learning to manage the body,
the baby showed instinct and intelligence most intricately mingled;
and, indeed, we do so ourselves our lives long.
Of all a baby’s doings this toe business is the one that people find it
most impossible to regard with scientific seriousness. But its indirect
usefulness is considerable. The coöperation of different parts of the
body that it teaches is remarkable; and it must have great influence
in extending the sense of self to the legs and feet, where it has
hitherto seemed but weakly developed. This is important in getting
the body ready for standing and walking.
The baby now showed intelligence in her actions in several little
ways, such as tugging with impatient cries at her mother’s dress
when she wanted her dinner, and leaning over to pluck at the
carriage blanket, under which her mother had laid some flowers to
keep them from her. She slipped a long-handled spoon farther down
in her hand to get the end of the handle into her mouth (almost
exactly the same act as the one that Darwin thought first showed “a
sort of practical reflection” in his child at about the same age: the boy
slipped his hand down his father’s finger, in order to get the finger tip
into his mouth). In the second week of the month she began to watch
things as they fell, and then to throw them down purposely, to watch
them falling.
I have already mentioned certain doubtful imitations in the fourth
month, and a clearer one in the fifth. Now the baby began to imitate
unmistakably. Her uncle had a fashion of slapping his hand down on
the table by way of a salutation to her, and one day (when she had
passed a week of her sixth month) she slapped down her little hand
in return. The next day as soon as her uncle came in, she began to
slap her hand down, watching him, delighted to repeat the
movement back and forth, as long as he would keep it up. She would
imitate me also when I did it; and in the course of the month several
other little imitations occurred.
I have already spoken of the great importance psychologists attach
to imitation. Professor Baldwin makes it the great principle of
development in child and race—all evolution one long history of its
workings; but he uses the word in a far wider sense than the ordinary
one, tracing “imitation” from the mechanical repetition of life-
preserving motions by the lowest living things, up to the spiritual
effort of men and women to live up to their own highest ideals. Even
using the word in its ordinary sense, we know what a potent force in
the little one’s education imitation is. The age, however, at which it is
most efficient is considerably later than the sixth month, and it did
not count for much yet with our baby.
Her sounds had been more various and expressive from the first
days of the month. She had taken up a curious puppy-like whine of
desire or complaint, and a funny little ecstatic sniffing and catching
her breath, to express some shades of delight; and she had also
begun to pour out long, varied successions of babbling sounds,
which expressed content, interest, or complaint very clearly. She
would “talk to” any interesting object (a hedge in gorgeous bloom, for
instance) with this expressive babble, sometimes holding out her
arms to it at the same time. But now, in the second week of the
month, the day after the first decisive imitation, a surprising advance
beyond these means of communication took place.
I must explain that the wise grandma, who believed in encouraging
babies to creep, as the best possible preparation for standing and
walking, had begun to set the little one on her hands and knees on
the big dining-table, putting a hand against her feet as a brace in
case she should be moved to struggle forward. The baby had a habit
of pushing with her feet when she felt anything against her soles;
and pushing thus, thrust herself forward; and as the table-cover slid
with her movement, she would half slide with it, half shove herself,
across the table, grunting with exertion, and highly pleased.
On the day in question I was sitting with her by this table, and she
pulled at the table-cover, as she was wont to pull and handle
anything she could reach. Suddenly she threw herself back on my
arm, and looked earnestly in my face; sat up and pulled at the cover
again, then threw herself back and looked at me again.
“What does she want?” I said, surprised, and hardly able to think that
the little thing could really be trying to say something to me. But
grandma interpreted easily, and when I put the baby on the table
accordingly, to make her sliding sprawl across the surface, she was
satisfied.
This remarkable advance in sign language comes well under our
definition of intelligent action: it was not a stereotyped sign, already
fixed in her mind in association with a certain wish, like holding out
her arms to be taken, but a device of her own, to meet the special
occasion.
Her increased power of communication was not the only way in
which her mind showed itself more wide awake to other people. A
rather uncomfortable phase of this development was timidity. In the
first week of the month, she was frightened by some one who came
in suddenly between her and her mother, in a strange house, and
spoke abruptly, in a deep, unfamiliar voice; and after that she often
cried or became uneasy when strange men took her, or came near
her, especially if they were abrupt. She drew distinct lines, according
to some principle of her own, and certain people were affably
accepted at once, while others, no more terrific that we could see,
made the little lip quiver every time they came near. This timidity
toward people was not at all deeply fixed in her temperament, and
though it lasted all this month, it was never very marked afterward.
Some indications of the dawn of affection also appeared now. The
baby’s desire to touch our faces with her mouth and hands seemed
to have a certain element of attachment in it. The touches were often
soft and caressing, and they were bestowed only on her especial
friends, or on one or two strangers that she had taken at once into
notable favor. Once she leaned out of her baby carriage, calling and
reaching to me, as if she wished to be taken; but when I came to her,
she wanted only to get hold of me, to put her hands and mouth softly
on my face.
Up to about the middle of the month, in spite of her daily exercises
with her toe, the baby had not altogether annexed her legs to her
conscious self and brought them under her orders. She still had to
hold the foot forcibly with her hands all the time her toe was in her
mouth, or it would have kicked away from her as if it was none of
hers. It is likely, too, that she had scarcely any idea of those parts of
her body which she could not see and did not often touch. Indeed,
the psychologists tell us that we ourselves have a decidedly inferior
bodily consciousness in such parts—say between the shoulder
blades. Even her own head must have been mainly unknown
territory to the baby still, in spite of the curiosity she had felt about it
the month before. But now she discovered by a chance touch that
she could investigate it with her hands, and proceeded at once to do
so, with a serious face.
In the latter half of the month, she went a good deal farther toward
getting a roughly complete knowledge and control of her body. She
investigated her ear, her cheek, and the back and sides of her head,
from time to time. She became quite expert in using legs and hands,
head and mouth, together, in get getting hold of her toe. She sat
alone longer and longer, and by the end of the month could have
done so by the half hour, if she had not always upset herself in five
minutes or so by turning and reaching about. She had become very
free in bending, squirming, and changing her position when she lay
on the floor, and early in the third week of the month she had turned
clear over, from back to stomach, in reaching after something. She
followed up the lesson at once, and soon was rolling over whenever
she wished—at first having much ado to get her arm disentangled
from under her, but managing it nicely before long.
It is possible she would have begun creep creeping at this time but
for the impediment of her clothes. She did stumble once upon almost
the right movement, in trying to get forward to something she
wanted; but her feet and knees became entangled in her skirts, and
she gave it up. A week later, she was put into short skirts, but by that
time the ability to roll over had diverted her mind from creeping.
Babies must lose a great deal of their normal activity through
clothes. They are retracing a stage of human history in which clothes
had no part, and this new element must hamper the repetition
immensely. Clothes they must wear—they do not live in tropic forests
nor own hair coverings; but we ought to leave the little limbs as free
as we can without risk from cold. A chance to roll about nude in a
room that is safely warm is a great thing for a baby.
She did not again use any sign language as advanced as when she
had asked to be put on the table; that incident was a sort of herald of
a later stage of development. But in the latter part of the month her
regular means of communication were decidedly better developed
than in the first part. She would coax for a frolic by leaning forward
with an urgent “Oo! oo!” and expressive movements of her body; but
if she was asking instead for an object she wished, or to be taken
into her mother’s arms, there were small but quite definite
differences in tone, expression, and movement, so that we usually
knew at once which she meant.
About a week before the end of the month a great step toward
intercommunication by speech took place. We began to suspect that
the baby knew her own name, she turned to look so often just after it
had been spoken. To test it I stood behind her, and in an ordinary
tone accosted her as Bobby, Tom, Kitten, Mary, Jacob, Baby, and all
sorts of other names. Whenever I said Ruth, Toodles, or Toots, she
turned and looked expectantly at me, but not at any other name.
Now, Ruth is our baby’s proper name; so it was evident that she
really did have some inkling of the sound that meant her.
Not that she could rise yet to any such abstract conception as that of
a person or of a name. But she had learned that this sound was
connected with interesting experiences—with frolics, and caresses,
and trips outdoors, with relief from discomforts, with dinners, and all
the other things that happened when people were attending to her. It
was out of such a beginning as this that full understanding of
articulate speech, in all its logical intricacy, was to develop.
One of the most marked traits of the latter weeks of this month was
the surprising rapidity with which things were grouping themselves in
the baby’s mind by association, in a way that came nearer and
nearer to definite memory. She coaxed for a spoon, and when she
got it was still discontented, till we found that she wished it to have
milk in, as she knew befitted a spoon—though for the milk itself she
did not care at all. She understood what particular frolic was to be
expected from each of us. She turned, when she saw reflections, to
look for the real object. She made demonstrations of joy when she
saw her baby carriage, knowing well what it portended.
In two or three cases, there was at last unmistakable evidence of
true memory, for at least a few minutes. For instance, in the last
week of the month, sitting on her mother’s lap, the baby caught sight
of a knot of loops that adorned the centre of an ottoman close by,
and reached her arms for it. By way of a joke on her, her mother set
her on the ottoman. It was quite beyond the baby’s sense of locality
to divine what had become of the knot, and she looked all about her
diligently to find it, leaning this way and that. By and by her mother
took her back into her arms to nurse; but all the time she was
nursing, she would stop now and then, sit up, and lean over to look
for the lost knot.
At another time, when her mother came into the room with a new hat
on, she reached out her hands for it with delight; her mother
retreated at once, and put the hat safely out of sight, but when some
minutes later the baby saw her again, her first look was at the top of
her head, and seeing it now bare of lace and buttercups, she broke
into a disappointed whimper.
All this time practice in her earlier attainments went vigorously on.
She was watching, handling, reaching after things, all day long.
Especially she watched all the movements of people; often, now, as
they went in and out of doors, as they were seen through windows,
came into sight or disappeared around corners. She must have been
getting thus some idea of the way walls acted in shutting out her
view, and of the relation of visible and invisible positions.
She had perhaps more troubles in this month than ever before, what
with some fear of people, and the discomforts connected with her
first pair of teeth, and also with the beginning of the weaning period.
There were a number of days when her health and spirits were
considerably depressed, and there was a good deal of fretting. When
the teeth were fairly through, and the insufficient food supplemented,
her spirits came up with a bound, and she was more joyous than
ever.
She had her first skin pain in this month—a scratched finger from a
clasp on my shoulder—and wailed with vigor; yet it was forgotten in
a few moments, and never thought of again. It was evident that skin
sensitiveness was still low, and that hurts left no after soreness.
It was about ten days before the end of the month that she first
showed a decided emotional dependence on her mother. She had
been separated from her for some time (by a tedious dentist’s
engagement), had become hungry and sleepy, and had been
frightened by an abrupt stranger. At last she settled into a pitiful,
steady crying—stopping at every angle in the corridor where I
walked with her, and watching eagerly till it was turned, then
breaking out anew when her mother did not prove to be around the
corner. This tragic experience left a much deeper mark than the
physical woes, and for some days the baby watched her mother
rather anxiously, as if she feared she might lose her again unless
she kept her eyes constantly upon her.
And so she was come to the end of her first half year. The breathing
automaton had become an eager and joyous little being, seeing and
hearing and feeling much as we do, knowing her own body
somewhat, and controlling it throughout to a certain extent, laughing
and frolicking, enjoying the vision of the world with a delicious zest,
clinging to us not so much for physical protection as for human
companionship, beginning to show a glimmer of intelligence, and to
cross over with sign and sound the abyss between spirit and spirit.
X
BEGINNINGS OF LOCOMOTION
When a baby has learned to see things clearly, and has known the
joys of handling them, it is natural that he should soon come to feel
the need of getting to them when they chance to lie beyond arm
reach. Apparently the first impulse to move the whole body does
always come from this desire to get at something; but I doubt if this
remains a very important motive throughout the whole process of
learning. There is so much in that process that is instinctive that the
baby seems to be in great part taken up and carried on by a current
of blind impulse. Then, too, the whole structure of bone, and joint,
and muscle is so fitted to certain positions and movements that in
the mere chance exercising of his limbs he is steadily brought nearer
to the great race acts of balance and locomotion.
One might suppose that with babies sprawling, creeping, and
toddling on every hand, we should not lack evidence on the
beginnings of human locomotion; but as a matter of fact, the stage
that precedes walking is involved in a good deal of confusion.
Records are scanty, and children seem to vary a good deal in their
way of going at the thing. Most of them “creep before they gang”; but
there seems to be a stage before creeping, when, if the child is given
full freedom of movement, he will get over the floor in some cruder
way, rolling, hitching, dragging himself by the elbows, humping
forward measure-worm fashion, or wriggling along like a snake.
Perhaps, as I have already suggested, this is because skirts delay
the natural beginning of creeping, and these other movements
require less freedom of the legs; perhaps there is some deeper
reason connected with race history. Sometimes the baby makes
these less efficient movements answer till walking is acquired, and
never creeps at all.
Our baby, as we have seen, had already made her first ineffective
attempts to pull herself forward and reach something; and lying face
down, unable to turn over, had so propped herself with hands and
knees that when she tried to move she almost stumbled on creeping
unawares. But soon after she was six months old, she discovered
the other half of the trick of rolling—reversing herself from front to
rear as well as from rear to front; and this gave her such an enlarged
freedom that it stopped all aspirations in other directions.
She did not deliberately turn over and over to get anywhere. She
simply rolled and kicked about the floor, turning over when she felt
like it or when she wished to reach something, highly content, and
asking odds of nobody. If by chance she turned in the same direction
a number of times in succession, she would drift halfway across the
room, meeting no end of interesting things by the way—mamma’s
slipper tips, chair rockers, table legs, waste basket, petals dropped
from the vases, and so on. It was a great enlargement of life, and
kept her happy for six or seven weeks.
During this time, her balance in sitting grew secure, so that she could
sit on the floor as long as she chose, occupied with playthings; but
she cared more for the rolling.
It was in these weeks, too, that two great new interests came into
our baby’s life. The first was a really passionate one, and it seized
her suddenly, the week after she was half a year old. The door had
just opened to admit a guest, amid a bustle of welcome, when a cry
of such desire as we had never heard from our baby in all her little
life called our attention to her. Utterly indifferent to the arrival of
company (she who had always loved a stir of coming and going, and
taken more interest in people than in anything else!) she was leaning
and looking out of the window at the dog, as if she had never seen
him before—though he had been before her eyes all her life. She
would think of nothing else; the guest, expert in charming babies,
could not get a glance.
Day after day, for weeks, the little thing was filled with excitement at
sight of the shaggy Muzhik, moving her arms and body, and crying
out with what seemed intensest joy and longing. When he came
near, her excitement increased, and she reached out and caught at
him; her face lighted with happiness when he stood close by; she
showed not the least fear when he put his rough head almost in her
face, but gazed earnestly at it; she watched for him at the window, or
from her baby carriage. No person or thing had ever interested her
so much. Muzhik, on his part, soon learned to give the snatching
little hands a wide berth; and his caution may have enhanced his
charm.
Later in the month, she showed somewhat similar excitement at
sight of a cow. About the same time, too, she first noticed the
pigeons as they flew up from the ground.
This was the beginning of a lasting interest in animals, animal
pictures, animal stories. It is not easy to account fully for this interest,
appearing in such intense degree, at so early an age. All children
show it to some extent, though in many it is mingled with a good,
deal of fear. One is tempted to connect both the fear and the interest
with race history—the intimate association of primitive man with
animals; but a six-month baby is traversing a period of development
far earlier than that of the primitive hunter. Professor Sully has some
good suggestions about the sympathy between children and
animals, but these, too, fail of application to a baby so young.
Probably to her the main charm was the movement, the rough
resemblance to people, joined with so many differences, now first
noticed with the interest of novelty—and (as later incidents made me
suspect) the quantity of convenient hair to be pulled.
The other new interest waked late in the seventh month: that joy in
outdoors that was for many months of the little one’s life her best
happiness. Up to this time, she had liked to be taken out in her baby
carriage, but mainly for the motion. Now, one morning, grandma took
her and sat down quietly on the veranda, saying that she wanted her
to learn to love the sunshine, the birds and flowers and trees, without
needing the baby carriage and its motion. The little one sat in her
lap, looking about with murmurs of delight; and after that, her
happiness in rolling about freely was much greater when we spread
a blanket on veranda or lawn, and laid her there. Within two weeks,
she would coax to be taken outdoors, and then coax till she was put
down out of arms, and left to her own happiness. She would roll
about by the hour, the most contented baby in the world, breaking
occasionally into cries and movements of overflowing joy.
I did not think that at this age the novel sights and sounds outdoors
had much to do with her pleasure; she did not yet notice them much.
Nor could it have been the wideness and freedom of outlook, for she
had not yet come to distant seeing—a hundred feet was as far as I
had ever seen her look. Later, all this counted; but now I thought that
the mere physical effect of activity in the fresh air, together with the
bright light, and perhaps the moving and playing of lights in the
leaves, must make up most of the charm.
In the early weeks of the seventh month idle baby’s rollicking spirits
were striking; in fact, she became for a time quite a little rowdy, ho-
ho-ing and laughing in loud, rough tones, snatching this way and
that, clutching at our hair with exultant shouts and clamor. In the
latter part of the month, her manners were better—indeed, it was
fully a year before I saw them as bad again; but she was much given
to seizing at our faces, flinging herself at them with cries and growls
(exactly as if she had been playing bear), and mouthing and lightly
biting them. And indeed it must be confessed that while our baby’s
behavior was often very pretty for weeks together, she had many fits
of rough play and hoydenish spirits, and our faces and hair were
never quite safe from romping attacks before she was two years old.
This boisterousness was not overflowing spirits (real joyousness
showed itself more gently) and I could never trace its psychological
origin.
At intervals during the month, she continued to improve her bodily
knowledge of herself, investigating her head and face and even the
inside of her mouth, with her fingers; she rubbed her forefinger
curiously with her thumb; she ran out her tongue and moved it about,
trying its motions and feeling her lips. And the very first day of the
month there had appeared that curious behavior that we call
“archness” and “coquetting” in a baby (though anything so grown up
as real archness or coquetry is impossible at this age), looking and
smiling at a person who was somewhat strange, but very amusing,
to her, then ducking down her head when he spoke, and hiding her
face on her mother’s shoulder. Whatever the real reason of such
behavior may be, there is plainly self-consciousness in it. So, too,
when, at seven months old, she began to try deliberately to attract
the interest of callers, wrinkling up her nose with a friendly grimace
till they paid attention to her.
Both these forms of self-consciousness were common after this.
Neither is what we could call human or rational self-consciousness.
Any dog or kitten will show them. But they certainly are something
more than mere bodily feeling of self. If we need a name for it, we
might call it a beginning of intelligent self-perception, as
distinguished both from bodily self-feeling, and rational self-
knowledge—in which the mind, years later, will say to itself clearly,
“This is I.”
We now began to suspect (as she ended her seventh month) that
the baby was beginning to connect our names with us; and when we
tried her by asking, “Where is grandpa?” or “mamma” or “aunty,” she
really did look at the right one often enough to raise a presumption
that she knew what she was about. The association of name and
person was still feeble and shaky, but it proved to be real. In a few
days it was firm as to grandpa (who was quite persona grata,
because he built up blocks for her to knock down, and carried her
about from object to object, to let her touch and examine); and in a
week or two as to the rest of us.
Professor Preyer complains of teaching babies mere tricks, which
have no real relation to their development; and certainly it is a sound
rule that self-unfolding, not teaching, is the way in which a baby
should develop in the earliest years. But Preyer’s baby learned to
wave his hand, and play “patacake,” and show “How big is baby?”
and the rest of it, just as other babies do; mammas and nurses
cannot resist it. And as long as the babies like it, I do not see that it
can do any harm, if it is not overdone. Besides, it may be said that
these standard tricks are all closely related to the sign language, and
so fall in well with the natural development at this stage. And again,
the extreme teachability of the human child is his great superiority
over the brute—all our civilization rests on it; and when the time
comes that he is capable of receiving training, it may be as well that
his power of doing so should be used a little, and that these simple
gesture tricks of immemorial nursery tradition are good exercises to
begin with. It is possible to make a fetich of “self-development,”
beyond all common sense.
At all events, as our baby approached seven months old, her
mamma had begun to teach her to wave by-by. For a couple of
weeks, the mother would hold up the little hand and wave it at the
departing guest, and before long the baby would give a feeble
waggle or two after her mother had let go; next, she would need only
to be started; and a week after she was seven months old she
waved a spontaneous farewell as I left the room. There was a long
history of the gesture after that, for it was lost and regained,
confused with other hand tricks and straightened out, and altogether
played a considerable part in the story of sign language and of
memory, which I shall not have time to relate. But at all times it paid
for itself in the delight it gave the baby: it reconciled her to almost
any parting, and even to going to bed.
Her objection to going to bed, which had been evident since the fifth
month, was because she thought sleeping was a waste of good
playtime, not because she had any associations of fear and
repugnance connected with it. She had never been left to cry herself
to sleep alone, but was rocked and sung to in good old fashion. But
she did show signs at this time of timidity and distress in waking from
sleep, clinging piteously to her mother and crying. She had waked
and cried alone a number of times, and, as I have already said, she
seemed to have formed some associations of fear in this way. But I
think there were deeper reasons for the confused distress on
waking, which from now until halfway through the third year
appeared at times.
I have spoken several times of the ease with which even we grown
people lose our sense of personal identity; and changes in brain
circulation make such confusions especially likely at first waking from
sleep. With babies, whose feeling of identity is but insecurely
established, this must be much more common; moreover, a baby’s
conditions of breathing are less regular than ours, and it is probable
that as he comes out of sleep, and the circulation and respiration of
the waking hours slowly reestablish themselves, he has all sorts of
queer, lost feelings. I was pretty sure, from our baby’s behavior I in
the next two years, that she struggled back to the firm shores of
waking consciousness through dark waters of confusion, and
needed a friendly hand to cling to. This, I suspect, is the secret of the
wild crying in the night, which doctors call “night terror”: it is not
terror, I think, but vague distress, increased by the darkness—loss of
self, of direction, of all one’s usual bodily feeling.
In these sensitive states attending sleep it is likely that some of the
emotional conditions for life are formed, and the ties between mother
and child knit firmest. My observation is that the one the baby loves
most is the one that sleeps close by, that bends over him as he
struggles confusedly back to waking, and steers him tenderly
through the valley of the shadow of sleep; and next, the one that
plays most patiently and observantly with him—not the one that
feeds him.
In her absorption in her growing bodily activity, the baby had taken
no marked steps in intellectual development, though in skill of
handling, and in ability to understand what went on about her and
put two and two together, she made steady progress. Early in the
eighth month, some definite instances of this appeared. She showed
a discreet preference at bedtime for anybody rather than her mother,
and clung vigorously round my neck or her grandfather’s when that
messenger of fate came for her. She dropped things to watch them
fall, with a persistent zeal and interest such as she had not shown in
earlier experiments of the sort. She knew what it meant if one of us
put a hat on, and pleaded with outstretched hands and springing
motion to go too. Once she found that in moving a long stick she was
moving some twigs at its farther end, and kept up the experiment
with curiosity.
It was about this time—the first fortnight of the eighth month—that
taste first became a source of pleasure to our baby. She had been
given an experimental taste of several things before, but beyond the
grimace of surprise (it looks like utmost disgust, but there seems no
doubt that it really means surprise only) with which little babies greet
new tastes, she had shown no great interest in them. Now, as
nature’s supply grew scant, she was introduced more seriously to
several supplementary foods, and at least once rejoiced over the
taste a good deal. Still, she was apt soon to tire of them, and on the
whole taste did not at any time in her first year take a large place
among her interests.
As the middle of the eighth month approached, it was evident that an
advance in power of movement was coming. The baby was getting
up on hands and knees again; she made daily a few aimless
creeping movements; and in her bath she would draw herself to her
knees, and partly to her feet, holding by the edge of the tub, and
somewhat supported by the water. A few days later she drew herself
forward a few inches, flat on her stomach, to get something. But she
still did not catch the idea of creeping, and rolling remained her great
pleasure for another fortnight.
In this fortnight, which brought our baby to eight months old, the
rolling grew very rapid and free. She would now roll over and over in
the same direction, not to get anywhere in particular (she never
learned to use rolling for that purpose), but just for fun. She varied
the exercise with the most lively kicking—heels raised in air and
brought down together with astonishing vigor and zest; and with
twisting about and getting on hands and knees, or even on hands
and feet, prattling joyously, and having a beautiful time all by herself,
for as long as the authorities would leave her alone. I have no note
or memory that she ever tired of it, or asked for attention or change;
it was always some one else who interfered, because meal-time or
nap-time or something had come.
In the last week of the month she learned to raise herself to a sitting
position; and as she could now sit up or lie down at will, she tumbled
about the floor with still more variety and enjoyment. In the same
week she began to pull herself daily quite to her feet in the tub. It
was an ordinary wooden wash-tub which was bridging the interval
between her own outgrown one and the grown-up bath-tub; and she
would stand, leaning her weight partly on her hands, on the edge of
the tub, with her feet planted wide apart, quite on the opposite side,
giving her a pretty secure base.
In this fortnight the baby’s understanding of us and feeling of
nearness to us were noticeably greater. Her attachment to her
favorites was striking. She would cling to us with all the strength of
her little arms, sometimes pressing her lips against our faces in a
primitive sort of kiss. Her desire for our attention was intense—little
arms stretched out, face full of desire, while she uttered urgent cries.
Now and then she was entirely unwilling to eat a meal till the person
she had set her heart on at the moment had yielded to her pleading,
and come to sit close beside her, for company.
She understood one or two little directions—“by-by,” and “patacake”;
or, at least, associated them with the acts. She had some idea of
what “No, no!” meant, and she knew perfectly that she must not keep
paper or flower petals in her mouth, and after biting off a bit would
put out her tongue, laughing, to have the forbidden scrap removed.
And one day when I said to her, “Don’t you want to come to aunty?”
without any gesture, she surprised me by leaning forward and
putting out her hands to me, exactly as if I had reached my arms out
for her. She could not have understood the whole question, for she
hardly understood words at all at the time; but she must have made
out “come,” and, putting it with “aunty,” which she had known for
weeks, got at my meaning.
On the day she was eight months old, at last, the baby half sprawled,
half crept, forward to get something. The early, aimless stages of
locomotion were over, and she was about to start in in good earnest
to learn to creep and to stand.
XI
CREEPING AND STANDING
Now, at eight months old, began a fortnight of rapid development in

movements, all branching out from the position on hands and knees
which the baby often took as she sprawled on the floor.
First she hit on two ways of sitting up, beginning on hands and
knees. One of them, in fact, had appeared in the last days of the
preceding month. She would tilt over sidewise till she was half sitting,
leaning on one hand, then straighten up, raising the hand—and there
you are, sitting. The other way, a few days later, was to begin as
before on hands and knees, separate the knees, and lift herself over
backward till she was sitting, turning the legs out at the knee. No
grown person but a contortionist could do it, for our hips have not
enough play in the socket to carry the movement through the last
inch or two; but babies’ joints are flexible. This became our baby’s
regular method, and the position it left her in—legs spread out before
her, bent directly out at the knee—was her every-day one for many
months. Most babies, I believe, sit monkey fashion—legs straight,
with soles turned in.
Watching carefully, we were sure that the baby did not at first use
either method intelligently; she wanted to sit up, and shifted and
lifted her body, scolding with impatience, and never knowing whether
she would bring up in the desired position or not, till she found
herself by luck where she wanted to be. In a few days, however, the
right movements were sifted out from the useless ones, and she sat
up and lay down at will.
In the same early days of the ninth month, another movement came
of experimenting while on hands and knees—a backward creeping,
pushing with the hands. The baby at once tried to utilize it to get to
people and things, and it was funny to hear her chattering with
displeasure as she found herself borne off the other way—backing
sometimes into the wall, and pushing helplessly against it, like a little
locomotive that had accidentally got reversed. She soon gave up
trying to get anywhere by this “craw-fishing,” however, and then she
enjoyed it, merely as movement.
The only reason I have heard suggested for this curious back-action
creeping (which is not uncommon just before real creeping) is that
the baby’s arms are stronger than the legs, and as a pushing
movement with them is more natural than a stepping one, a
backward impulse is given, which the baby, as a rule, resents with
comical displeasure.
Next, from hands and knees the baby learned to rise to hands and
feet; to kneel, and then to sit back on her heels; and to make sundry
variations on these positions, such as kneeling on one knee and one
foot, or sitting on one heel, with the other foot thrust out sidewise,
propping her.
In spite of two or three chance forward steps, she was eight and a
half months old before she hit at last on real creeping; then one day I
saw her several times creep forward a foot or two, and presently she
was rolling an orange about and creeping after it. I tried in vain to
lure her more than a couple of feet, to come to me or to get a
plaything; she would creep a step or two, then sit back on her heels
and call me to take her. Until almost the end of this month, indeed,
she would creep for but very short distances, and always to reach
something, not for pleasure in the movement.
But while she fumbled in such chance fashion towards creeping, she
was carried on towards standing by strong and evident instinct. She
pulled herself up daily, not to reach anything, but from an
overwhelming desire to get to her feet; and when she found herself
on them she rejoiced and triumphed. At this stage she almost
invariably used a low object to pull up by, so that she could lean over
it, propping her weight with her hands—or with one hand, as she
grew more confident. It was after the middle of the month that she
first drew herself up, her knees shaking, by a chair, to reach a

Guide Reporting On An Examination of Controls Relevant To Security Availability Processing Integrity Confidentiality or Privacy in A Production Manufacturing or Distribution System Aicpa Full Chapter

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Guide Reporting On An Examination of Controls Relevant To Security Availability Processing Integrity Confidentiality or Privacy in A Production Manufacturing or Distribution System Aicpa Full Chapter

Uploaded by

Copyright:

Available Formats

Guide: Reporting on an Examination of

Controls Relevant to Security,

SOC for Supply Chain March 1, 2020

About AICPA Guides

1 All AT-C sections can be found in AICPA Professional Standards.

©2020, AICPA AAG-SSC

Purpose and Applicability

Terms Used to Deﬁne Professional Responsibilities in

AAG-SSC ©2020, AICPA

References to Professional Standards

Examinations of System and Organization Controls:

©2020, AICPA AAG-SSC

Description Criteria for a Description of an Entity’s System

2 All DC sections can be found in AICPA Description Criteria.

AAG-SSC ©2020, AICPA

Trust Services Criteria

Applicability of Quality Control Standards

3 All BL sections can be found in AICPA Professional Standards.

©2020, AICPA AAG-SSC

6 All ET sections can be found in AICPA Professional Standards.

AAG-SSC ©2020, AICPA

©2020, AICPA AAG-SSC

AAG-SSC ©2020, AICPA

2 Accepting and Planning a SOC for Supply Chain Examination .01-.154

©2020, AICPA Contents

3 Performing the SOC for Supply Chain Examination .01-.199

Contents ©2020, AICPA

©2020, AICPA Contents

4 Forming the Opinion and Preparing the Practitioner’s Report .01-.91

Contents ©2020, AICPA

B Comparison of SOC for Supply Chain, SOC 2® , and SOC for

©2020, AICPA Contents

C Illustrative Management Assertion in a SOC for Supply Chain

Contents ©2020, AICPA

vices for goods.

©2020, AICPA AAG-SSC 1.03

1.04 Distribution companies are entities that use systems to distribute

AAG-SSC 1.04 ©2020, AICPA

• Provide products that meet the principal product performance

©2020, AICPA AAG-SSC 1.09

Intended Users of a SOC for Supply Chain Report

1.12 Without such knowledge, intended users are likely to misunderstand

AAG-SSC 1.10 ©2020, AICPA

Overview of a SOC for Supply Chain Examination

11 All AT-C sections can be found in AICPA Professional Standards.

©2020, AICPA AAG-SSC 1.17

1.18 In a SOC for Supply Chain examination, entity management is usu-

Contents of the SOC for Supply Chain Report

AAG-SSC 1.18 ©2020, AICPA

Deﬁning the System to Be Examined

only examination. A design-only examination is discussed beginning at paragraph 1.41.

©2020, AICPA AAG-SSC 1.24

The Entity’s System Objectives and Principal System Objectives

Selecting the Trust Services Category or Categories to Be

AAG-SSC 1.25 ©2020, AICPA

1.32 When an entity uses proprietary customer information or personal

1.33 In other situations, the omission of a category that is likely to be

Determining the Time Frame for the Examination

©2020, AICPA AAG-SSC 1.34

Other Engagement Considerations

Considerations for Entities That Distribute Products

Considerations for Entities That Bundle Services With

16 AICPA Guide SOC 2® Reporting on an Examination of Controls at a Service Organization