Definition
When a service organization uses a subservice organization, its report must choose a method. Under the carve-out method, management's description identifies the subservice organization and the services it provides but excludes the subservice organization's relevant control objectives and controls from the description and from the service auditor's testing. Under the inclusive method, the description includes the subservice organization's controls and the service auditor tests them. Inclusive requires a written assertion from the subservice organization, and the service organization's report carries those controls.
Why it matters in an audit or review
With carve-out, the user auditor cannot rely on the report for the subservice organization's controls. The report lists complementary subservice organization controls that must operate effectively, and the user auditor must get evidence elsewhere, often from the subservice organization's own report.
Example
Illustrative: a loan servicer uses a hosting provider. The servicer's SOC 1 uses carve-out. The user auditor requests the hosting provider's SOC 1 and reads its coverage period.
Common mistakes
- Treating a carve-out report as covering the hosted environment.
- Missing the complementary subservice organization controls section.
Sources
- AICPA, AT-C Section 320 (definitions of carve-out and inclusive methods and related requirements)
- AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error