Definition
A subservice organization is a service organization used by another service organization. A payroll processor that uses a cloud hosting provider for its platform is an example. In a SOC 1 report, management of the service organization either carves out the subservice organization's controls (carve-out method) or includes them in the description and the scope of testing (inclusive method).
Why it matters in an audit or review
With the carve-out method, the controls at the subservice organization are not covered by the service auditor's opinion, so the user auditor cannot rely on them from that report. The report will list the controls that depend on the subservice organization. The user auditor considers whether another source of evidence, such as the subservice organization's own SOC report, is needed when those controls matter to the audit.
Example
A payroll processor's SOC 1 carves out its data center provider. The report states that physical and environmental controls at the data center are expected to be in place at the subservice organization. The user auditor judges that those controls are not significant to the client's payroll risks and does not request a separate report, but documents the reasoning.
Common mistakes
Overlooking the carve-out language and assuming the report covers every party in the chain.
Sources
- AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
- AICPA, AT-C Section 320 (carve-out and inclusive methods)
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error