In short
Under the carve-out method, a service organization's controls report excludes the controls of a subservice organization it uses, and instead describes the controls the subservice organization is expected to have.
Key takeaways
- User entities must find other evidence about the carved-out controls, such as the subservice organization's own report.
- Under the inclusive method, the subservice organization's controls are included and tested instead.
- The expected controls are called complementary subservice organization controls.
Where it's tested
ISC: Third-Party & Vendor Risk — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A service organization's SOC 1 report uses the carve-out method for a subservice organization. What does this mean for the user entity?