What is Inclusive method?
In short
Under the inclusive method, a service organization's description of its system includes the relevant controls of a subservice organization it uses, and the service auditor's report covers them.
Key takeaways
- It needs the subservice organization's cooperation and a written assertion from its management.
- Under the carve-out method, the subservice organization's controls are excluded and only monitored.
- Users of a carve-out report may need the subservice organization's own report.
Where it's tested
ISC: System and Organization Controls (SOC) Engagements — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
Under the carve-out method, a SOC report lists controls the service organization expects its subservice organization to have in place. These are called: