Carve-Out vs Inclusive
Method in SOC 2

It excludes the components of a subservice organization’s system used to serve you from both the description and the scope of the examination. Three disclosures survive: the nature of the services performed, each applicable criterion intended to be met by controls there, and the types of controls assumed of it — the CSOCs. A fourth thing survives that people miss: the DC 200 definition of the method itself includes the controls you operate to monitor the vendor, so those sit inside the described system and the CPA firm tests them like any other control. In practice that means a register, a dated review of each vendor’s report, and documented follow-up on every exception that touches a CSOC you rely on.

The relevant aspects of the vendor’s infrastructure, software, people, procedures and data become part of your described system, with the portions attributable to it separately identified, and its controls fall inside the auditor’s procedures. Mechanically the report changes in six places: two assertions rather than one, two representation letters, a components section covering both estates, an entity column in the control matrix, no CSOC disclosure for that entity, and an independence requirement that must clear the vendor as well as you. It is rare because every one of those needs the vendor’s cooperation as a matter of governance, not commerce — which is why it appears almost exclusively between entities under common ownership.

Service organization management decides, per subservice organization, during scoping. DC section 200 states that an organization using several subservice organizations may use carve-out for some and inclusive for others, so a mixed treatment inside one report is expressly permitted rather than a workaround. The CPA firm does not choose the method, but it will challenge a classification it disagrees with. If a vendor you treated as an ordinary supplier is in fact a subservice organization, the description omits a required disclosure — a fair-presentation problem resolved by amending the description before issue, or, failing that, by a modified opinion. Settle classification before the period opens, not during fieldwork.

Open the report and run five checks. Search for the heading “Complementary Subservice Organization Controls” — if it returns nothing, the disclosure is missing or buried. Confirm the description states that commitments can be achieved only if those controls operate effectively alongside yours. Read the criteria column: DC7(b) requires each applicable criterion intended to be met at the vendor to be named, so a vendor list with no criteria attached has not met the criterion. Look for a criterion claimed at the vendor that also appears in the control matrix as tested in-house with no explanation. Then check what is left inside the boundary — access, change, incident response and encryption tested in-house make a report substantive whatever the carve-out count.

Complementary subservice organization controls are the controls management assumed, in designing the system, would be implemented by the subservice organization and which are necessary — with your own — to achieve your service commitments and system requirements. DC 200 requires them to be complete, accurately described and relevant to the achievement of those commitments and requirements, and adds that only CSOCs specific to the services provided should be described. By convention they appear as a table inside Section 3, mapped to criteria, with the description stating that commitments can be achieved only if they are suitably designed and operating effectively along with your controls. They are the mirror image of the CUECs your own report places on your customers.

Yes — more of it, not less. CC9.2 places vendor and business-partner risk inside the common criteria, so it applies whichever method you elected, and the DC 200 definition of carve-out itself includes the controls used to monitor the vendor. In practice: a maintained register tied to an independent source such as the cloud-account inventory and payables above a threshold, risk-based tiering, a pre-engagement assessment, a dated annual review of each vendor’s report, and a documented route for handling issues. DC 200’s implementation guidance also names reconciling output reports, evaluating performance against service-level agreements, site visits and monitoring external communications as qualifying monitoring activities — describe the whole set, not just the report review.

Carve-out is still permitted; nothing in the description criteria conditions it on the vendor holding a report. What changes is the evidence behind your monitoring control, which now rests on a completed security assessment, an independent penetration-test summary, contractual security schedules and a documented risk acceptance signed by someone with authority to accept it. The CPA firm tests that package closely, because it alone supports the CSOC assumption — expect requests for the assessment questionnaire and the responses, the date it was completed, the risk decision and its re-assessment date. The same applies where the vendor holds only a Type 1: design at a point in time cannot evidence operating effectiveness across your period.

Work in three steps. First, determine whether the exception or the basis for the qualification actually touches a CSOC in your mapping — plenty of exceptions sit in areas you place no reliance on, and the answer is a documented conclusion rather than escalation. Second, if it does touch one, record the compensating control and the risk decision inside the period, signed by someone with authority. Third, expect your CPA firm to test that follow-up as part of your monitoring control. The important point: this is a finding about your monitoring, not a change to your scope. The vendor stays carved out and the method does not change because its report came back imperfect.

Yes. The method is elected per entity per period, so a vendor carved out last year can be included this year and the other entities in the same report are unaffected. Two consequences follow. First, the change alters the described system: the vendor’s relevant components come inside the boundary, its controls enter the matrix, and its CSOC disclosure disappears because nothing is left as an assumption. Second, for a type 2 the description discloses relevant details of significant changes during the period, so a switch that happens mid-period is disclosed rather than silently applied. The practical constraint is unchanged — the vendor must sign an assertion, and if it will not, the switch cannot happen.

The methods work the same way, but the standards behind them differ and it is worth stating precisely. A SOC 2 examination is performed under AT-C section 205, Assertion-Based Examination Engagements, against the trust services criteria in TSP section 100, with description content governed by DC section 200. A SOC 1 is performed under AT-C section 320, whose description requirements are written into the section itself rather than a separate DC document, and framed against control objectives relevant to user entities’ internal control over financial reporting. Both are attestation engagements producing an opinion, never a certification. The CSOC concept, the vendor’s assertion under the inclusive method and the surviving monitoring duties are common to both.