SOC 2 Carve-Out vs. Inclusive Auditing: Choosing the Right Approach for Your Subservice Organizations

---

Organizations increasingly rely on third-party vendors and cloud-based services to support key operations. As a result, it’s crucial to address how these dependencies are managed in SOC 2 audits. The decision to adopt either the Carve-Out or Inclusive method when dealing with subservice organizations can significantly affect the audit scope, trust with clients, and overall risk posture.

This guide delves into the nuances of these two approaches, offering expert insights into when to use each method to best fit your compliance strategy.

Introduction to Subservice Organizations in SOC 2 Audits

What is a Subservice Organization?

A subservice organization is a third-party vendor or entity that provides services or systems that directly support the services of the primary service organization. These can include data centers, cloud providers, payment processors, or identity management solutions.

In a SOC 2 context, these entities contribute to meeting trust service criteria such as security, availability, confidentiality, processing integrity, and privacy – meaning their controls may affect your audit outcome.

Why Are Subservice Organizations Important in SOC 2?

Subservice organizations are integral to your organization’s operational and security posture. If they experience downtime, misconfigure access, or suffer a breach, it could directly impact your customers and your compliance standing.

That’s why SOC 2 audits require transparency about the role and risk posed by these vendors. The American Institute of Certified Public Accountants (AICPA) allows two main approaches for doing so: Carve-Out and Inclusive.

Subservice Organizations vs. Contractors: Understanding the Difference

It’s essential to differentiate between subservice organizations and contractors. Not all third parties are treated the same. A contractor typically performs tasks under your direct control, using your systems. In contrast, a subservice organization independently manages controls critical to your operations.

SOC 2 Audit Approaches: Carve-Out vs. Inclusive

What is a Carve-Out in a SOC 2 Report?

In the Carve-Out method, your SOC 2 report acknowledges the use of a subservice organization but explicitly excludes their controls from the scope of the audit. You are responsible for managing these relationships through vendor risk management, SLAs, or independent assessments.

This approach reduces audit scope but may raise concerns for customers who want assurance that your third parties meet the same standards as you. This is a common approach when the subservice organization already has its own SOC 2 Type II report.

What is Inclusive Auditing in SOC 2?

In the Inclusive method, the subservice organization’s controls are included within your SOC 2 audit scope. Your auditor evaluates their systems and processes as if they are an extension of your own. This offers greater transparency and assurance to customers but requires coordination and detailed documentation from the subservice provider.

The Differences Between Carve-Out and Inclusive Methods

Aspect	Carve-Out Method	Inclusive Method
Audit Scope	Excludes subservice organization’s controls	Includes subservice organization’s controls
Audit Responsibility	Focuses only on your internal controls	Shared responsibility between you and the subservice
Evidence Collection	Relies on external SOC reports or vendor attestations	Auditor evaluates both your and the vendor’s controls
Audit Complexity	Lower	Higher
Audit Complexity	May raise questions if not supplemented	Builds higher confidence in your overall security

SOC Audit Process: How Carve-Out and Inclusive Fit In

During the planning phase of a SOC 2 audit, your organization must identify all relevant subservice providers. The decision to use the Carve-Out or Inclusive method depends on factors such as:

• Nature of services provided
• Risk exposure
• Access to third-party documentation
• Willingness of subservice org to cooperate

Auditors will then either review and test the subservice organization’s controls (inclusive) or ensure your oversight mechanisms are sound (carve-out).

Choosing the Right Approach: Carve-Out or Inclusive

Which SOC 2 Method Should You Use?

There’s no one-size-fits-all answer. The right choice depends on your business model, risk appetite, and customer expectations.

If your customers demand complete visibility and assurance across your entire supply chain, inclusive might be the better fit. If, however, your third-party is reluctant to share information or is already covered under their own SOC report, carve-out is often more practical.

Considerations When Choosing the Carve-Out Method

• Your subservice organization already has a SOC 2 Type II report.
• You have limited access to your vendor’s internal controls.
• You want to reduce audit scope and timeline.
• Your clients are comfortable with vendor disclosure without direct validation.

Considerations When Choosing the Inclusive Method

• Your clients demand full transparency into third-party controls.
• Your vendor lacks a current SOC 2 report or cannot share it.
• You have contractual oversight or shared responsibility over the vendor’s controls.
• You want to elevate trust and accountability across your service supply chain.

How to Determine the Best Method for Your Organization

Start by mapping out which services are dependent on third parties. Then ask yourself:

• How critical is the subservice provider to our core services?
• Can we obtain sufficient evidence from the vendor?
• Are we capable of monitoring their performance effectively?
• Will my clients trust a carve-out?

These answers, combined with auditor guidance, will steer you toward the best-fit method.

Practical Implications of Your Choice

Impact on Control Responsibilities and Audit Scope

Inclusive audits broaden the scope significantly, requiring collaboration with vendors. Carve-outs, on the other hand, shift the focus onto how you manage the risks introduced by those vendors.

Risk and Trust Implications for Customers and Stakeholders

Your choice will directly affect how customers perceive your operational transparency. Inclusive audits may strengthen stakeholder trust and accelerate sales cycles, especially in regulated industries like fintech or healthcare.

Legal and Compliance Considerations

Some industries or contracts may mandate an inclusive approach, especially when handling sensitive customer data. Always review contractual obligations and data protection regulations before choosing.

Best Practices for Managing Subservice Relationships

• Maintain an updated inventory of subservice providers
• Conduct annual vendor risk assessments
• Request third-party SOC 2 reports and review exceptions
• Establish clear contractual obligations for security, availability, and incident reporting.
• Build contingency plans for vendor failure or breach

Working with Auditors to Define Scope and Responsibility

Early engagement with your SOC auditor ensures alignment on which method best fits your control environment. They can also provide sample language for describing your vendor arrangements transparently in the final report.

When to Use Each Method

• Use Carve-Out when your subservice provider already has a SOC report or isn’t open to direct evaluation.
• Use Inclusive when your customers require full visibility or when the subservice plays a core role in delivering your service.

Need help managing your SOC 2 compliance and vendor risks? Our experts at Ampcus Cyber can guide you through the audit process.