Carve-out vs. Inclusive Method: What’s The Right Way?

Often organizations struggle to determine if they should use a carve-out or inclusive method for SOC reporting. In order to make an informed decision an organization should fully understand the difference between the two methods.

Each method is a means of handling those services the organization has outsourced to another organization (subservice organization) such as data center hosting or managed services (e.g. network monitoring services). In the carve-out method, the control activities performed by the subservice organization are excluded from the scope of the report. Conversely with the inclusive method, the control activities performed by the subservice organization are included within the scope of the report.

In the carve-out method, the control activities performed by the subservice organization are excluded from the scope of the report.

Now that we know the difference between the types of methods, which one to choose?

The first response is typically to include everything! However this may not be the best method for you. Often the subservice organization receives their own SOC report. An organization should check with any subservice organization they use to see if they undergo their own SOC examination. The organization should also review that SOC report to ensure that it covers the services they receive. If the services are covered by the subservice organization’s report, an inclusive report is generally not necessary.

It should also be noted that using the inclusive method requires an organization to obtain a management assertion from the subservice organization. Always confirm that the subservice organization is willing to provide a management assertion and work with your auditors before engaging in an inclusive method of SOC reporting. The final decisions generally come down to what will meet the needs of the organization’s clients.