Carve-out vs. Inclusive Method: What’s The Right Way?
Often organizations struggle to determine if they should use a carve-out or inclusive method for SOC reporting. In order to make an informed decision an organization should fully understand the difference between the two methods.
Each method is a means of handling those services the organization has outsourced to another organization (subservice organization) such as data center hosting or managed services (e.g. network monitoring services). In the carve-out method, the control activities performed by the subservice organization are excluded from the scope of the report. Conversely with the inclusive method, the control activities performed by the subservice organization are included within the scope of the report.
In the carve-out method, the control activities performed by the subservice organization are excluded from the scope of the report.
Now that we know the difference between the types of methods, which one to choose?
The first response is typically to include everything! However this may not be the best method for you. Often the subservice organization receives their own SOC report. An organization should check with any subservice organization they use to see if they undergo their own SOC examination. The organization should also review that SOC report to ensure that it covers the services they receive. If the services are covered by the subservice organization’s report, an inclusive report is generally not necessary.
It should also be noted that using the inclusive method requires an organization to obtain a management assertion from the subservice organization. Always confirm that the subservice organization is willing to provide a management assertion and work with your auditors before engaging in an inclusive method of SOC reporting. The final decisions generally come down to what will meet the needs of the organization’s clients.
Schellman is a leading provider of attestation and compliance services. We are the only company in the world that is a CPA firm, a globally licensed PCI Qualified Security Assessor, an ISO Certification Body, HITRUST CSF Assessor, a FedRAMP 3PAO, and most recently, an APEC Accountability Agent. Renowned for expertise tempered by practical experience, Schellman's professionals provide superior client service balanced by steadfast independence. Our approach builds successful, long-term relationships and allows our clients to achieve multiple compliance objectives through a single third-party assessor.