The carve-out method names a vendor but leaves its controls untested.

Most service providers depend on other companies, a cloud host being the usual case. With the carve-out method, the report lays out which vendor handles which task while the vendor's own controls stay outside it. The CPA firm does not test them. Readers are pointed to the vendor's own report, or other evidence, for that part.

Carve-out is the usual choice because it needs nothing from the vendor beyond what it already publishes. Large cloud platforms will not let a small customer's auditor test their data centres, so carving them out is often the only workable route. The price is a gap that readers must fill themselves. Your report lists the controls you expect the vendor to run, the CSOCs, and a careful buyer will check the vendor's own report against them. Your own monitoring of the vendor, such as reviewing its SOC report each year, stays in scope and will be tested.

Section 3, the system description

Names each carved-out subservice organization and the services it performs.

The auditor's opinion

States that the subservice organization's controls were excluded from the examination.

The list of complementary subservice organization controls

Shows what the vendor is expected to do for your controls to work.

Vendor management evidence

Your yearly review of the carved-out vendor's own report, which your auditor samples.

Inclusive method

Inclusive brings the vendor's relevant controls into your description and your auditor tests them. Carve-out leaves them out and only discloses the vendor's role.

Out of scope entirely

A carve-out vendor is still named and its expected controls are listed. A system that is simply out of scope does not appear at all.

• List every vendor that performs part of your in-scope system and mark which ones must be carved out.
• Write the controls you rely on each vendor to run, in terms a reader can check against that vendor's report.
• Collect each carved-out vendor's latest report and record your review of it, including any exceptions.

• GuideCarve-out or inclusive: how vendors appear in your reportTwo ways to present a vendor, and what each does to your report.
• GuideHosting on a SOC 2 cloud: what you inheritWhat a provider's report covers, and the controls that stay yours.
• GuideSubservice organizations in a SOC 1Carve-out or inclusive for the vendors behind your service.

Sources: AT-C section 320; AICPA guide on SOC 1 reporting; AICPA guide on SOC 2 reporting; DC 200 description criteria.