Glossary · SOC and attestation
The inclusive method brings a vendor's controls into your own examination.
A SOC reporting choice for a subservice organization: the vendor's relevant controls are written into your report and examined by your own service auditor.
Back to the glossary01 · In plain words
In plain words
A SOC reporting choice for a subservice organization: the vendor's relevant controls are written into your report and examined by your own service auditor.
Instead of pointing readers to a vendor's separate report, the inclusive method puts the vendor's relevant controls inside yours. The CPA firm examining you also tests those controls. Readers get one report that covers the whole chain.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Inclusive gives readers fewer gaps to close, which some clients' auditors prefer. It also asks a lot. The vendor must let your auditor in, accept the testing, and have its own management sign a statement vouching for its part of the system. That is realistic when the vendor is a sister company, a small specialist that wants the business, or a provider without its own report. It is rarely possible with a large cloud platform. Any exception found at the vendor appears in your report, so you inherit its control problems in public.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Section 3, the system description
- The vendor's controls are described alongside yours, with the services it performs.
- The assertions
- The subservice organization's management signs its own assertion, next to yours.
- Section 4, tests and results
- The vendor's controls are listed and tested like your own, with any exceptions.
- The contract with the vendor
- Should give your auditor access and require the vendor to support the examination.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a SaaS company whose infrastructure is run by a group company
A wealth-management software firm relies on a sister company in the same group to run its servers, backups and network. The sister company has no SOC report of its own. Carving it out would leave readers with nothing to check. The firm chooses the inclusive method: the sister company's management signs an assertion, its change and backup controls appear in the description, and the CPA firm tests them over the same period. Clients receive one report covering both entities.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Carve-out method
- Carve-out discloses the vendor's role but leaves its controls out and untested, listing CSOCs instead. Inclusive puts the controls in and tests them, so no CSOCs arise for that vendor.
- A combined or group report
- A group may scope several of its own entities as one service organization. Inclusive keeps the vendor a separate subservice organization with its own assertion.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Ask the vendor early whether it will accept testing and sign an assertion; without both, inclusive is not open to you.
- Put audit access and cooperation duties in the contract before the period starts.
- Agree with the vendor how exceptions at its end will be handled and explained in the report.
- GuideCarve-out or inclusive: how vendors appear in your reportTwo ways to present a vendor, and what each does to your report.
- GuideSubservice organizations: vendors inside your reportWho counts, how they're monitored, and what the report must say.
- GuideThe management assertionWhat leadership is signing, and what backs it.
Sources: AT-C section 320; AICPA guide on SOC 1 reporting; AICPA guide on SOC 2 reporting; DC 200 description criteria.
Questions about Inclusive method
Why is inclusive less common than carve-out?
It needs the vendor's cooperation.
The vendor has to accept testing by your auditor and sign its own assertion. Large providers serve thousands of customers and publish their own reports instead, so most service organizations carve them out.
Does the vendor get anything from an inclusive report?
Not a report of its own.
The report is issued to the service organization and its users. The vendor's controls are tested, but it cannot hand the result to its other customers as if it were its own SOC report.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.