Presenting a vendor
Carve-out or inclusive: two ways to put a vendor in your report.
When a vendor performs part of your service, your description must say how its controls are treated. Under the carve-out method they stay outside the examination. Under the inclusive method they are described and tested inside it. The choice reshapes four things: the description, the testing, the vendor's role and the reader's job.
Back to SOC 2 services01 · The two methods
The two methods, side by side
One leaves the vendor's controls out; the other brings them in.
Carve-out
Vendor's controls excluded
- Description names the vendor and the services it provides
- Vendor's controls are not described in detail and not tested
- Description lists the CSOCs the system assumes the vendor runs
- The opinion is limited to your controls
Inclusive
Vendor's controls included
- Description covers the vendor's relevant controls, identified separately
- The service auditor tests those controls
- The vendor's management gives its own written assertion
- The opinion covers both sets of controls
Both methods are permitted. Neither is “more compliant”. They describe different arrangements.
02 · What changes
What the choice changes
Four parties feel the difference.
| Effect on | Carve-out | Inclusive |
|---|---|---|
| Your description | Shorter: a role statement and a CSOC list per vendor | Longer: the vendor's controls described alongside yours, clearly separated |
| The auditor's testing | Tests your monitoring of the vendor, not the vendor | Tests the vendor's controls directly, which may mean access to its people and systems |
| The vendor | No involvement beyond supplying its own report | Must cooperate with testing and sign an assertion |
| The reader | Must obtain the vendor's own report to complete the picture | Gets one report covering the combined system |
For the reader, the practical difference is how many documents they need. A customer reading a carve-out report who cares about the hosting layer must request the host's report, check its period against yours, and confirm it covers the CSOCs you listed. A customer reading an inclusive report finds both sets of controls, both assertions and one opinion in a single place, but should still note which controls belong to which organization, because a later change at the vendor changes the picture.
03 · When inclusive fits
When the inclusive method is chosen
Rare, and usually when the vendor is close to you.
- The vendor is a related partyA parent company, sister entity or shared-services unit that runs part of the platform.
- The vendor has no report of its ownA specialist provider with no SOC report, whose controls matter to your customers.
- Readers need one documentCustomers or regulators who will not chase a second report for a critical function.
- The vendor agreesWithout cooperation and an assertion from its management, inclusive is not possible.
For large cloud hosts, payment processors and identity providers, carve-out is the realistic choice: they publish their own reports and will not join your examination.
04 · Monitoring you owe
The monitoring you still owe under carve-out
The vendor's controls leave the test plan. Your oversight of them does not.
- A vendor inventory. Every subservice organization, its role and the method applied to it.
- Periodic report reviews. Each vendor's SOC report read, with scope, period, opinion and exceptions recorded.
- CSOC confirmation. Each CSOC in your description traced to a control in the vendor's report.
- Follow-up on exceptions. A recorded response to anything in the vendor's report that touches your system.
- Alternative evidence. Where a vendor has no report: questionnaires, contract terms, certificates or site visits, recorded.
Your auditor samples these records, usually under the vendor-risk criterion CC9.2. Carve-out without monitoring is a gap in your own controls.
05 · Mistakes
Mistakes in applying a method
Most errors are about disclosure, not the choice itself.
- Not naming the method. The description must say which method applies to each subservice organization.
- Carving out without CSOCs. If your controls depend on the vendor, the reader needs to know what you assume it does.
- Treating a carve-out as invisible. A vendor that performs part of the service must still be named, even if excluded from testing.
- Switching methods silently. A change between periods is a change to the system and should be disclosed.
Sources: AICPA description criteria DC section 200; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization (subservice organizations, carve-out and inclusive methods); AICPA attestation standards AT-C 205; Trust Services Criteria TSP section 100, CC9.2.
Questions about the two methods
Can we use different methods for different vendors?
Yes.
The method is chosen per subservice organization. A report can carve out the cloud host and include a related entity that runs support, as long as the description is clear about each.
Does carving out a vendor weaken our opinion?
No, it narrows what the opinion covers.
The opinion still addresses your controls fully. Readers simply complete the picture with the vendor's own report and your CSOCs list.
As a customer, what do we do with a carved-out vendor in someone else's report?
Ask for that vendor's report too, if it matters to you.
Check the CSOCs listed, then check the vendor's own report covers them. Many customers do this only for vendors that hold or process their data.
Who decides the method: us or the auditor?
Management decides; the auditor agrees it is workable.
It is part of management's description. The CPA firm needs to be able to test whatever is included, so inclusive needs its agreement and the vendor's.
Present every vendor clearly, once.
We build your subservice inventory, choose a method per vendor with you and write the CSOCs your description needs.