The vendors behind your service, seen by a client's auditor.

The general test for a subservice organization, and how it is named in a description, is covered on the SOC 2 subservice guide. In a SOC 1 the filter is narrower: a vendor counts when its services or controls bear on your control objectives, and so on the figures clients record. A payment bank, a payroll tax filing agent or the host of your processing system usually does. A design agency does not.

1. VM.1
   Obtain and review the vendor's reportEach year, get the vendor's SOC report, check its period, scope, opinion and exceptions, and record the review.
2. VM.2
   Map the vendor's user controlsList the CUECs the vendor's report places on you, and show that you perform each one.
3. VM.3
   Reconcile vendor outputsAgree bank confirmations, settlement files or processing totals from the vendor to your own records.
4. VM.4
   Track service issuesLog incidents and failures reported by the vendor and assess their effect on your objectives.
5. VM.5
   Review the relationshipPeriodic review of the contract, service levels and any change in what the vendor does for you.

• Period mismatch. The vendor's period ends months before yours. Ask for their bridge letter and note it in your review.
• Scope mismatch. The vendor's report covers a different product or region. Confirm what it actually covers before relying on it.
• Exceptions in their report. Assess whether each one affects your objectives, and record any compensating step you took.
• No report this year. Increase reconciliation and confirmation work, and say what you did.

Under carve-out, the opinion says that some control objectives are achieved only if the vendor's complementary subservice organization controls operate as assumed, and the vendor's controls are not tested. A client's auditor then looks for evidence about the vendor separately. Under the inclusive method, the vendor's controls are tested and covered, which needs the vendor's cooperation and its own written assertion.

Neither method is a weakness in itself. What harms the opinion is a relevant vendor left out of the description altogether.

1. The provider calculates net pay and sends a payment file to its bank, which pays employees.
2. The description names the bank, its role in disbursing pay, and the carve-out method.
3. It states the controls assumed of the bank: payments executed as instructed and on the value date, and rejected items reported back.
4. The provider's monitoring control: each run, it reconciles the bank's payment confirmation to the payroll register and follows up rejects.
5. A client's auditor reads this, confirms the client reviews its own pay register, and decides whether further evidence about the bank is needed.

Sources: AICPA SSAE No. 18, AT-C section 320; AICPA SOC 1 guide; PCAOB AS 2601 for the carve-out and inclusive terms. Vendors, situations and the payroll scenario are illustrative.