Subservice organisations in ISAE 3402: carve-out or inclusive?
A subservice organisation is a supplier you engage for part of your service, such as a data centre, a payment provider or an external backup. In an ISAE 3402 report, you can treat that supplier in two ways: the carve-out method, where the supplier’s controls fall outside the opinion, or the inclusive method, where they are part of the report and the auditor tests them. With carve-out, the supplier’s controls remain untested in your report. That is the core of this choice. The standard requires the description to clearly set out the services of the subservice organisation, and the audit report to state which method was used. The IAASB, which drafted the standard, states in its basis for conclusions on ISAE 3402 that the inclusive method is rarely used, unless the auditor is also the auditor of the supplier. More about the process is in the step-by-step plan and the system description.
Short answer: with carve-out, you leave the supplier out of the report and refer to its own report. With inclusive, you include the supplier, and the auditor tests its controls as well. The choice you make determines what your client can rely on.
Carve-out and inclusive side by side
| Carve-out | Inclusive | |
|---|---|---|
| What happens to the supplier | Its controls fall outside the opinion | Its controls are in scope and tested |
| What the auditor tests | Only what you do yourself, plus the link to the supplier | Also the supplier’s controls. The auditor is then responsible for his opinion on everything the description says about the supplier |
| What your client must do itself | Request and read the supplier’s report | Almost nothing extra for this supplier |
| Work for you | Less testing work, but more explanation needed | More testing work and more coordination. The auditor usually needs full access to the supplier and asks it for written confirmations |
| Risk | A gap in the chain if the client does not read the supplier’s report | The opinion also depends on the supplier |
The difference is practical. With carve-out, your report has a gap that your client must close itself. With inclusive, the report is thicker and needs more coordination, but the chain is complete.
Example: a payroll processor with an external data centre
A payroll processor runs its software in a data centre operated by a third party. The data centre manages physical access, power and cooling. The payroll processor manages the application and the access rights itself.
Carve-out. The payroll processor names the data centre in the description as a subservice organisation. Physical security falls outside the opinion. The client must request and read the data centre’s own report to cover that link. If the data centre has its own ISAE 3402 or SOC report, your client can ask for it.
Inclusive. The auditor includes the data centre’s controls in his testing. The data centre must then cooperate: give the auditor access and provide written confirmations. The client has one report to read, but the process is more demanding.
Which of the two you choose depends on what the supplier provides and what your clients ask for. Discuss this with your auditor in advance.
How to justify your choice
Use this order, which also comes back in practice when you write the description:
- Name the supplier. Make a list of all parties that do part of the processing, not only the large ones.
- Determine relevance. Does the supplier affect your client’s financial reporting? If not, it does not belong in the report.
- Request its own report. Does the supplier have an ISAE 3402 or SOC report? Then carve-out is simpler, provided the period matches.
- Choose the method and record it. Describe in the system description which method you use for each supplier.
- Close the gap. With carve-out, your client must know that it has to read the supplier’s report, and when that report’s period ends.
Common mistakes
- Carve-out without a supplier report. Then nobody has visibility of that link, and your client has a gap.
- A supplier you do not name. It is often discovered only when the client asks about the chain. See also the audit checklist.
- Periods that do not match. The supplier’s report runs from January to June, while your report covers the whole year. You must name that gap.
- Choosing inclusive without evidence from the supplier. The auditor cannot test the controls if you cannot obtain the evidence.
- Switching method between reports. If you used carve-out last year and now use inclusive, explain why. Clients compare reports from year to year.
What your client needs to know with carve-out
With carve-out, part of the assurance shifts to your client. He must then request the supplier’s report himself and check what it says. This only works if you help him. Therefore, give him three things in your description:
- The name of the supplier and the service it provides, so the client knows what falls outside the report.
- The period overview of the supplier’s report. If that period does not match yours, name the gap.
- A reference to what the client must check itself. These are the CUEC linked to this supplier.
Without those three points, your client’s accountant reads the report as complete, while it is not. That is one reason carve-out is sometimes harder to sell than inclusive, even when it is technically correct.
Checklist when choosing a supplier
Use this list for each supplier before you record the method:
- Does the supplier have its own report from an independent auditor?
- Does its service affect the processing your client needs, or only the technology around it?
- Does its reporting period broadly match yours?
- With inclusive, can you ask the supplier to provide its evidence if the auditor wants to see it?
- Is the contract with the supplier set up so that you receive the report every year?
- Is the supplier named with the correct name and service in the system description?
Frequently asked questions about subservice organisations
Can I choose a different method for each supplier?
Yes. In one report, you may treat one supplier as carve-out and another as inclusive. Record the method for each supplier, so the reader does not have to guess.
Is a cloud provider always a subservice organisation?
Not automatically. A cloud provider that only supplies infrastructure, without carrying out the processing, sometimes falls outside the scope. Assess each case to see whether the supplier is part of the service your client receives.
What if the supplier has no report?
With carve-out, you cannot rely on its own assurance. Inclusive can be a way out, but then the supplier must give the auditor access and provide written confirmations. If that is not possible, discuss with your auditor what the supplier can provide before you make the choice.
Can a supplier change method between two years?
It can, but it is a change you must explain. A client who compares two consecutive reports sees a different scope and may think something has disappeared. Set out in the description of the new report why you changed the method and what that means for the reader.
Does the method change the opinion?
The auditor’s opinion covers your service and the controls in the report. The method determines what falls within that opinion. Carve-out therefore cannot improve the opinion. It narrows the scope.
More information
Also read the page on additional controls for the client, because a supplier often comes with an agreement with your client. See the system description for where you record the method, and type 1 vs type 2 for the time frame of the report.