Video: Carve-out vs. Inclusive Method in Reporting on CSOCs

In this lesson, Nick Palazzolo, CPA, clarifies the differences between the carve-out and inclusive methods used in reporting on controls at service organizations (SOC). Exploring the roles that subservice organizations play, he utilizes the example of Microsoft using ADP, which in turn relies on QuickBooks, to illustrate how these two methods can be applied. Nick explains that the carve-out method allows the primary service organization to exclude the controls of its subservice organizations, whereas the inclusive method involves including these controls within its own SOC report. This detailed explanation helps in understanding how each method impacts the clarity and breadth of SOC reports. Additionally, Nick discusses the implications for companies like Microsoft when determining necessary due diligence or obtaining separate SOC reports, weighing the pros and cons of each method to facilitate better decision-making.