Inclusive v. Carve-out Method in SOC Engagements

Lesson: Inclusive v. Carve-out Method in SOC Engagements

In this lesson, Nick Palazzolo, CPA, delves into the inclusive and carve-out methods used in SOC 1 and SOC 2 engagements, specifically addressing the handling of subservice organizations like a trucking company when conducting a SOC report for a manufacturing client. Nick explains that the inclusive method involves incorporating the controls of the subservice organization into the main SOC report, providing a comprehensive view of the entire control environment. This can be more labor-intensive but offers a more in-depth assurance. Conversely, the carve-out method simplifies the process by focusing only on the service organization, thereby excluding the subservice entity from the scope of the report. Nick also clarifies the role of Complementary Subservice Organization Controls (CSOCs) in each method, enhancing understanding of how these controls affect the report depending on the chosen method.

This video and the rest on this topic are available with any paid plan.

See Pricing

Video Transcript

Instructor: Nick Palazzolo

Nick Palazzolo is head instructor of ExamPrep.ai CPA Review. Nick's teaching style is engaging & upbeat, combining practical Big 4 tax & assurance expertise with years of 1-on-1 coaching. His lessons are concise and emphasize what you need to know to pass. Whether you're a recent grad or working full-time, we’re confident you can conquer your CPA exams with Nick’s review.

Cite this lesson

Link to this page

[[ citeExample ]]

Copy to clipboard

Copy URL to clipboard

Copy HTML to clipboard

I know this is one of our longer ISC lessons, so stick with it. I'm going to kind of go through this a little bit more quickly, because like I said, this is covered in a prior lesson and in the next lesson as well. So with our SOC reports, SOC 1 and SOC 2, these third party service providers, it's critical to subservice organizations. So why is it important to identify those? Well, here's why. Because we've got the inclusive method and the carve out. So let's say, yes, we do have a subservice organization. Well, the inclusive method, so just two different methods of reporting within SOC 1 and SOC 2 engagements. So with the inclusive method, this involves including the controls of the subservice organization within the scope of the SOC report. So if we're doing a SOC report on, let's say, I'll do the manufacturing one again. So we're doing a SOC report on the manufacturing company, and then we've got the trucking company. This would be including both of these in the SOC report. So yes, our main client is the manufacturing company. But because this is a subservice organization, as determined by the rules we saw on the slide prior, we're also including the controls of the subservice organization within this SOC report. So you can see that that's a lot more work, because not only do we have to go over the controls with our actual client, but their subservice organization. And then obviously there's a lot of others. Now, in reality, how might that work is maybe the trucking company had their SOC engagement done by another auditor or another practitioner, and you can just use that report. And it's kind of like building blocks. You just keep piling all the SOC

Unlock the full video transcript and subtitles support with the full course!

Get more from this lesson

View the Course View Pricing

Create an account Get started free. No credit card required.

Considerations Specific to Planning, Performing & Reporting on a SOC Engagement

Module: 2 Concepts, 30 Videos

Considerations Specific to Planning and Performing a SOC Engagement - Overview

1:09

Introduction to Considerations Specific to Planning and Performing a SOC Engagement

8:07

Purpose and Organization of the Trust Services Criteria

3:58