Carve-out vs inclusive method in SOC reports

The short answer

The carve-out method and inclusive method answer one question: where does the report boundary stop? In a carve-out report, the service auditor examines your controls and leaves subservice organization controls outside the opinion. Your description names the subservice organization and the controls you depend on, often called complementary subservice organization controls, or CSOCs. In an inclusive report, those subservice controls sit inside the system description and the auditor tests them as part of the same examination.

Neither method is better in the abstract. The choice follows the work your customers need to do, the influence you have with the subservice organization, and the evidence you can get. A payroll platform that hosts on a large cloud provider usually uses carve-out because the cloud provider will not join every customer audit. A payments processor that depends on one small data center may use inclusive because customers want one report that covers the whole chain.

The method also changes what your customers read. Carve-out reports push them to collect the subservice organization's own report and map CSOCs to their own controls. Inclusive reports give them one document, but that document takes more coordination to produce. Pick the boundary that matches how your service is delivered, then explain it in plain words to sales and customer success.

How the carve-out method works

Under the carve-out method, your system description includes the subservice organization as a dependency. It lists the services the subservice provides, the criteria you rely on, and the CSOCs you expect the subservice organization to run. The service auditor does not test those CSOCs and does not opine on them. The opinion covers your controls only. The report usually states that the subservice organization's controls are excluded and that user entities need complementary controls at the subservice organization.

This is why a carve-out report often points customers to the subservice organization's own SOC report. Your customer or their auditor reads both reports and decides whether the combination covers the risks. You still need to monitor the subservice organization. Vendor risk reviews, annual report collection, bridge letters between report periods and follow up on exceptions belong in your control set. If you skip that monitoring, a carve-out report looks thin because the report says you depend on controls you do not test.

Carve-out is common for infrastructure providers, identity services and other suppliers with many customers. The subservice organization may refuse to join your audit, or its schedule may not line up. Carve-out lets you finish your report without waiting. Watch the wording in the description: be specific about which services and controls fall outside. Vague CSOC language leads to customer questions and extra follow up.

How the inclusive method works

Under the inclusive method, the subservice organization is part of your system. Your description covers its relevant controls, and the service auditor tests those controls along with yours. The opinion covers the combined system. The subservice organization must agree to the arrangement, provide evidence and let the auditor review its environment. That can mean interviews, screenshots, configuration exports and walkthroughs at a site you do not own.

The inclusive method gives customers one report with one opinion. That helps when the subservice organization is small, when it has no SOC report of its own, or when the service you sell cannot be separated from its controls. It also makes the dependency visible. If the subservice organization has a control gap, the exception shows up in your report, not in a separate document. You carry the coordination cost and some of the reputational cost.

Inclusive does not work with every supplier. Large cloud providers often will not join a customer's audit. A supplier may lack the staff to answer auditor requests or may see the request as a risk. Put the right to audit and the duty to cooperate in the contract before you promise an inclusive report to customers. Also check report distribution: some subservice organizations restrict how their information appears in another party's report.

When to choose the carve-out method

Choose carve-out when your subservice organization already has a current SOC report that covers the relevant criteria and period. That report gives customers the tested evidence your report does not. You avoid duplicate testing and you keep the audit schedule in your hands. This is the usual path for hosting and cloud infrastructure services.

Carve-out also fits when you have many subservice organizations or when their controls change on their own schedule. Adding each one to your audit turns a focused project into a large coordination effort. A carve-out keeps your report tied to the controls you run and lets customers evaluate each supplier with its own report.

The method still demands work. You need a subservice organization inventory, a mapping of each supplier to the services and criteria it supports, and a review process that catches missing or qualified reports. Sales teams need a clear answer when a customer asks who tests the cloud provider. The answer is not nobody. The answer is the cloud provider's auditor, and your monitoring controls.

When to choose the inclusive method

Choose inclusive when the subservice organization is central to the service and your customers cannot get a complete picture from two separate reports. A small hosting provider without its own SOC report is a common case. A custom application that runs on a supplier's platform with tightly coupled controls is another. The report then matches the service the customer actually buys.

Inclusive also helps when you need to show control over a supplier that handles sensitive data and the supplier will cooperate. Your auditor can test the handoff, the access path, the backup process and the incident communication in one examination. That can shorten customer due diligence because there is one report to read.

Set expectations before you start. Confirm the subservice organization will sign the engagement letter or a cooperation letter, name contacts and meet the audit timetable. Ask your auditor what access they need and how they will treat supplier evidence. If the supplier cannot commit, stay with carve-out and strengthen your monitoring instead of forcing a boundary that will not hold.

Costs and effort to consider

The inclusive method usually adds audit hours, travel or remote review time, and project management. Your team becomes the coordinator between the auditor and the subservice organization. Every delay at the supplier can move your report date. Carve-out shifts some of that effort to the customer, who has to collect and read the supplier's report. That is a real cost too, just not one on your invoice.

Both methods need a current system description, a control matrix and evidence that matches the period. For carve-out, add supplier monitoring records, CSOC mappings and a process for reviewing the supplier's report. For inclusive, add supplier cooperation terms, access logs, shared responsibility notes and a plan for exceptions that sit outside your direct control. Review the draft description closely. The boundary is easy to blur in writing, and a blurred boundary causes more rework than a clean exclusion.

If you are still deciding, a readiness assessment can save a false start. Cloudverg offers a SOC 2 readiness assessment at $7,500/month that scopes systems, criteria and report type, reviews controls against the Trust Services Criteria and gives you a remediation roadmap. It also shortlists independent CPA firms, which helps you ask about carve-out and inclusive experience before you sign an audit letter. Other options include working directly with an auditor or using a compliance platform, but neither replaces a clear decision about the report boundary.

Frequently asked questions