Start for free Start for free

Carve-Out Method (Subservice Organizations)

The carve-out method is how a SOC report leaves out the controls of a vendor's own providers, such as its cloud host. The report names those providers, but the auditor does not test their controls, so you need other evidence for them.

What is the carve-out method?

Most vendors rely on other companies to run their service, such as a cloud host or a data warehouse. In a SOC report these are called subservice organizations. In privacy terms many of them are subprocessors.

A SOC report can treat them in two ways (AICPA):

  • Carve-out method: the report names the provider and what it does, but leaves its controls out of scope.
  • Inclusive method: the provider's relevant controls are treated as part of the vendor's own system and covered by the report. This needs the provider to cooperate.

Under carve-out, the report lists controls the vendor assumes the provider runs, called complementary subservice organization controls. For example, the vendor assumes its cloud host runs physical and environmental controls at its data centers. Nobody in this report tested that.

Why it matters to you

Carve-out leaves a gap in what was examined. The vendor is still expected to oversee those providers, most often by getting and reviewing their own SOC reports. If a carved-out provider holds your data, you may want that evidence too. For a small company, a practical approach is to review the main hosts and accept the rest as fourth-party risk.

The list of subservice organizations is fixed to the audit period. The vendor's subprocessor list keeps changing. For example, Stripe added Microsoft Azure and Snowflake as cloud subprocessors. A provider added after the audit period will not appear in the report at all.

What to check

  • Find the subservice organizations in the system description and note which method the report uses for each.
  • Compare that list with the vendor's current subprocessor list. Ask about any provider in one list but not the other.
  • For carved-out providers that hold your data, get their own SOC report or a public summary.
  • Read the complementary subservice organization controls, so you know what the vendor is assuming.
  • Check that your DPA makes the vendor responsible for its subprocessors.

How Venpo helps

Venpo monitors your vendors' subprocessor lists and emails you in plain English when a provider is added or removed. That shows you when the list has moved past what the last SOC report covered.

Start for free

Frequently asked questions

Is carve-out a red flag in a SOC 2 report?

No. It is a normal way to handle cloud hosts and other providers. It just means you need separate evidence for those providers.

Is a subservice organization the same as a subprocessor?

They overlap but are not the same. A subservice organization matters to the vendor's controls, while a subprocessor processes personal data, and many providers are both.

Related terms

Vendor Documents Subprocessor List A subprocessor list is a public page where a vendor names the other companies that handle your data for it, with what each one does, where it is, and what data it touches. It changes whenever the vendor adds or drops a provider. Vendor Management Fourth-Party Risk Fourth-party risk is the risk from your vendors' own vendors, such as the cloud host or AI provider a tool uses to process your data. For software, these are mostly the subprocessors on a vendor's subprocessor list. Security and Compliance SOC 2 Report A SOC 2 report is the document a CPA firm issues after examining a vendor's controls. It holds the auditor's opinion, management's statement, a description of the system and, in a Type 2 report, the tests the auditor ran and what they found. Subprocessors and DPAs Subprocessor A subprocessor is a company your vendor hires to handle your data for it, such as a cloud host or an AI model provider. You have no contract with it, so your vendor's data processing agreement sets the rules. Security and Compliance Complementary User Entity Controls (CUECs) Complementary user entity controls (CUECs) are the security steps a vendor's SOC report assumes you, the customer, will take. The vendor's controls only work as described if you do your part, such as managing your own users' access. Change Monitoring Subprocessor Monitoring Subprocessor monitoring means tracking the outside companies your vendors use to handle your data, and noticing when a vendor adds or removes one, so you can review the change and object in time if you need to.

Sources

Last reviewed