What does carve-out method mean on the CPA exam?
Last reviewed
Carve-out method. Excludes a subservice organization's control objectives and controls from both the description and the scope of the service auditor's report. It leaves a gap the user entity has to close separately.
Defined against AT-C 320.08.
Worked example
A payroll processor hosts its system at a separate data center company that runs the servers, backups and physical security. The processor's SOC 1 report uses the carve-out method for the data center. The auditor of one of the processor's customers is reading the report to decide how far to rely on it.
What does the report cover about the data center, and what must the customer's auditor do about the rest?
- Under the carve-out method the data center's controls are left out of both the processor's system description and the service auditor's testing. The report names the data center and the controls the processor expects it to have, but tests none of them.
- A clean opinion therefore says nothing about whether the data center's backups, access controls and physical security worked.
- The customer's auditor needs separate evidence for those controls, typically the data center's own SOC report, or else other procedures, before relying on controls that depend on them.
Answer: The report covers only the processor's own controls, including how it monitors the data center. The customer's auditor must get assurance about the data center separately, most often from the data center's own SOC report.
The trap: Assuming the processor's clean opinion extends to every party in its chain. The inclusive method would bring the data center's controls into scope; carve-out deliberately leaves them out.
Based on AT-C 320.08.
Which CPA exam sections use carve-out method?
Carve-out method appears in the AUD section of the CPA exam.
What is the difference between carve-out method and inclusive method?
Both describe how a service organization treats a SUBSERVICE organization in its SOC report. The carve-out method excludes the subservice organization’s controls from the description and the opinion, leaving the user auditor to obtain assurance separately. The inclusive method brings them inside both. Carve-out is far more common, and it is the one that leaves a gap the user entity has to close. (AT-C 320)
Other terms defined against AT-C 320
- inclusive method: Brings a subservice organization's controls inside the description and the scope of the service auditor's report, so one report covers both organizations.
- SOC 1 Type 1 report: A report on the fairness of the description and the suitability of the design of controls, at a point in time.
- SOC 1 Type 2 report: A report covering the description, the suitability of design, and the operating effectiveness of controls over a period.
- suitably designed: The controls, if they operated as described, would achieve the stated objective.
Related terms
- service organization: A third party whose processing affects a user entity's financial reporting, such as a payroll bureau or a claims processor.
- control objectives: What a set of controls is supposed to achieve, stated so that it can be tested.
- user auditor: The auditor of an entity that uses a service organization.
- equity method: Used when the investor can exercise significant influence, presumed at 20% or more of the voting stock.
- description of the system: Management's account of the service it provides and the controls around it.
- auditor's report: The document carrying the opinion, with its sections in a fixed order.