What does inclusive method mean on the CPA exam?
Inclusive method. Brings a subservice organization's controls inside the description and the scope of the service auditor's report, so one report covers both organizations.
Defined against AT-C 320.08.
Which CPA exam sections use inclusive method?
Inclusive method appears in the AUD section of the CPA exam.
What is the difference between inclusive method and carve-out method?
Both describe how a service organization treats a SUBSERVICE organization in its SOC report. The carve-out method excludes the subservice organization’s controls from the description and the opinion, leaving the user auditor to obtain assurance separately. The inclusive method brings them inside both. Carve-out is far more common, and it is the one that leaves a gap the user entity has to close. (AT-C 320)
Other terms defined against AT-C 320
- carve-out method: Excludes a subservice organization's control objectives and controls from both the description and the scope of the service auditor's report.
- SOC 1 Type 1 report: A report on the fairness of the description and the suitability of the design of controls, at a point in time.
- SOC 1 Type 2 report: A report covering the description, the suitability of design, and the operating effectiveness of controls over a period.
- suitably designed: The controls, if they operated as described, would achieve the stated objective.
Related terms
- SOC 2 report: A report on a service organization's controls against the trust services criteria, covering security plus any of availability, processing integrity, confidentiality, and privacy that are selected.
- service organization: A third party whose processing affects a user entity's financial reporting, such as a payroll bureau or a claims processor.
- equity method: Used when the investor can exercise significant influence, presumed at 20% or more of the voting stock.
- auditor's report: The document carrying the opinion, with its sections in a fixed order.
- complementary user entity controls: Controls a service organization assumes its customers are running.
- user entities: The customers of a service organization, whose own financial reporting or systems depend on the service organization's controls.