How do carve-out and inclusive methods handle subservice organizations?

Under the carve-out method, relevant subservice organization controls are excluded from the service auditor's testing scope. The report explains the subservice organization's role and identifies complementary subservice organization controls that are assumed to operate.

Under the inclusive method, relevant subservice organization controls are included in the system description and in the service auditor's procedures. The exam distinction is scope: carve-out points users to controls outside the report, while inclusive brings those controls into the report.