The carve-out method excludes a subservice organisation’s controls from the service auditor’s opinion and describes the missing controls in the report. The main organisation remains responsible for understanding the gap and managing the resulting risk. Customers must assess whether the excluded controls affect the service they rely on and whether extra assurance is needed.
How the carve-out method changes the auditor’s opinion
The carve-out method is about scope, not endorsement. The service auditor evaluates the portion of the service they can see and then explicitly notes that a subservice organisation’s controls were excluded from the opinion, so the report is not a full assurance statement over the entire service chain.
That distinction matters because readers should not assume the absence of a finding means the excluded environment was tested. In practice, the carve-out creates a boundary in the report, and the service provider has to understand how that boundary affects the completeness of the assurance story.
What the carve-out leaves to the main organisation and the customer
Once controls are carved out, the main organisation remains responsible for understanding what sits behind that boundary and whether the missing controls matter to service delivery. If the excluded subservice organisation performs an important part of the service, the unresolved gap becomes part of the risk decision the customer must make.
The customer’s job is to decide whether the omitted controls affect confidentiality, integrity, availability, or other commitments they rely on. If they do, the report alone is not enough, and the customer may need additional evidence, contractual commitments, or a different assurance path.
How to read the gap in a carved-out report
A carved-out report should be read as a partial picture with an identified blind spot. The practical question is not whether the report exists, but whether the excluded controls are material to the service outcome the customer is buying.
That means the reader should look for where the subservice organisation fits into the delivery chain, what function it performs, and whether the main organisation has compensating controls or monitoring that narrow the gap. When the missing controls sit on a critical dependency, the carve-out becomes a governance issue as much as a reporting choice.
When an assurance report is used to support vendor due diligence, it helps to compare the carve-out boundary with the service dependency map rather than reading the opinion in isolation. NHIMG’s SOC 2 Guide covers scoping, carve-outs, complementary user entity controls, and the questions that typically follow a partial-scope report.
Risk and Threat Considerations
A carve-out can leave a real assurance gap when the excluded subservice organisation performs a material security or availability function. The risk is not the carve-out itself, but the possibility that the reader treats partial coverage as full coverage and underestimates residual exposure.
Failure mechanism: Critical controls sit outside the auditor’s scope, so an important dependency may be untested, unobserved, or only indirectly covered by the main organisation’s report.
Impact: A customer may rely on incomplete assurance, miss a control weakness in the excluded provider, or accept a service relationship without enough evidence to judge the operational or security risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
SOC 2 (AICPA) provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SOC 2 (AICPA) | CC1.2 — Communication of Objectives | Carve-outs change what the service report communicates about scope and coverage. |
| CC3.2 — Risk Identification and Analysis | Readers must assess risk created by omitted subservice controls and residual dependency exposure. | |
| CC5.2 — Control Activities | Compensating controls may be needed when assurance over a subservice organisation is excluded. | |
| Recommendation — Document the carve-out boundary so stakeholders understand what the report does and does not cover. Evaluate the excluded controls as part of the service risk assessment. Add compensating controls where the carve-out leaves a material assurance gap. | ||
Practitioner Guidance
What to verify: Confirm exactly which functions were carved out, whether those functions are security-relevant to the service you consume, and whether the report explains how the gap is handled in practice.
Decision rule: If the carved-out provider sits on a critical path, treat the report as incomplete assurance and seek compensating evidence, contractual commitments, or independent review before relying on it.
Practitioner takeaway: The key judgement is whether the excluded controls are material to your actual service dependency, because a well-written carve-out report still leaves you responsible for the risk that sits outside the opinion.
Related resources from NHI Mgmt Group
- How should organisations keep PHI out of SaaS task systems when teams need to track care or clinical operations work?
- How should organisations rebuild identity governance after a carve-out or similar infrastructure separation?
- What breaks when identity and access management is rebuilt too slowly after an infrastructure carve-out?
- Who is accountable for identity control gaps during a carve-out programme?