The Inclusive Method is used when a service organisation includes a subservice provider’s controls within its own system description and control reporting. In practice, that means the provider’s controls are treated as part of the overall control environment, so the combined scope and responsibilities are documented together for the report.
How the Inclusive Method works in a SOC 2 report
The inclusive method is a reporting choice, not a different control philosophy. It is used when the service organisation’s own system description and control assertions include the subservice provider’s controls as part of the service organisation’s overall control environment. That makes the subservice provider visible inside the report rather than treated as an external carve-out.
For readers comparing report formats, the practical effect is that responsibilities are presented as one combined scope. The service organisation still owns the report, but the subservice provider’s relevant controls are documented alongside it, so the reader can see how the full service delivery chain is represented.
That distinction matters when the outsourced portion is material to the service being described. If the service organisation relies on the subservice provider for important operational or security controls, the Inclusive Method gives a more complete picture of how the overall service environment is governed and reported.
What changes when the subservice provider is included in scope
Using the Inclusive Method changes how control boundaries are described. Instead of separating the subservice provider into a carved-out dependency, the report treats the combined environment as the subject of the system description. That means the narrative must be clear about which controls are operated by the service organisation and which are operated by the subservice provider, even though both sit inside the report scope.
This also changes how a reader interprets evidence. A control can still be relevant even if it is not directly operated by the service organisation, so the report needs enough detail for the reader to understand coverage, responsibility, and any complementary user entity controls. NHIMG’s SOC 2 Guide is useful here because it ties scoping, carve-outs, and complementary controls back to the way SOC 2 reporting is actually read.
In practice, the Inclusive Method is most useful when the report consumer needs a single, integrated view of the service stack. It helps avoid the false impression that outsourced controls are outside the assurance boundary when, operationally, they are part of how the service is delivered.
When the Inclusive Method is the better reporting choice
The Inclusive Method is usually the better fit when the subservice provider’s control operation is important enough that excluding it would weaken the reader’s understanding of the service. It is especially helpful when the outsourced component is tightly integrated into delivery, monitoring, or access control, and the organisation can describe the combined environment clearly without obscuring ownership.
It is less helpful when the reporting organisation cannot obtain enough detail from the subservice provider to describe the shared environment accurately. In that case, the report may become harder to interpret, because the reader sees the dependency but not enough evidence to understand how the surrounding controls work in practice.
For assurance consumers, the main question is whether the scope presentation matches the actual operating model. If the report says the service organisation includes the subservice provider’s controls, the rest of the report needs to support that claim with consistent scope language, responsibilities, and evidence boundaries.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
SOC 2 (AICPA) and ISO/IEC 27001:2022 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SOC 2 (AICPA) | CC6.1 — Logical Access Security Software, Infrastructure, and Data | Inclusive reporting often hinges on access and control ownership across the shared service boundary. |
| CC3.2 — Communication of Objectives | The inclusive method requires clear scope and responsibility communication in the report narrative. | |
| Recommendation — Document which party operates each access control in the combined scope. State the service boundary and shared responsibilities explicitly. | ||
| ISO/IEC 27001:2022 | A.5.23 — Information security for use of cloud services | Included subservice providers create shared-service governance and accountability needs. |
| Recommendation — Define governance and assurance requirements for outsourced service dependencies. | ||
Practitioner Guidance
What to verify: Confirm that the system description, control narrative, and boundary language all describe the same operating model. If the subservice provider is included, the report should make clear which controls are owned, which are relied upon, and what evidence supports each.
Common mistake: Treating the Inclusive Method as a wording preference instead of a scoping decision. The mistake is not the label itself, it is failing to align the report narrative, control ownership, and evidence trail so the reader can follow the combined scope without ambiguity.
Practitioner takeaway: Use the Inclusive Method when the outsourced component is material enough that excluding it would distort the reader’s view of the service, but only if you can describe the combined control environment precisely and consistently.