What do organisations get wrong when documenting subservice organisations?

They often list vendors without explaining what those vendors actually do, how they affect control outcomes, or where accountability sits. That leaves auditors guessing about trust boundaries. Strong documentation names the service provided, its relevance to operations, and whether the vendor’s controls are relied on directly.