ExpertMinds LogoExpertMinds
Medium1 markMultiple Choice
Area III: SOC EngagementsSOC EngagementSubservice Organizations

CPA · Question 10 · Area III: SOC Engagements

Which of the following scenarios BEST describes a 'Carve-out' method in a SOC 2® report involving a subservice organization?

Answer options:

A.

The service organization's description identifies the services performed by the subservice organization but excludes the subservice organization's controls from the scope of the examination.

B.

The service organization's description includes the subservice organization's controls, and the auditor tests them as if they were the service organization's controls.

C.

The service organization does not mention the subservice organization in the system description.

D.

The auditor issues a separate opinion on the subservice organization.

How to approach this question

Differentiate 'Carve-out' (excluded from testing scope) vs 'Inclusive' (included in testing scope).

Full Answer

A.The service organization's description identifies the services performed by the subservice organization but excludes the subservice organization's controls from the scope of the examination.✓ Correct
In the carve-out method, the subservice organization's controls are excluded from the examination scope. The service auditor reports on the controls of the service organization and notes that the subservice organization's controls were not tested.

Common mistakes

Confusing Carve-out with Inclusive method.
09All questions11

Practice the full CPA ISC Practice Exam 3

82 questions · hints · full answers · grading

Sign up freeTake the exam

More questions from this exam

Q01A CPA is advising a client who is migrating their legacy on-premise ERP system to a cloud-based s...MediumQ02During a review of a client's cloud governance structure, an auditor notes that the client uses a...MediumQ03An auditor is evaluating the 'Processing Integrity' principle for a financial institution's loan ...HardQ04A company uses a batch processing system to update inventory records overnight. The 'Grandfather-...HardQ05During a walkthrough of the change management process, an auditor observes that the 'Developer' r...Medium
View all 82 questions →