What is Complementary subservice organization controls?
In short
When a service organization's report uses the carve-out method, complementary subservice organization controls are the controls it assumes its subservice organizations have in place for its own controls to achieve their objectives.
Key takeaways
- They are listed in the service organization's report.
- User entities may need the subservice organization's own report to know whether those controls work.
- They are the subservice equivalent of complementary user entity controls.
Where it's tested
ISC: System and Organization Controls (SOC) Engagements — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
Under the carve-out method, a SOC report lists controls the service organization expects its subservice organization to have in place. These are called: