A SOC 2 report includes a subservice organization that handles data storage. What reporting method discloses the subservice organization's controls within the primary report?
-
A
Inclusive method, where the subservice organization's controls are described and tested within the report
-
B
Carve-out method, where the subservice organization is excluded and expected to provide its own SOC report
-
C
Both inclusive and carve-out methods can be used simultaneously in the same report
-
D
Relay method, where the primary auditor delegates testing to the subservice organization's internal audit team