http://linfordco.com/2010/03/subservice-organizations-and-the-carve-out-or-inclusive-method/ SSAE 16/SOC 1 (f. SAS 70), SOC 2, and Royalty Audit Specialist CPAs Fri, 13 Jan 2012 16:38:56 +0000 hourly 1 http://wordpress.org/?v=3.3.2 http://linfordco.com/2010/03/subservice-organizations-and-the-carve-out-or-inclusive-method/comment-page-1/#comment-6 Newel Linford Fri, 02 Apr 2010 16:20:42 +0000 http://linfordco.com/2010/03/subservice-organizations-and-the-carve-out-or-inclusive-method/#comment-6 1 - Correct. The service organization is not relieved of their responsibilities for monitoring the sub-service organizations. Especially sub-service organizations that perform moderate to extensive functions for the service organization. Monitoring in this scenario usually takes the form of monitoring service-level agreements or other relevant metrics and following up on deviations. 1 – Correct. The service organization is not relieved of their responsibilities for monitoring the sub-service organizations. Especially sub-service organizations that perform moderate to extensive functions for the service organization. Monitoring in this scenario usually takes the form of monitoring service-level agreements or other relevant metrics and following up on deviations.

]]> http://linfordco.com/2010/03/subservice-organizations-and-the-carve-out-or-inclusive-method/comment-page-1/#comment-5 Kimberley Laris Fri, 02 Apr 2010 00:53:14 +0000 http://linfordco.com/2010/03/subservice-organizations-and-the-carve-out-or-inclusive-method/#comment-5 The #1 question is - does the services provider evaluate the adequacy of controls at sub-services providers? If that is not happening in any way, shape, or form, there are big monitoring concerns to address in the provider's SAS 70. The client should not turn their SAS 70 auditor into their monitoring control; the auditor should not be the first to find out that there is a problem at a sub-services provider. Sub-services providers need to be monitored by the provider purchasing services when they sub-source services. It is the sub-services provider's job to provide evidence of adequate controls - just like the services provider does for their customers by obtaining a SAS 70 for them. The #1 question is – does the services provider evaluate the adequacy of controls at sub-services providers? If that is not happening in any way, shape, or form, there are big monitoring concerns to address in the provider’s SAS 70. The client should not turn their SAS 70 auditor into their monitoring control; the auditor should not be the first to find out that there is a problem at a sub-services provider. Sub-services providers need to be monitored by the provider purchasing services when they sub-source services. It is the sub-services provider’s job to provide evidence of adequate controls – just like the services provider does for their customers by obtaining a SAS 70 for them.

]]>