Subservice Organization for Purposes of ISAE 3402

The ISAE 3402 standard also includes provisions regarding the use of a subservice organization. Many service organizations themselves actually outsource services to other service organizations, thus these are identified as subservice organizations.  For purposes of the ISAE 3402 standard, a service organization has two reporting options for subservice organizations, if in fact they use one to outsource services to.

Carve-out Method | ISAE 3402 Standard
The subservice organization's control objectives and related controls are excluded from the actual service organization's description of its system, resulting in this information not being a part of the scope of the service auditor's engagement.

The ISAE 3402 standard also states that if the inclusive method is used for reporting on subservice organizations, then the service auditor will have to obtain relevant information as needed along with performing procedures. The ISAE 3402 standard recommends using the inclusive method when the service organization and the subservice organization are related or explicit contractual documentation is in place between both parties.

It is plausible to assume that if a subservice organization is providing critical and/or material outsourcing services for a service organization, then it will likely garner the attention of having to undergo an assurance audit itself in accordance with the ISAE 3402 standard.