User Auditor Responsibilities: Carve-Out Method in Subservice Organization Audits

When a service auditor uses the carve-out method to audit a subservice organization, it's the user auditor's responsibility to 'evaluate whether the use of the carve-out method in the service auditor's report is appropriate.' This involves assessing if the carve-out method is suitable considering the specific circumstances and the risks associated with the subservice organization's controls.