ISC S4

Question 1

when the subservice org use the inclusive method

Answer 1

-the more significant / complex the service provided by the subservice , the more likely to use the inclusive method
-the less available information from other source, the more likely a SOC report using the inclusive method
-the more dependent the service organization is on the subservice organization control , the more likely SOC use inclusive method

Question 2

when the subservice org use the crave out method

Answer 2

-when subservice org is independent/ unavailable

Question 3

does service auditor test the suitability of the design and operating effectiveness of the complementary user entity control ?

Answer 3

-No
-only assume that complementary user entity controls were applied and operated effectively during that period