Is My Vendor a Subservice Organization?

What service does the organization provide to the Service Organization?

Type of Report

Is the service provided by the organization relevant to user entities’ control objective or service commitments and system requirements?

Are the controls provided by vendor NECESSARY to provide reasonable assurance that the control objectives, service commitments and system requirements are achieved?

Is the organization a Subservice Organization?

Report printing and mailing

This organization prints the Service Organization’s electronic files containing financial reports for user entities and mails the reports to the user entities. The information in the reports is incorporated into the user entities’ financial statements. The organization is responsible for controls over the completeness and accuracy of the reports.

SOC 1

Yes. The service provided by this organization is relevant to user entities’ internal control over financial reporting because the information in the reports is incorporated into the user entities’ financial statements.

Yes. Vendor is responsible for the printing of the electronic files that goes to the user entities and Service Organization does not perform additional controls to review such reports.

Yes.

Document storage and record retention

This organization picks up boxes of documents from the Service Organization and stores them at its facility.

SOC 1

No. Although this service is important to the Service Organization’s business and enables the Service Organization to meet certain regulatory requirements, document storage and record retention services do not relate to user entities’ internal control over financial reporting.

N/A

No

Electric power

This organization provides electric service to the Service Organization.

SOC 1

No. Although important for the Service Organization’s continuing operations, the electric service does not relate to user entities’ internal control over financial reporting

N/A

No

Software development

The Service Organization outsources the development of its application changes to a software development organization. This organization receives the authorized changes from the Service Organization, develops the changes, and sends them back to the Service Organization. The Service Organization authorizes all changes to be developed, reviews the accuracy of the changes, performs all user acceptance testing, and approves all changes prior to implementing them in production.

SOC 1

Yes. Controls over software development are relevant to Information Technology General Control (ITGC)s for financial reporting as the software is providing transaction processing.

No. In this scenario the organization would not be considered a Subservice Organization because the Service Organization’s controls alone are sufficient to meet the needs of a user entity’s internal control over financial reporting.

No

Backup Power Maintenance

ABC Vendor is responsible for performing quarterly maintenance on the Service Organization’s backup power system;

SOC 2 (Security, Confidentiality, and Availability)

Yes. ABC vendor is performing monitoring controls over the Service Organization’s availability commitments.

No. Service Organization personnel participate in post-maintenance testing used to verify the backup power system is working as intended, which serves as a primary control. In this instance, ABC Vendor’s controls are not necessary for the Service Organization to achieve its service commitments and system requirements based on the applicable trust services criteria for availability; therefore, ABC Vendor would not be considered a Subservice Organization.

No

Capacity Monitoring

XYZ Vendor is responsible for monitoring service capacity and usage and for projecting future capacity demands based on historical trends.

SOC 2 (Security, Confidentiality, and Availability)

Yes. Capacity monitoring is a relevant function over the Service Organization’s availability commitments.

Yes. Without additional controls at the Service Organization, controls at the vendor are necessary for the Service Organization to achieve its service commitments and system requirements related to availability based on the applicable trust services criteria. Therefore, XYZ Vendor would be considered a Subservice Organization.

Yes. However, if the Service Organization were to independently perform high-level capacity monitoring activities and review the future capacity demands projected by XYZ Vendor for appropriateness, XYZ Vendor might not be considered a Subservice Organization because the vendor’s controls may not be necessary for the Service Organization to achieve its service commitments and system requirements based on the applicable trust services criteria. The service auditor would need to use judgment to determine whether the review controls were precise enough that the vendor controls would not be necessary.

Monitoring of configuration settings

A Service Organization purchases from JKL Vendor a tool to monitor and report on the status of configuration settings that affect the operation of control activities. JKL Vendor also provides services around the use of that tool through a software-as-a-service (SaaS) model.

SOC 2 (Security, Confidentiality, and Availability)

Yes. Security configuration monitoring is a relevant function over the Service Organization’s security commitments.

Yes. In this situation, management has effectively outsourced monitoring of the configuration settings to JKL Vendor. Because management considers this function and related controls necessary to the achievement of the Service Organization’s service commitments and system requirements, JKL Vendor would be considered a Subservice Organization.

Yes. However, if JKL Vendor does not provide additional services (only provided the software and no additional services) then there is an argument the Company