Payroll SaaS with a Carve-Out and a Subprocessor Change
A pension fund administrator uses a SaaS HR and payroll platform covering 6,200 employees. The vendor's SOC 2 Type II report includes a carve-out: "the subservice organization, CloudHost Inc., is responsible for physical security and infrastructure." The fund's risk register lists the platform as "medium" risk, last assessed 22 months ago. The contract has no right-to-audit clause and no defined RTO. The vendor has had two unplanned outages in 12 months, one lasting 9 hours during payroll close. The fund's regulator requires annual risk assessment of material outsourcing arrangements and notification of material changes. The vendor has just announced a change of subprocessor for backup storage to a provider in a different jurisdiction. You are the risk manager preparing the annual reassessment.
1. How should the carve-out be treated in the risk assessment?
Read the worked answer
Treat the carve-out as an evidence gap, not a pass. A carve-out report states that the subservice organization's controls were excluded from the audit scope. The fund cannot rely on the SOC 2 for physical security, infrastructure availability, or the environmental controls underpinning every other control the vendor operates. Those are precisely the controls that determine whether payroll runs.
Required action:
- Obtain the subservice organization's own independent report (SOC 2 or ISO 27001) covering the same period, or a bridge letter for any gap.
- Obtain the vendor's complementary subservice organization controls (CSOCs) - how it monitors CloudHost, what SLAs flow down, what assurance it receives and reviews.
- If neither is available, record the affected control objectives as unverified rather than effective, and reflect that in the residual rating.
Why it matters here: the fund is a material outsourcing arrangement under a regulator that expects annual assessment. Accepting a carve-out report at face value means the assessment would be documenting assurance the fund does not actually hold. The 9-hour payroll-close outage is a live signal that availability controls matter, and the excluded layer is where availability originates. Document the gap, the compensating evidence obtained, and the residual position explicitly in the risk register rather than burying it in an appendix.
2. How would you move the risk rating from an unsupported "medium" to a defensible rating?
Read the worked answer
Replace the label with a reasoned scenario analysis. "Medium" is not a rating; it is a habit. Build the rating from inputs:
- Impact: a failed payroll affects 6,200 employees and pensioners, creates regulatory notification exposure, and carries reputational and potentially legal consequences. Quantify the cost of a missed payroll cycle (manual processing, interest, complaints, remediation labor) rather than asserting it is "high."
- Likelihood: two unplanned outages in 12 months, one of 9 hours during the worst possible window, plus an undefined RTO and an unassessed backup subprocessor in a new jurisdiction. That is empirical frequency, not speculation.
- Aggravating factors: no right to audit, no RTO commitment, 22-month assessment gap, material subprocessor change without prior approval, single-provider concentration for a process with no realistic manual fallback at scale.
- Inherent vs residual: rate inherent first, then residual after crediting the controls you can actually evidence. The carve-out limits what can be credited.
Conclusion: the defensible rating is high, driven by material outsourcing status, demonstrated availability failures, absent contractual assurance rights, and an unassessed fourth party. Document the rationale, the assumptions, and the evidence relied on, so the rating survives regulatory scrutiny and so the board understands what would have to change to lower it.
3. What actions and contractual changes should be recommended, and what residual risk remains?
Read the worked answer
Contractual:
- Right to audit, or acceptance of independent third-party reports plus the right to request additional evidence.
- Defined RTO/RPO with service credits, and mandatory tested BCP/DR evidence annually - not a plan document.
- Subprocessor approval and notification: prior notice, right to object, and flow-down of equivalent obligations. The backup-storage move must trigger a jurisdiction and legal-access review before consent.
- Exit plan with data return in a usable format and deletion attestation.
- Annual attestation obligation and breach-notification timeline.
Operational:
- Obtain CloudHost's own report or record the gap formally.
- Require the vendor to explain the two outages with root-cause reports and confirm remediation.
- Build and test a manual payroll fallback for at least one cycle.
- Add the vendor to the material-outsourcing register and align reporting to the regulator's expectations.
Residual risk that remains: the fund is still dependent on a single SaaS provider for a process it cannot manually sustain at scale, and it still relies on attestations rather than direct observation. That residual should be formally accepted by the board with a review date, not left implicit. Monitoring triggers - a second outage, a further subprocessor change, a missed attestation - should automatically re-open the assessment.