Carve-Out Temptation for a Payments Orchestrator

The VerifyNow exclusion is not supportable merely because VerifyNow has its own SOC 2 report. If VerifyNow performs a function that supports Rivergate's in-scope service, it is a subservice organization. Management must either use the carve-out method, disclose the subservice organization and the complementary subservice organization controls in the system description, and describe the complementary user entity controls that merchants must perform, or use the inclusive method and include VerifyNow's controls in scope. Omitting it entirely would make the system description incomplete.

The legacy settlement service is harder to exclude. It shares the Kubernetes cluster, the identity provider, and can read production database backups. Those shared components mean a compromise of the legacy service can affect in-scope systems and merchant data. A system description that excludes it while claiming coverage of production may be misleading. Management could retire the service before the period starts, isolate it into a separate environment with separate credentials and no backup access, or include it in scope. 'Only three customers' is a business materiality argument, not a system-boundary argument. The auditor should also challenge the sales statement, because the report cannot honestly claim to cover all systems that touch merchant data if the legacy service is excluded.

A carve-out is usually the practical choice when VerifyNow is a mature vendor with its own SOC 2 report. Rivergate would identify VerifyNow in the system description, describe the service it provides, state that the report does not include the vendor's controls, and list the complementary subservice organization controls that Rivergate relies on, such as vendor access controls, encryption, and availability monitoring. Rivergate still needs vendor risk management evidence: due diligence, review of the report, review of the bridge letter, and follow-up on exceptions. The inclusive method would require testing VerifyNow's controls, often through another auditor, and is rarely proportionate for a single KYC function.

The two-month gap matters. If no bridge letter exists, management should obtain one, or perform alternative monitoring such as a vendor questionnaire, evidence of control operation, or a discussion with the vendor. If the vendor cannot provide coverage, Rivergate must assess whether the controls operated during the gap and whether the missing evidence creates an exception or a scope limitation. The auditor should document the gap and consider whether it affects the opinion. A quick fix is not to backdate a letter; it is to document the monitoring performed and the conclusion.

Management should correct the commitment in writing rather than let the system description follow the sales promise. The scope of a SOC 2 report is defined by the system description and management's assertion, not by a sales email. If the legacy service remains outside the boundary but shares infrastructure and can read backups, the honest description is narrower than 'all systems that touch merchant data.' That mismatch is a misrepresentation risk and could mislead the customer about the controls protecting its data.

The corrective steps are: confirm the final boundary with the auditor; document the rationale for any exclusion; notify the customer of the actual scope before contracting; and, if the customer requires coverage of the legacy service, either include it or accelerate retirement and isolation. Sales should not use the report as a substitute for the customer's own due diligence. A short scope clarification now is cheaper than a later dispute over what the report was represented to cover.