Part II · Chapter 2 · The Boundary · lesson 6

When the control you rely on belongs to somebody else

13 min

Builds on Count what is inside the line before you draw it

Your customer data is encrypted at rest by a database service you did not write, backed up on a schedule you did not set, in a data centre you have never seen. The control is real, it runs, and it is not yours.

There are two legitimate ways to put that in a boundary, and they put the work in completely different places. One of them is widely understood. The other is the one most people are actually doing.

Predict

You exclude a supplier's own controls from the examination of yours — the treatment usually called a carve-out. What happens to the work?

It disappears: their controls are their problem nowIt moves to your reader, who now has to obtain and read a second documentIt moves to your auditor, who tests the supplier insteadNothing changes except a sentence in the document

Two treatments of a control somebody else operates.

Bounded. Their controls are outside the examination. Yours about them are inside it: selection, the assurance you obtained and reviewed, your monitoring, your incident path. The opinion on your document does not reach their machinery, and whoever reads it has to go and get theirs.

Included. Their controls are presented as part of your system and are examined with it. Somebody has to produce evidence about controls you do not operate, and their deficiencies appear in your document.

Both are honest. The cost does not vanish in either; it moves. Bounded moves it to your reader. Included moves it to you, and is only available if you can actually get the evidence.

Not the same thing

Bounding the supplier out

The supplier's own controls sit outside what is examined. The relationship, and every control you operate about it, stays inside.

Measured in: What your document asserts, and what a reader has to obtain elsewhere before they can conclude anything about the whole chain.
For example: The managed database service is named, what it does for you is described, and its own controls are stated as outside the examination.
Chase it alone and: Used where the supplier has no assurance of their own to hand anybody, it is not a boundary — it is a hole with a sentence in front of it, and the reader finds that out by asking once.

Pulling the supplier in

The supplier's controls are presented as part of your system and examined alongside yours.

Measured in: Artefacts about controls you do not operate, for every instance in the period, obtained from somebody with no obligation to you beyond the contract.
For example: The supplier's controls over the database are described as part of your system, and their evidence is obtained and reviewed inside your period.
Chase it alone and: Committed to without checking whether the supplier will actually produce evidence on your schedule, it turns into a month of chasing and a dependency you cannot evidence at all.

Which is which? Put each one on a side.

How you tiered this supplier, and what the tier triggered before you signed
Whether the supplier's own access reviews ran every quarter
Your reader having to obtain a second document whose period does not line up with yours
A deficiency at the supplier appearing as an exception in your own document
The dated record of you reading their assurance report and noting what was unresolved
What you would do on the morning the supplier tells you they have had an incident

The asymmetry nobody mentions

The mechanism for bounding a supplier out exists on one side only.

The criteria side has a device for it: the dependency can be named and its controls placed outside the examination, which bounds the opinion and tells the reader where to go next. That device is why the vocabulary exists at all, and why everybody has heard the term.

The certification side has nothing equivalent. The relationship stays yours to control; there is no mechanism for handing a supplier's controls out of your management system. The only lever is the scope statement itself, which is a blunter instrument — it can describe what the system covers, and it cannot say this part of it belongs to somebody else and was not looked at.

The practical consequence for a company holding or seeking both: a bounding sentence that works in one document has no counterpart in the other, and the same supplier that is outside one examination remains inside your controls in the other. That is one decision rendered two incompatible ways, which is the subject of a later lesson in this track.

Where they part company

One control, two sets of identifiers, and the gap between them

The parts of your system other people run
management system: A.5.19, A.5.22criteria: CC9.2
Only one side has a carve-out. A subservice organisation can be excluded from the examination, which narrows what the opinion covers and formally moves the reader's work onto the vendor's own report; there is no equivalent device on the certification side, where the supplier relationship stays inside your controls and any limitation has to be expressed in the scope statement instead. Two companies with identical vendor stacks can therefore produce documents covering very different amounts of ground.

Choosing, in three questions

Can you get the evidence? Not whether they would send a questionnaire back — whether their assurance covers your period, arrives before your fieldwork, and addresses the controls you depend on. If the answer is no, the included treatment is not available, whatever you would prefer.

Who is your reader? A buyer's security reviewer with a process will chase a second document without complaint. A buyer without one reads the boundary, notices the gap, and escalates. The bounded treatment is cheap for you and assumes competence in them.

What does the supplier do for you? The deeper the dependency, the harder a bounding sentence reads. A payroll system bounded out is unremarkable. The database holding every customer record bounded out invites exactly one question, and you need an answer to it that is better than a sentence.

Check

You bound a supplier out of the examination and your document names them, says what they do, and states their controls as outside it. A buyer's reviewer asks for their assurance report and the supplier has none. What did the boundary do?

Nothing wrong — the boundary was accurate and the supplier's gap is theirsIt made a gap visible that the included treatment would have forced you to fix firstIt transferred the risk to the supplier under the contractIt created a finding in your own document

Worth remembering

A control a supplier operates can be bounded out of the examination or pulled into it; both are legitimate and the cost moves rather than disappearing.
Bounding moves the work to your reader, who must obtain a second document whose period may not line up with yours.
Including moves the work to you: artefacts about controls you do not operate, and their deficiencies appearing in your document.
In both treatments, how you chose the supplier, what assurance you reviewed, what you monitor and what you would do on the bad morning stay inside your boundary.
The mechanism for bounding a supplier out exists on the criteria side and has no counterpart on the certification side, where the scope statement is the only lever.
The included treatment is only available if the supplier's evidence actually covers your period and arrives in time, which is a question to ask before choosing.