The American Institute of Certified Public Accountants (AICPA) defines a subservice organization as a service organization used by another service organization to perform some of the services provided to user entities that are likely to be relevant to those user entities’ internal controls over financial reporting (ICFR).
In today’s business environment, an organization typically outsources certain functions to third parties—service organizations—that may in turn outsource certain functions to subservice organizations. Unfortunately, this can unknowingly leave the organization’s transactional or confidential information at risk.