Which approach must be taken if a type 1 or type 2 auditor's report is available for a subservice organization?

The correct approach when a type 1 or type 2 auditor's report is available for a subservice organization is the carve-out method. This method allows the main organization to incorporate the controls of the subservice organization as part of its own internal control system, provided that the auditor's report evaluates the design and operational effectiveness of those controls.

Carving out is particularly relevant when analyzing how the services provided by a subservice organization affect the financial reporting and overall controls of the primary entity. By utilizing the audit report, the primary organization can assess whether the controls are functioning as intended and appropriately mitigating risks associated with outsourcing certain processes. This method highlights the importance of external audit assurance in understanding and relying on the subservice organization's control environment.

In contrast, other methods like the exclusive or unified methods do not address the incorporation of controls from a subservice organization effectively, and the integrative method typically comprises a more holistic view not specifically tailored to assess the subservice organization's audit reports. Thus, leveraging the carved-out report is essential for ensuring that the internal controls are evaluated in line with the services relied upon from the subservice organization.