Reviewing SOC Reports: Complementary User Entity Controls and the User Auditor's Work

Many audits touch a service organization: a payroll processor, a benefit plan recordkeeper, a payment processor, a hosted accounting platform. The client hands over a SOC report and the report goes in the file with a check mark. PCAOB inspection staff have cited that pattern, including auditors who skipped the section describing what the client itself was supposed to be doing: the complementary user entity controls.

This guide covers the review end to end. For the report types themselves, see SOC 1 vs SOC 2 vs SOC 3; for the AU-C 402 framework, see service organizations and SOC 1 reports.

What CUECs are

A service organization designs its system on the assumption that its customers will perform certain controls. Those assumed controls are complementary user entity controls. The service auditor identifies them and delineates them in the description of controls. Typical examples:

• the user entity reviews output reports, such as payroll registers, for accuracy and completeness
• the user entity restricts and reviews its own users' access to the service organization's portal
• the user entity approves changes to master data it submits, and reconciles the service organization's output to its own records
• the user entity reports errors to the service organization on a timely basis

The point is that the service organization's controls only achieve their objectives if those user controls operate. A clean opinion on the service organization does not tell you whether your client's side of the relationship works. The service auditor tests controls at the service organization, not at your client.

What the user auditor remains responsible for

Under PCAOB AS 2601 paragraph .14, if the user auditor decides to use a service auditor's report, the user auditor considers the extent of the evidence the report provides about the effectiveness of controls intended to prevent or detect material misstatements in the relevant assertions, and remains responsible for evaluating the evidence presented by the service auditor and for determining its effect on the assessment of control risk at the user organization. AU-C 402 sets the corresponding responsibilities for audits under AICPA standards. The PCAOB text is the clearer statement of the principle, and it is the benchmark an inspector or peer reviewer will use.

The PCAOB staff's April 2024 Spotlight gives a concrete deficiency. The public company used a service organization to process and record revenue transactions, and the auditor's approach relied on controls over the accuracy and completeness of the transaction data. The auditor did not perform any procedures to test the operating effectiveness of the complementary user controls that the service auditor specified in the SOC report. A March 2022 Spotlight on confirmation service providers lists the same pattern: the audit firm "did not consider complementary user entity controls delineated in the SOC reports."

The review, step by step

1. Confirm the report covers the right service and entity

The service named in the report must be the service your client uses, and the system description must cover the processes that touch your client's financial reporting. Check the entity, the service lines, the locations and the application version.

2. Identify the type and period

A type 1 report describes the system and gives an opinion on whether controls are suitably designed as of a specific date. A type 2 report adds an opinion on whether the controls operated effectively over a specified period, along with the service auditor's tests and results. A design-only opinion is not evidence of operating effectiveness. If you plan to rely on controls, you need a type 2 report.

The period matters. The PCAOB's guidance says that when time has elapsed since the period covered by the report, the auditor considers whether there were changes in the service organization's controls during the uncovered period, and whether to obtain an updated SOC report or perform other procedures. Compare the report period with your audit period and document the gap and your response.

3. Read the opinion

Look for qualified opinions, adverse opinions, emphasis paragraphs and any other modification. Read the basis for any modification closely; it names the control objective that failed.

4. Map the control objectives to your risks

For each significant class of transactions or balance the service organization processes for your client, find the control objectives that address the relevant assertions. Note where the report does not address something you need, such as controls over the accuracy and completeness of the data the service organization produces. The same Spotlight asks the auditor whether the SOC report covered controls relevant to the information used, whether the scope has exclusions, and, if the report does not address accuracy and completeness, whether the auditor identified and tested alternate, compensating or mitigating controls at the company.

5. Evaluate the service auditor's tests and exceptions

Read the test results, not only the opinion. Exceptions in a control the opinion treats as operating effectively still need your attention if they touch your assertions. Consider how the sample was selected and its size relative to the population.

6. Understand subservice organizations

In a SOC 2 examination, management of a service organization that uses a subservice organization may elect the inclusive method or the carve-out method in the description of its system. Under the carve-out method, the subservice organization's controls are outside the report. If the subservice organization's work matters to your client's reporting, you need that organization's SOC report or other evidence.

7. Work through the CUECs

This is the step to document carefully.

1. List every CUEC in the report.
2. Decide which are relevant to your client's use of the service.
3. For each relevant CUEC, identify the client control that addresses it, and who performs it.
4. Evaluate design and implementation through inquiry and inspection. If you plan to rely on the controls to reduce substantive testing, test operating effectiveness.
5. If the client does not perform a CUEC, consider what that means for the service organization's controls over your client's data, and for your risk assessment. Design other procedures where needed.

A mapping table makes the result visible:

8. Decide whether other procedures are needed

If there is a gap in period, a modified opinion, a missing control objective or a CUEC that is not performed, document the additional procedures: direct testing at the service organization where permitted, substantive procedures on the data, or reliance on controls at your client that compensate. Audit evidence under AU-C 500 covers how reliability is judged when the source is a service organization.

Common review failures

• Filing the report without reading beyond the opinion page.
• Relying on a type 1 report for operating effectiveness.
• Ignoring the gap between the report period and the audit period.
• Treating a carve-out subservice organization as if it were covered.
• Listing CUECs without tying them to client controls.
• Testing CUEC design but not operating effectiveness when relying on controls.

Where the service organization produces data you use, the data reliability question applies in addition to the control review, as discussed in auditing AI-generated inputs to financial reporting. That post covers the same accuracy and completeness logic for another source of information produced outside your client's accounting records.

Frequently asked questions

Are CUECs optional?

For the service organization's description, they are part of the delineated controls the system assumes. For the user auditor, evaluating them is part of using the report, and the PCAOB inspection findings show they are not optional in practice.

Can I rely on a SOC report from last year?

Only to the extent it covers your period or you perform procedures on the uncovered period. Consider changes in the service organization's controls since the report period.

Is a SOC 2 acceptable for financial statement audits?

A SOC 2 addresses security, availability, processing integrity, confidentiality or privacy, not internal control over financial reporting. A SOC 1 is designed for user auditors. A SOC 2 can still inform your understanding of IT controls at the service organization.

Who owns CUEC testing, the service auditor or us?

You do. The service auditor identifies them and does not test them at individual user entities.

Sources

• PCAOB staff Spotlight on auditor use of data and reports (April 2024), discussing AS 2601 paragraph .14: https://assets.pcaobus.org/pcaob-dev/docs/default-source/documents/data-and-reports-spotlight.pdf
• PCAOB, Spotlight: Observations and Reminders on the Use of a Service Provider in the Confirmation Process (March 2022): https://pcaobus.org/documents/observations-reminders-confirmation-process-spotlight.pdf
• AICPA, Appendix A: Comparison of SOC 1, SOC 2, and SOC for Cybersecurity Examinations and Related Reports (as published by the U.S. Department of Labor ERISA Advisory Council): https://www.dol.gov/sites/dolgov/files/ebsa/pdf_files/2022-cybersecurity-issues-affecting-health-benefit-plans-blanco-best-written-statement-appendix-a-07-18.pdf
• Journal of Accountancy, "Explaining the 3 faces of SOC" (June 2016): https://www.journalofaccountancy.com/newsletters/2016/jun/3-face-of-soc/

CORAA prepares audit files for US CPA firms from client books; the firm reviews and signs. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error