Definition
Complementary user entity controls (CUECs) are controls that the service organization's management assumes will be implemented by user entities, and that are needed to achieve certain control objectives in its description. They are listed in the SOC report. Examples: reviewing payroll registers for accuracy, approving changes to user access, and reconciling the provider's reports to the client's records.
Why it matters in an audit or review
The user auditor reads the CUEC list and decides which apply to the client and matter to the audit. If a control objective is met only when the client runs a CUEC and the client does not, the service organization's controls may not give the assurance the auditor expected. The user auditor therefore tests or evaluates the client's CUECs when relying on the report.
Example
A payroll provider's SOC 1 lists a CUEC that clients must review the payroll preview before approving the run. The auditor inspects three payroll cycles at the client for the reviewer's sign-off and the follow-up on differences. Without that review, the auditor could not use the provider's calculation controls to reduce testing.
Common mistakes
Filing the SOC report without mapping each CUEC to a client control.
Sources
- AICPA, AT-C Section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' ICFR (description of CUECs)
- AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error