What it is
When a service provider processes transactions for you, its SOC 1 report is evidence about the controls that matter to your financial reporting. It only helps if it covers the right service and period and the controls you rely on. This workbook documents the review.
It records the report type, period, opinion, exceptions and subservice organizations, calculates the gap between the report period and your year-end, and maps each complementary user entity control to a control you perform, with the test and result.
When to use it
- When a service organization’s report is received.
- At year-end to cover the gap between report period and year-end.
- When the auditor asks how the entity monitors its service providers.
What’s inside
- Report review tab with period coverage and opinion checks
- CUEC mapping for up to 40 controls with owner, test and result
- Checks for relevant controls with no mapping and for exceptions
Standard cited
This template follows SOC 1 / service organization controls. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What is a complementary user entity control?
A control that the service organization assumes its customers perform for the service organization’s controls to work as described. Each relevant one needs an owner and evidence in your entity.
Does a bridge letter extend the report?
No. A bridge letter can help you understand changes after the report period, but it cannot extend the service auditor’s opinion. Cover the gap with your own procedures where needed.
Related templates
- SOC 2 Control Matrix (Trust Services Criteria)
- Risk and Control Matrix: IT General Controls
- IPE Testing Worksheet (Information Produced by the Entity)
- SOX ITGC Test Plan
Last updated 11/05/2026. All free templates.