What it is
When an entity outsources payroll, hosting, custody or billing, part of its internal control sits with the service organization. AU-C 402 requires the user auditor to understand those services and how they affect the entity’s controls, and allows a SOC 1 Type 2 report to be used as evidence.
This checklist covers both the entity’s own vendor oversight and the auditor’s evaluation of a report: the report type, period coverage and bridge, the service auditor’s opinion, exceptions, complementary user entity controls and subservice organizations.
When to use it
- Assessing payroll, trust, hosting and billing providers during planning.
- When a client gives you a SOC report and you need to decide how to use it.
- Building or improving a client’s vendor oversight process.
What’s inside
- Vendor inventory and criticality
- Due diligence and contract terms
- SOC report evaluation and CUEC mapping
- Subservice organizations
- Ongoing monitoring and conclusions
Standard cited
This template follows AU-C 402. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Can a SOC 2 report replace a SOC 1?
Not usually for financial reporting controls. SOC 2 addresses trust services criteria such as security and availability. A SOC 1 addresses controls relevant to user entities’ financial reporting. A SOC 2 can still be useful context for IT risks.
What if the SOC 1 report ends before year end?
Obtain a bridge letter and perform additional procedures for the gap, and evaluate whether the gap and any changes at the vendor affect reliance.
What are CUECs?
Complementary user entity controls are controls the service organization assumes the user has in place for the service’s controls to work, such as reviewing output reports. Map each to the client’s own control and test it.
Related templates
- SOX ITGC Test Plan
- ITGC and User Access Review Checklist (Financial Statement Audit)
- IPE Testing Worksheet (Information Produced by the Entity)
Last updated 11/05/2026. All free templates.