Complementary user entity controls and subservice organizations: carve-out vs inclusive

• Identify complementary user entity controls relevant to the audit
• Test CUECs at the user entity as part of relying on a type 2 report
• Distinguish the carve-out and inclusive methods for subservice organizations
• Plan procedures for carved-out subservice organizations

Complementary user entity controls

AU-C 402 defines complementary user entity controls (CUECs) as controls that management of the service organization assumes, in the design of its service, will be implemented by user entities and are necessary to achieve the control objectives stated in management's description of the service organization's system.

In plain terms: the service organization's controls work only if your client does its part. Typical CUECs:

• The user entity authorizes changes to master data (pay rates, vendor bank accounts) before submitting them.
• The user entity reviews output reports and reconciles them to its records.
• The user entity restricts access to the service organization's system to authorized employees and removes access timely.
• The user entity notifies the service organization of terminated users.

Which CUECs matter

The SOC 1 report lists CUECs, often in a table mapped to control objectives. Not every CUEC applies to every audit. Under AU-C 402.17b, the user auditor determines whether the CUECs address risks of material misstatement relating to relevant assertions; if they do, the auditor obtains an understanding of whether the user entity designed and implemented them, and if so tests their operating effectiveness.

Practical steps:

1. List every CUEC in the report.
2. Mark the control objectives you are relying on.
3. Keep the CUECs linked to those objectives.
4. For each, identify the client control that performs it, the owner and the evidence.
5. Test those controls as you would any other key control.

If the client has not implemented a relevant CUEC, the control objective may not be achieved for your client even if the service auditor's opinion is unmodified. That is a deficiency at the user entity.

Subservice organizations

AU-C 402 defines a subservice organization as a service organization used by another service organization to perform some of the services provided to user entities that are relevant to those user entities' ICFR. A common example: a payroll provider hosts its application at a data center operator. The data center operator is the subservice organization.

There are two ways the service auditor's report can handle it.

The definition of a subservice organization is in AU-C 402.08, and AU-C 402.A42 describes the inclusive and carve-out methods. AU-C 402.18 requires that when a type 1 or type 2 report excludes services provided by a subservice organization and those services are relevant to the audit, the user auditor applies AU-C 402 to the services provided by the subservice organization.

Handling a carve-out

When a report uses the carve-out method:

1. Read the description to see which services the subservice organization performs and which control objectives depend on it. Carve-out reports usually list complementary subservice organization controls, the controls the service organization expects the subservice organization to perform.
2. Decide whether those services are relevant to your audit.
3. If relevant, obtain the subservice organization's own SOC report (often a SOC 1 or SOC 2) and evaluate it under the same steps as lesson 11.
4. Check that the service organization monitors the subservice organization; the SOC 1 report often describes monitoring controls such as annual review of the subservice organization's report.

If no report is available for a relevant subservice organization, consider other procedures or substantive work, and evaluate the effect on your ability to rely on controls.

Documentation

The SOC 1 review and CUEC mapping template keeps CUECs, subservice organizations and your responses in one place.

Carve-out and CUECs at Ridgeline Property Management