What are CUECs and why do auditors ask about them?

Complementary user entity controls (CUECs) are controls that a service organization's system assumes its customers operate, listed in the vendor's SOC 1 or SOC 2 report. The vendor's controls were designed on that assumption. If you do not operate your CUECs, the controls the auditor tested may not achieve their objectives for you, whatever the opinion says.

CUECs are one of the most often missed parts of a SOC report review, and one of the first things internal auditors and examiners ask about. This post explains what they are, why they matter, how to map and evidence them, and how they relate to the controls a vendor expects its own providers to run.

What are complementary user entity controls?

Every outsourced service splits responsibility. The vendor runs the platform, and you still decide who gets access, what data goes in and what you do with the output. A SOC report describes the vendor's side of that split. The CUEC list, usually found in or near management's description of the system, describes the side the vendor expects you to cover.

Some typical examples:

• User access reviews. You periodically review which of your users have access to the vendor's application and remove what is no longer needed.
• Notifying the provider of terminated users. Where the vendor manages accounts for you, you tell it promptly when someone leaves.
• Reconciliations. You reconcile what you sent to the vendor with what it processed and returned, such as payroll totals or transaction files.
• Securing your own credentials. You protect the API keys, passwords and administrator accounts that give access to the service.
• Reviewing reports the vendor provides. You review exception or activity reports and act on what they show.

Why can an unoperated CUEC undermine the auditor's conclusion?

A service auditor's opinion is typically worded so that it holds only if the complementary controls assumed in the design were also in place. The auditor does not test your CUECs. They are outside the examination.

Consider the vendor's control "user access is removed within one business day of notification". The auditor may test it and find it works perfectly. But if your team never tells the vendor that someone has left, that control never starts, and former staff keep access. The report is accurate, the opinion is clean, and the risk is fully open for you.

That is why a SOC report alone is not evidence that a control objective is met for your organization. It is evidence that the vendor's half works. The other half is yours to prove.

How do you map each CUEC to your own controls?

Treat the CUEC list as a set of requirements and work through it for every vendor that matters.

1. Extract every CUEC from the current report, word for word, with the control objective or criterion it supports.
2. Decide whether it applies. Some CUECs relate to features you do not use. Record why it does not apply, rather than silently skipping it.
3. Map it to an existing internal control, such as your quarterly access review or your leaver process. If nothing matches, you have a gap.
4. Name an owner for each mapped control, usually the business or IT team that runs it.
5. Keep evidence that the control operated: review sign-offs, leaver notifications sent to the vendor, completed reconciliations.
6. Recheck at each new report. CUEC lists change when vendors change their services or their auditors.

What are carve-outs and complementary subservice organization controls?

The vendor relies on its own providers too, such as a cloud platform or a data center. In the SOC report these are subservice organizations. The report handles them in one of two ways:

• Inclusive method. The subservice organization's relevant controls are described and tested within the vendor's report.
• Carve-out method. Its controls are excluded from the description and testing. The report instead lists the complementary subservice organization controls (CSOCs) that the vendor expects that provider to operate.

CSOCs mirror CUECs one level down: CUECs are what the vendor expects of you, and CSOCs are what it expects of its own providers. With a carve-out, nobody in your report has tested those provider controls. For a material subservice organization, look for assurance over it, typically that provider's own SOC report, and check how the vendor monitors it. This is also where fourth-party, or downstream, risk enters your program.

What do examiners and auditors ask about CUECs?

Internal auditors and examiners tend to ask a short set of questions when they sample a vendor file:

• Did you identify the CUECs in the vendor's current report?
• Is each one mapped to an internal control with a named owner?
• Can you show evidence that those controls operated during the period?
• How were gaps handled, and were any risks formally accepted?
• For carved-out subservice organizations, what assurance did you obtain?

The US Interagency Guidance on Third-Party Relationships expects banking organizations reviewing SOC reports to consider whether their scope and results are relevant to the activity (Federal Reserve SR 23-4 attachment). A file with the report but no CUEC mapping shows the report was received, not reviewed.

Frequently asked questions

What does CUEC stand for?

CUEC stands for complementary user entity control. It is a control that a service organization assumes its customers, the user entities, will operate, and it is listed in the service organization's SOC 1 or SOC 2 report. The vendor's own controls were designed on the assumption that customers operate these controls alongside them.

Does the SOC auditor test CUECs?

No. CUECs are outside the scope of the service auditor's examination, because they are operated by customers rather than by the service organization. The auditor's opinion is typically conditioned on customers operating them. Each customer has to confirm and evidence its own CUECs, usually by mapping them to internal controls with named owners.

What is the difference between a CUEC and a CSOC?

A CUEC is a control the service organization expects its customers to operate. A CSOC, a complementary subservice organization control, is a control it expects one of its own providers to operate when that provider is carved out of the SOC report. CUECs are your responsibility; CSOCs point to fourth parties you need assurance over.

What happens if we do not operate a CUEC?

The vendor's related control may not achieve its objective for your organization, even with a clean audit opinion. For example, if you never notify the vendor that an employee has left, its access removal control never runs. Record the gap as a finding, assign an owner, and fix it or formally accept the risk.