9.3 Complementary User Entity Controls (CUECs)

Complementary User Entity Controls (CUECs)

Quick Summary: In modern outsourced architectures, internal control is not a monolithic structure maintained entirely by the service provider. Under SSAE 21 and AU-C section 402, Complementary User Entity Controls (CUECs)—historically termed User Control Considerations (UCCs)—are controls that the service organization's management assumes will be designed and implemented by user entities (customers). If these customer-side controls are not implemented and operating effectively, the service organization's controls cannot achieve the stated Trust Services Criteria or control objectives. CUECs represent the operational bridge in the shared responsibility model.

---

1. The Architectural Role of CUECs in Internal Control

When a service organization designs its system and control environment, it makes fundamental assumptions about the operating environment at customer organizations. No cloud platform, outsourced payroll provider, or enterprise SaaS solution operates in complete isolation from the customers accessing it.

The Shared Responsibility Model

Consider a high-security physical vault company. The vault provider designs 2-foot-thick reinforced steel doors, multi-factor biometric locks, seismic sensors, and continuous CCTV surveillance. However, the vault provider's security controls assume that the customer does not write the master vault combination on a whiteboard in a public lobby, nor loan their biometric credential card to an unauthorized third party. If the customer fails to protect the combination, the vault's physical safeguards are circumvented.

In the same manner, a cloud service provider (e.g., Salesforce, Workday, Amazon Web Services) can engineer world-class technical infrastructure, but if a customer creates user accounts with the password Password123!, fails to enforce multi-factor authentication (MFA), or fails to deprovision terminated employees, the overall system of security collapses.

+-----------------------------------------------------------------------------------+
|                         THE COMPLETE CONTROL ENVIRONMENT                          |
+-----------------------------------------+-----------------------------------------+
|       SERVICE ORGANIZATION CONTROLS     |  COMPLEMENTARY USER ENTITY CONTROLS     |
|          (Tested in SOC Report)         |                 (CUECs)                 |
+-----------------------------------------+-----------------------------------------+
| • Multi-tenant data isolation           | • Timely deprovisioning of terminated   |
| • Physical data center security         |   user accounts                         |
| • Hypervisor and network firewalls      | • Mandatory multi-factor authentication |
| • Database encryption at rest           | • Least-privilege role assignment       |
| • System incident response & patching   | • Independent reconciliation of outputs |
+-----------------------------------------+-----------------------------------------+
|                   MUTUAL DEPENDENCY FOR CRITERIA ACHIEVEMENT                      |
|                                       |                                           |
|                                       v                                           |
|                     TRUST SERVICES CRITERIA ACHIEVED                              |
+-----------------------------------------------------------------------------------+

Formal Definition under Attestation Standards

Under AICPA attestation standards (AT-C section 205 and Description Criteria DC section 200), CUECs are defined as:

Controls that the service organization's management assumes, in the design of the service, will be implemented by user entities, and which, if necessary to achieve the control objectives or trust services criteria stated in management's description of the system, are identified in the description.

---

2. Concrete Real-World CUEC Implementations Across Service Sectors

To master CUECs for the CPA ISC exam, candidates must understand how CUECs apply across different technical architectures and outsourced services:

Cloud Infrastructure-as-a-Service (IaaS / PaaS - e.g., AWS, Azure, GCP)

In an IaaS environment, the cloud vendor manages physical hardware, facilities, and the virtualization layer. Everything built on top of the virtual instance is the customer's operational responsibility:

• CUEC 1 (Identity & Access): User entities are responsible for configuring and enforcing Multi-Factor Authentication (MFA) for all root and identity-and-access-management (IAM) tenant accounts.
• CUEC 2 (Network Configuration): User entities are responsible for defining virtual private cloud (VPC) subnets, configuring security group inbound/outbound firewall rules, and restricting public internet access to database endpoints.
• CUEC 3 (Key Management & Encryption): User entities are responsible for generating, rotating, and managing encryption keys via Key Management Service (KMS) and enabling encryption-at-rest flags on provisioned storage volumes (e.g., AWS S3 buckets, EBS volumes).
• CUEC 4 (Patching): User entities are responsible for applying operating system, middleware, and application patches to virtual machine guest instances.

Software-as-a-Service (SaaS - e.g., Workday, Salesforce, ServiceNow)

In a SaaS environment, the vendor manages the application code, databases, and underlying infrastructure. The customer manages access, configuration, and data input:

• CUEC 1 (User Lifecycle): User entities are responsible for maintaining formal user provisioning and deprovisioning procedures, ensuring access is revoked within 24 hours of employee separation.
• CUEC 2 (Segregation of Duties): User entities are responsible for configuring role-based permissions (RBAC) within the application to ensure that no single user possesses conflicting entitlements (e.g., creating and approving invoices).
• CUEC 3 (Review of Audit Logs): User entities are responsible for periodically extracting, reviewing, and monitoring administrator activity logs generated by the SaaS application for unauthorized changes.

Outsourced Payroll and Financial Processors (e.g., ADP, Paychex, Stripe)

In transactional processing systems, controls over data validity, completeness, and disbursement approval reside predominantly with the customer:

• CUEC 1 (Pre-Processing Approval): User entities are responsible for reviewing and authorizing the preliminary payroll register (preview report) prior to authorizing funds transmission.
• CUEC 2 (Independent Reconciliation): User entities are responsible for independently reconciling total payroll disbursements debited from their corporate bank account against general ledger journal entries and certified payroll reports.
• CUEC 3 (Master File Maintenance): User entities are responsible for restricting access to change employee direct deposit bank routing numbers and requiring dual authorization for bank account alterations.

---

3. Placement and Presentation of CUECs in the SOC Report

CUECs are not informal recommendations; they are structured, authoritative components of the SOC report. They appear in multiple sections:

Section III: Management's Description of the System

Management must dedicate a specific subsection in Section III to Complementary User Entity Controls. For each Trust Services Category or control objective, management outlines the specific responsibilities expected of user entities. For example, under criterion CC6.2 (User Access Modification), management states: "The achievement of criterion CC6.2 is dependent upon user entities promptly notifying the service organization of terminated personnel to enable credential deactivation."

Section IV: Service Auditor's Test Matrices

In Section IV of a Type 2 report, the auditor displays the testing matrix. While service auditors do not test CUECs at user entities, the matrix explicitly cross-references which service organization controls rely upon specific CUECs to achieve the criteria.

Sections I & II: Auditor's Report and Management's Assertion

Both the independent service auditor's report (Section I) and management's assertion (Section II) contain an explicit, standardized caveat:

"Our opinion is based on the assumption that the complementary user entity controls contemplated in the description are suitably designed and operating effectively at user entities to achieve the criteria identified in the description."

4. User Entity Auditor Responsibilities: Testing CUECs

When a financial statement auditor (user auditor) conducts an audit under AU-C 402, obtaining a pristine, unmodified SOC 1 or SOC 2 Type 2 report from a service organization represents only half of the required audit work.

The Mandatory 4-Step User Auditor Workstep Program

1. Obtain and Review the SOC Report: The user auditor reviews Section I to verify an unmodified opinion, checks the testing period, and inspects Section IV for reported deviations.
2. Extract Applicable CUECs: The auditor reads Section III to extract all Complementary User Entity Controls specified by the service organization.
3. Map CUECs to Internal Client Controls: The auditor assesses which CUECs are relevant to how the client interacts with the service organization. The auditor maps each relevant CUEC to specific internal controls operated by the user entity (e.g., mapping a CUEC requiring monthly output reconciliations to the client's internal general ledger accounting control).
4. Test Design and Operating Effectiveness at the User Entity: The user auditor must directly test whether the user entity implemented and operated those CUECs throughout the financial statement audit period. The user auditor performs standard audit procedures (inquiry, observation, inspection of reconciliation sign-offs, reperformance of sample matching) on the client's controls.

---

5. The Consequence of CUEC Failure: "The Broken Bridge"

What occurs when a user entity fails to implement or operate the CUECs listed in a service organization's SOC report?

The Fatal Breakdown of Control Reliance

If a user entity fails to perform its complementary controls, the auditor cannot rely on the service organization's SOC report, even if the service organization's SOC report is 100% pristine with zero deviations.

• Example: A healthcare company uses an unmodified SOC 2 Type 2 cloud platform to store patient health records. The cloud provider's report lists CUEC #1: "User entities must enforce Multi-Factor Authentication (MFA) and immediately revoke credentials upon employee termination." During the audit of the healthcare company, the auditor selects a sample of 25 terminated doctors and finds that 8 accounts remained active for over 90 days after departure, and MFA was not enforced on administrative accounts.
• Audit Consequence: The healthcare company cannot claim that patient data is secured merely because AWS or Azure is SOC 2 compliant. The control failure resides squarely at the user entity. The user auditor must assess a control deficiency (which may rise to the level of a Significant Deficiency or Material Weakness in internal control), expand substantive testing, and potentially qualify the internal control opinion.