Glossary · SOC and attestation
Some controls only finish on the customer's side, and CUECs say which.
Controls a service organization assumes its customers (user entities) will run, without which its own controls would not fully meet the stated objectives or criteria.
Back to the glossary01 · In plain words
In plain words
Controls a service organization assumes its customers (user entities) will run, without which its own controls would not fully meet the stated objectives or criteria.
Some protections only work if the customer does their share. A service can enforce passwords, but only the customer knows when an employee leaves. Complementary user entity controls, or CUECs, are the customer-side steps your SOC report assumes. They are listed so each customer knows what is theirs to do.
Spelled out: Complementary user entity controls.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
CUECs move responsibility to the reader, so a buyer who skips them is relying on assurance that does not fully exist. For the service organization, a well-written list prevents disputes after an incident: if the report said customers must remove leavers from the admin console, a breach through a stale account is easier to trace. For a customer's auditor, CUECs are a to-do list: they test the customer's own controls that match each CUEC before relying on the report.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Section 3, the system description
- A list of CUECs, often near the end, sometimes mapped to criteria or objectives.
- The auditor's opinion
- A paragraph noting that the conclusion assumes customers apply the CUECs.
- Customer onboarding packs
- Where good providers repeat the CUECs as plain set-up steps.
- A buyer's vendor review
- Where the reviewer checks their own team actually performs each CUEC.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a fund administration portal used by investment managers
A fund administrator gives investment managers a portal to approve capital calls. Its report lists a CUEC: customers review the list of their users with approval rights each quarter and tell the administrator about changes. One manager's auditor asks for evidence of those reviews. The manager has none, so the auditor cannot rely fully on the administrator's access controls for that client and has to test more of the manager's own approvals instead.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- CSOC
- CSOCs are controls your vendors are assumed to run. CUECs are controls your customers are assumed to run. One looks down the supply chain, the other looks up it.
- Shared responsibility model
- A cloud provider's general split of duties, published as marketing or documentation. CUECs are specific, listed in a SOC report and tied to its opinion.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Write each CUEC as an action a customer can perform and show evidence for, not as a general duty.
- Keep the list short and real: a CUEC should exist only where your control genuinely depends on the customer.
- As a buyer, assign an owner to every CUEC in each vendor report you rely on.
- GuideComplementary controls: what customers and vendors owe the systemCUECs and CSOCs, written so they can actually be checked.
- GuideUser entity controls in a SOC 1What clients must do for your controls to work.
- GuideA scorecard for a vendor's SOC 2 reportTen checks that tell a useful report from a thin one.
Sources: AT-C section 320; AICPA guide on SOC 1 reporting; AICPA guide on SOC 2 reporting; DC 200 description criteria; AU-C section 402.
Questions about CUEC
Does a long CUEC list mean a weak vendor?
Not always, but read it closely.
Some services rightly hand customers many tasks. A long list becomes a warning when CUECs cover things the vendor could easily do itself, or are written so vaguely that no customer could show they did them.
Does the CPA firm test CUECs?
No.
The service auditor tests the service organization's controls. CUECs sit with each customer, and only the customer, or the customer's own auditor, can check them.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.