Glossary · SOC and attestation
Every SOC report is written for the customers who rely on it: the user entities.
An organization that uses a service organization's services and relies on its SOC report, and whose own controls complete the controls described in that report.
Back to the glossary01 · In plain words
In plain words
An organization that uses a service organization's services and relies on its SOC report, and whose own controls complete the controls described in that report.
When a company hands part of its work to a provider, it becomes a user entity of that provider. The provider's SOC report is written for it. Some controls only work if the user entity does its part, such as removing its own leavers from the provider's system.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
A SOC report is only useful if the user entity reads it with its own role in mind. The report lists complementary user entity controls (CUECs): things the customer must do for the provider's controls to work. If a user entity skips those, the assurance has a gap the report cannot close. In a SOC 1, the user entity's financial statement auditor, the user auditor, relies on the report when planning their own audit.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The CUEC section of a SOC report
- Lists what each user entity is expected to do on its side.
- A user entity's vendor review file
- Records that the report was read, CUECs mapped and exceptions assessed.
- The user auditor's working papers
- Show how a SOC 1 was used in auditing the user entity's accounts.
- A SOC report's use restriction
- SOC 1 and SOC 2 reports name user entities among their intended readers.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: an NBFC reads its loan platform's SOC 1
A non-banking finance company in Jaipur runs its loan book on a hosted loan-management system. Each year it receives the provider's SOC 1 Type 2. Its finance team maps the CUECs: approving rate changes in the system, reviewing user lists monthly, and reconciling the system's ledger to the general ledger. Its statutory auditor reads the same report and tests that the NBFC does those three things before relying on the provider's controls.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- User auditor
- The auditor of the user entity's financial statements. The user entity is the company; the user auditor audits it.
- Data principal or data subject
- A person whose data is processed. A user entity is a business customer of a service organization.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- If you are a user entity, map every CUEC in your providers' reports to a control you run.
- Record your review of each report and any exceptions that affect you.
- If you are the provider, write CUECs a customer can actually perform and check.
- GuideWho is who in a SOC 1The service organization, user entities and user auditors, and how a report moves between them.
- GuideComplementary controls: what customers and vendors owe the systemCUECs and CSOCs, written so they can actually be checked.
Sources: AICPA AT-C section 320; AICPA AU-C section 402, Audit Considerations Relating to an Entity Using a Service Organization; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization.
Questions about User entity
Can a user entity share the SOC report with others?
Usually only within the intended users.
SOC 1 and SOC 2 reports are restricted-use. They are meant for the service organization, its user entities and their auditors, and for a SOC 2 others with sufficient knowledge, as the report states. A SOC 3 is for general use.
What if a user entity ignores the CUECs?
Its reliance on the report weakens.
The provider's controls assume the customer does its part. If it does not, the user entity cannot treat the report as covering that risk on its side.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.