SOC 1
The half of the control your client runs.
Some of your control objectives can only be met if the client does its part: approving what it sends you, reviewing what you send back, reconciling the two. A SOC 1 lists these as complementary user entity controls (CUECs). For a client's finance team they are a to-do list; for their auditor, a test plan.
Back to SOC 2 services01 · Why they exist
Why your objectives depend on your clients
You process what you are given. Whether it was right to begin with is often the client's call.
A payroll provider can check that a pay change came from an authorized client contact. It cannot know whether the raise itself was agreed. The objective that payroll changes are authorized is only met when the client approves changes before sending them. That approval is a CUEC.
The concept is the same as in a SOC 2, covered on the complementary controls guide. What changes in a SOC 1 is the stake: a missing CUEC can let an error reach the client's financial statements, and the client's auditor has to test it.
02 · What clients owe
The kinds of things clients usually owe
Most SOC 1 CUECs fall into a handful of patterns.
- Authorize inputs
- Approve transactions and master data changes before sending them to the provider.
- Review reports
- Check the registers, exception reports and summaries the provider returns, and follow up differences.
- Reconcile outputs
- Agree what the provider processed to the client's own records and general ledger.
- Manage their own users
- Control who at the client can send instructions or access the provider's portal, and remove leavers.
- Tell the provider
- Notify changes in authorized contacts, banking details or business rules in time.
03 · Writing them
Writing a CUEC a client can actually check
If a client cannot tell whether they do it, neither can their auditor.
- A named actor. Who at the client does it: the payroll manager, the finance team, an approver.
- One observable action. Review, approve, reconcile, notify. Not “ensure” or “maintain appropriate”.
- A trigger or frequency. Each pay run, each month-end, before each file is sent.
- A trace. Something the client's auditor can inspect: a sign-off, a reconciliation, an approval record.
- A linked objective. Reference the control objective it supports, so readers see why it matters.
Illustrative wording
“Before each pay run is released, an authorized client approver reviews the pre-payroll register and confirms in the portal that the totals are expected (supports objective 2).”
04 · By service type
One example per service type
All illustrative. Your own list comes from your objectives.
| Service type | Illustrative CUEC | What it protects |
|---|---|---|
| Payroll processing | Client reconciles the payroll journal from the provider to the general ledger each pay period | Completeness and accuracy of payroll expense |
| Billing and invoicing | Client approves new price lists before the provider loads them | Accuracy of revenue |
| Loan servicing | Lender reviews the monthly investor report and investigates unexplained balance movements | Accuracy of loan balances and interest |
| Investment custody | Client compares the custodian's holdings statement with its own records each month | Existence of investments |
| Claims administration | Plan sponsor approves benefit rule changes before they are configured | Authorization of claims paid |
| Hosted finance application | Client reviews its own user access to the application each quarter | Restricted access to financial data |
05 · How they are tested
How a client's auditor tests the client's side
Your report hands the client's auditor a list; they test it at the client.
- The auditor reads the CUEC list in your report and decides which ones bear on accounts that matter to this client.
- They ask the client how each is performed and who does it.
- They inspect evidence: signed reconciliations, approval records, portal logs.
- If a CUEC is missing or weak at the client, they consider whether your controls can still be relied on for that objective, and may do extra work elsewhere.
The CPA firm examining you does not test CUECs; they are outside your system. Your opinion is on your controls, on the assumption that clients do their part.
06 · Your side
What to do as the provider
A good CUEC list is short, accurate and communicated.
- Listing what you should do yourself. A CUEC that shifts your own control onto clients will be challenged by the CPA firm and by clients' auditors.
- A list nobody reads. Put CUECs in onboarding material and contracts, not only in the report.
- Missing the obvious one. If you rely on clients reviewing your output, say so. A gap here weakens the objective, not just the paperwork.
- Vague verbs. “Clients should maintain adequate controls” cannot be tested and helps nobody.
Sources: AICPA SSAE No. 18, AT-C section 320; AICPA SOC 1 guide; AICPA AU-C section 402; PCAOB AS 2601. Service types, wording and controls are illustrative.
Questions about SOC 1 user entity controls
Are CUECs a sign that our controls are weak?
No. They reflect how the service is shared.
Every outsourced process has a client side. Listing it honestly shows the auditor where responsibility sits. A report with no CUECs at all is more surprising than one with a sensible list.
Can a client refuse to perform a CUEC?
They can, but their auditor will notice.
If a client skips a CUEC, the objective may not be met for that client. Their auditor then has to find other evidence or adjust their approach. It is worth explaining CUECs at onboarding.
Should CUECs appear in our contracts?
Commonly, yes.
Many providers reference client responsibilities in contracts or service schedules. That keeps the report and the agreement consistent and gives the client a clear list.
How many CUECs is normal?
No fixed number; tie each one to an objective.
Count matters less than relevance. Each CUEC should exist because an objective cannot be met without it. Padding the list with general advice dilutes the ones that matter.
Write the client's half so it gets done.
We help you identify and word user entity controls that clients and their auditors can act on.