Complementary user entity controls: the part that is yours

Some of the controls a vendor arrangement depends on are not the provider's to operate, and your own auditor may ask you about them. They have a name in service organization reporting: complementary user entity controls, or CUECs.

In our view the difficulty is ownership rather than effort: a control described in the provider's report but performed on the customer's side is the one likeliest to go unperformed.

Somebody has already been told to evaluate them

The clearest sign that these are not a paperwork curiosity sits in the federal audit record. A recommendation published with the independent auditors' report on the Small Business Administration's fiscal year 2023 financial statements, listed on Oversight.gov, tells the agency to assess "the risk posed by the service organizations' control environments and obtain sufficient assurance over the operating effectiveness of relevant and significant controls" and then sets out what the agency should do with the reports it obtains. One item reads:

"All complementary user entity controls described in the SOC 1 reports are evaluated using current information and with consideration to their applicability to SBA's internal controls over financial reporting."

The next item asks for more than a reading. It calls for "Evaluation procedures performed to assess whether complementary user entity controls and other SBA-performed controls were tested on a frequency determined by SBA and found operating effectively and, if they are not, assess the impact of such deficiencies on SBA's internal controls over financial reporting."

That recommendation is addressed to a federal agency about its own internal control over financial reporting, so whether anything in it reaches your company is a question for your auditor. What it shows is the direction of travel: somebody downstream of the provider is expected to evaluate these controls, not merely to hold them in a PDF.

What these controls actually are

Some of the controls an arrangement depends on are not the provider's to operate, because the provider is not standing where the control has to happen.

A platform can offer role-based permissions; it cannot decide which of your employees gets the administrator role. It can log every privileged action; it cannot read the log on your behalf. It can accept the file you upload; it cannot know whether the numbers in it were reviewed first.

Those are the assumptions that get written down. In our view the plainest translation is: assumptions the provider made about you, with no mechanism attached for checking whether they held.

The clearer vocabulary sits outside the SOC world

NIST's Computer Security Resource Center glossary gives a common control as "a security or privacy control that is inherited by multiple information systems or programs."

The useful term is the next one along. The same glossary gives a hybrid security control as "a security control that is implemented in an information system in part as a common control and in part as a system-specific control."

In our view that is the shape of a CUEC said in better words: one control, implemented partly somewhere else and partly by you. The list is the provider marking the seam — here is where our half stops.

Why a clean opinion does not close the question

Read what a service auditor's opinion is addressed to. The Department of Agriculture's inspector general describes one such examination of the department's Office of the Chief Information Officer as presenting "the results of the System and Organization Controls 1 Type 2 examination conducted in accordance with relevant attestation standards established by the American Institute of Certified Public Accountants," and says that the report "contains an unmodified opinion on the description and controls that were suitably designed to provide reasonable assurance that the control objectives would be achieved."

The description and the controls in that sentence are the service organization's. In our view, a reader who treats a clean opinion as settling the controls on their own side has borrowed comfort from a sentence that was never about them.

Two SEC documents describe where responsibility sits when a process is outsourced.

SEC staff addressed it at Question 14 of its 2004 frequently asked questions on management's report on internal control over financial reporting. The question is framed around a registrant that "relies on a third party service provider to perform certain functions," with the report under discussion a Type 2 SAS 70 report. The staff's answer opens:

"In situations where management has outsourced certain functions to third party service provider(s), management maintains a responsibility to assess the controls over the outsourced operations."

And closes with a qualification that has aged well:

"Note, however, that management is still responsible for maintaining and evaluating, as appropriate, controls over the flow of information to and from the service organization."

That is staff guidance about a registrant's own assessment of internal control over financial reporting. In our view, the flow of information to and from the service organization is exactly where a CUEC lives.

The SEC's 2007 interpretive guidance in Release 33-8810 works through the version of this problem where the evidence is not available. It says that "management must determine whether the inability to assess controls over a particular process is significant enough to conclude in its report that ICFR is not effective." Note where the consequence lands: on the registrant's own report.

Scope comes up separately in the 2023 interagency guidance on third-party relationships. It says that "when relevant and available, a banking organization may consider reviewing System and Organization Control (SOC) reports and any conformity assessment or certification by independent third parties related to relevant domestic or international standards." That sentence is permissive and is addressed to banking organizations; whether anything in that guidance reaches your company is a question for counsel.

The families that show up

The specific lines differ by provider, but they cluster:

• User administration inside your own tenant. Provisioning, periodic review, and removal when somebody leaves or changes role.
• Authentication configuration. Multi-factor authentication, session length, password policy — whichever dials the platform actually hands you.
• Accuracy and completeness of what you submit. If your file drives their processing, the review happens before the upload.
• Key custody. Where the product offers customer-managed encryption keys, the custody problem is yours.
• Monitoring what the platform exposes. Alerts, audit logs and admin reports are only controls if somebody looks at them.
• Contact hygiene. Security and notification contacts kept current, so an incident notice reaches a person.

Access review is the line worth opening first. In our view the usual slip is offering a policy that describes reviews in place of a record of one, the whole subject of how to run an access review an auditor will accept.

Authentication on your own side of the login carries obligations of its own for some companies. The FTC's guidance on its Safeguards Rule tells covered financial institutions to "implement multi-factor authentication for anyone accessing customer information on your system." Whether your company is covered is a question for counsel.

If you are the one writing the list

• Write them as actions a named person can perform. "The security lead reviews the administrator list and removes leavers" is a control. "Maintains appropriate security" is not.
• Do not use the list to push your own controls across the line. A line reading that the user entity is responsible for the security of the application is an abdication dressed as an assumption.
• Keep the list stable. A CUEC that appears, disappears and reappears across periods suggests the description is being edited rather than described.
• Expect to be asked about it. Buyers return the list annotated, asking which lines are configurable in the tier they bought. That exchange is covered from the buyer's side in security questionnaire versus SOC 2 report, and SOC 1 vs SOC 2 covers which report your customers want.

If you are the one reading it

1. Lift the list out of the report into a document of its own, one line per control.
2. Name an owner for each line, by person rather than by team. Shared ownership of a boundary control is how it goes unperformed.
3. Map each line to something you already do. Access management, change control and monitoring absorb most of them. The ones that do not map are your findings.
4. Mark the ones you cannot perform and raise them with the provider in writing. Each is either a setting you have not found, a tier you have not bought, or a gap somebody has to accept.
5. Keep the evidence where your own auditor can find it. These controls sit in your environment, so the evidence has to as well.

Where to start

Pick your largest vendor, open its most recent report and look for the list. If nobody can tell you whether it has one, that is already the finding.

If a customer deadline is driving your own reporting schedule, the SOC 2 timeline calculator maps the work against that date. The readiness scorecard gives you an ordered list of what to close first.

This is general information, not audit or legal advice. Confirm what applies to you with your auditor or counsel.

Common questions

What is a complementary user entity control?

In our view the plainest reading is this: a control the arrangement depends on that sits on the customer's side of the boundary rather than the provider's. The term travels with service organization reporting. A recommendation published with the independent auditors' report on the Small Business Administration's fiscal year 2023 financial statements asks that 'All complementary user entity controls described in the SOC 1 reports are evaluated using current information and with consideration to their applicability to SBA's internal controls over financial reporting.' Granting the right permissions inside your own tenant, enforcing your own authentication policy and reading the logs the platform exposes are the usual examples.

Does a clean opinion on a vendor's report mean there is nothing left for us to do?

In our view, no, and the way to see it is to read what the opinion is addressed to. The Department of Agriculture's inspector general describes one such engagement as a report that 'contains an unmodified opinion on the description and controls that were suitably designed to provide reasonable assurance that the control objectives would be achieved.' The description and the controls in that sentence belong to the service organization. In our view, treating that as covering the controls on your own side is the reading error worth guarding against, because it leaves a set of controls with no named owner on either side of the relationship.

Who carries the consequence if a listed control is never performed?

In the financial reporting context, SEC staff has said that where management has outsourced certain functions, management maintains a responsibility to assess the controls over the outsourced operations, and is still responsible for maintaining and evaluating, as appropriate, controls over the flow of information to and from the service organization. That guidance is about a registrant's own assessment, so confirm what applies to you with your auditor or counsel.

What should we do if we cannot perform one of the controls on the list?

Raise it with the provider in writing before the relationship goes live, and record what you decided. A control you cannot perform is either a configuration you have not found, a feature tier you have not bought, or a genuine gap that somebody at your end has to accept by name and on a date.

If we are the service organization, can we move our own controls onto the customer's side?

You can write anything you like, but a line reading that the user entity is responsible for the security of the application reads as an abdication rather than an assumption. In our view, a security reviewer treats a vague list as a signal to ask harder questions about everything else in front of them.

Sources

1. Independent Auditors' Report on SBA's Fiscal Year 2023 Financial Statements — recommendation SBA-24-03-28 (agency reviewed: Small Business Administration) · Council of the Inspectors General on Integrity and Efficiency, Oversight.gov
2. Independent Service Auditor's Report on the Office of the Chief Information Officer's Description of Its Application Hosting and Security Systems and on the Suitability of the Design and Operating Effectiveness of Its Controls (issued September 18, 2024) · U.S. Department of Agriculture, Office of Inspector General, via Oversight.gov
3. Management's Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports — Frequently Asked Questions (revised October 6, 2004), Question 14 · U.S. Securities and Exchange Commission, Office of the Chief Accountant and Division of Corporation Finance
4. Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934 (Release Nos. 33-8810; 34-55929), 72 FR 35324 · U.S. Securities and Exchange Commission, via the U.S. Government Publishing Office
5. Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 · Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency, via the U.S. Government Publishing Office
6. Computer Security Resource Center Glossary — 'hybrid security control' · National Institute of Standards and Technology
7. Computer Security Resource Center Glossary — 'common control' · National Institute of Standards and Technology
8. FTC Safeguards Rule: What Your Business Needs to Know · Federal Trade Commission