Mapping complementary user entity controls to your vendor contracts

Public companies and regulated financial institutions rely on service organizations for payroll, custody, loan servicing, cloud hosting and dozens of other processes that feed the financial statements. For SOX purposes, the usual evidence that those outsourced controls work is a SOC 1 Type 2 report issued under the attestation standards. Management reads the opinion, files the report and moves on.

That is where the gap opens. Almost every SOC 1 report includes a section listing complementary user entity controls: things the vendor assumes each customer does, such as reviewing access lists, reconciling output files or approving changes to master data. If you do not perform those controls, the vendor’s control objectives may not be achieved for you, and your auditor will ask how you are compensating. Findings in this area are common because the CUEC list is read by the SOX team but rarely connected to the contract or to the people who own the process.

This guide is for SOX program managers, IT audit leads and vendor management teams in banks, insurers and other public companies. It explains what to put in vendor contracts, how to map each CUEC to an internal control and a five-step approach that keeps the mapping current as reports change each year.

Contract terms that make SOC 1 reliance work

Reliance on a SOC 1 report is only as good as the contractual right to receive it on time and understand what changed. Strong vendor agreements for in-scope services carry these provisions.

• Report delivery, an obligation to provide a SOC 1 Type 2 report annually, covering a defined period and delivered within a set number of days after period end.
• Bridge letter, a commitment to provide a letter covering the gap between the report period end and the customer’s fiscal year end, confirming no material changes.
• Exception notice, a duty to notify the customer of control deviations, qualified opinions or significant incidents affecting in-scope controls.
• Subservice disclosure, identification of subservice organizations used for in-scope processes, and whether they are carved out or included in the report.
• Fallback audit right, the right to perform or commission testing if a report is late, qualified or does not cover the services purchased.

These clauses convert assurance from a courtesy into an obligation with a date. Without them, SOX teams spend the last weeks of the year chasing vendors for reports and bridge letters that arrive late or not at all. The same principle applies across third-party risk programs, as the SOX third-party risk exam checklist sets out. Contract language is also the only reliable way to learn when a vendor changes subservice providers or report scope, both of which can silently shift CUEC responsibilities onto you.

Where CUEC programs fail

Internal audit and external audit findings around service organizations follow a recognizable pattern. Each one traces back to a missing link between the report, the contract and the control owner.

• CUECs are never mapped. The SOX team files the report, but nobody matches the listed CUECs to existing internal controls or assigns an owner for gaps.
• Reports cover the wrong scope. The vendor’s report addresses a different service line, platform or location than the one the company actually uses.
• Bridge letters are missing. The report period ends months before fiscal year end, and no bridge letter covers the gap, leaving a period without assurance.
• Carve-outs are ignored. Subservice organizations are carved out of the report, but no one obtains their reports or evaluates the related complementary controls.
• Mapping goes stale. The vendor updates its CUEC list from one year to the next, but the internal mapping still reflects the old version.

A five-step roadmap for CUEC mapping

Step 1, Inventory in-scope vendors

List every service organization whose processing affects financial reporting, and link each to its contract, the services purchased and the financial statement assertions involved. This inventory becomes the backbone of the program and should be refreshed whenever a new vendor or service is onboarded.

Step 2, Strengthen the contract terms

Review in-scope agreements for report delivery, bridge letter, exception notice, subservice disclosure and fallback audit clauses. Add missing terms at renewal or through amendment, and record each obligation with a due date so delivery can be tracked rather than chased.

Step 3, Map each CUEC to an internal control

For every CUEC in the current report, identify the internal control that satisfies it, the owner and the evidence produced. Where no control exists, design one or document a compensating control. AI-assisted review can extract CUEC lists from long reports and compare them with the prior year to highlight changes.

Step 4, Test and document

Include mapped CUEC controls in the annual SOX test plan. Keep test evidence alongside the vendor record so auditors can see the report, the evaluation, the mapping and the test results in one place, rather than across several shared drives and spreadsheets.

Step 5, Monitor through the year

Track report and bridge letter due dates, review exceptions when reports arrive, evaluate carved-out subservice organizations and update the mapping when CUEC lists change. Escalate late or qualified reports under the contract’s fallback provisions.

Connecting contracts, reports and control owners

The organizations that handle service organization reliance well treat each in-scope vendor as a single record. The contract, the current SOC 1 report, the bridge letter, the CUEC mapping, test evidence and any exceptions sit together, with due dates and owners visible to SOX, IT audit and vendor management. When the report arrives, the reviewer compares scope and period to what the contract promised, logs exceptions and updates the mapping. When the vendor changes a subservice provider, the notice obligation in the contract triggers a review. This structure also helps with regulatory expectations beyond SOX. The 2023 interagency guidance on third-party relationships from the US banking agencies discusses reviewing independent assurance reports, such as SOC reports, during due diligence and ongoing monitoring, and a mapped, evidenced CUEC program is a direct way to show that work. For broader context on automating vendor oversight, see the third-party risk contract automation guide.

Common CUECs and how to evidence them

CUEC wording varies by vendor and service. The examples below show typical categories and the kind of internal control and evidence that usually satisfies them.

Complementary user entity controls are where vendor assurance meets your own control environment. Put report delivery, bridge letters and notice duties in the contract, map every CUEC to an owned control, test it and keep the mapping current each year. Do that and the SOC 1 report becomes evidence you can rely on rather than a file you hope nobody questions.

For related guidance, see Vendor contract controls for OCC and FFIEC exam readiness, Vendor contract controls for OCC and FFIEC examinations and Termination assistance clauses, an exit readiness datasheet.

Aavenir Financial Services PracticeAavenir’s Financial Services practice works with SOX, IT audit and third-party risk teams on contract-driven vendor oversight.