Check what the report expects your company to do. Your vendor may handle part of a process while relying on you to handle another part. Its SOC report does not prove that your part is working.
The report may call these tasks complementary user entity controls, or CUECs. In plain English: controls the provider relies on its customers to perform. Read the actual requirements rather than assuming every customer has the same job.
A simple example
Suppose a payroll provider’s SOC 1 report assumes customers check the pay information they submit. Your team sends the wrong hourly rate. The provider can process that rate correctly and still produce the wrong paycheck.
That is why someone on your side needs to check the input. The provider’s audit is not a substitute for that check. This is an illustration; your provider’s report may describe different controls.
Turn the report into assigned work
For each listed customer control, answer four questions:
- Does it apply? Compare it with the service and features you actually use. Record why any item does not apply.
- Who does it? Name the person or team responsible.
- What do we already do? Link to the existing process. Do not invent a second process just for the vendor review.
- What shows it happened? Keep the review or approval record. A policy alone does not show that someone performed the task.
What if nobody is doing it?
Treat it as an open gap. Ask the relevant owner how the work will be covered. If another control addresses the same need, explain how it does so. Do not mark the item complete just because the vendor has a clean report.
You do not need a large workbook. One short entry for each applicable control is enough to start. Add a follow-up owner and due date where work is missing.
Where to look
Find the customer-control section in the report’s system description. Also read the service instructions and agreement. Other customer responsibilities may exist outside the CUEC list.
For SOC 1, AICPA AT-C 320 explains why these controls matter. Wolf & Company’s reader guidance covers CUECs in SOC 1 and SOC 2.
Next: use our supplier SOC report review steps to check the rest of the report.
4 Responses