thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Complementary User Entity Controls (CUEC)

Controls a service organization assumes its customers will implement for the overall control objectives to be met.

Definition

SOC reports list CUECs, such as customers managing their own user access or reviewing reports. If customers do not implement CUECs, the assurance provided by the report may not hold. Reviewing CUECs is a key part of vendor risk assessment.

Example

A SOC 2 states customers are responsible for disabling their own users' access upon termination.

Exam tip

Failing to implement CUECs is a common gap auditors look for at user entities.

Related terms