Exams or Audits

Our auditors recently requested a memo/report that states we are implementing Complementary User Entity Controls from SOC reports. This is not something we do. Do other financial institutions have vendor reports or memos they document stating that CUECs from vendor SOC reports are implemented by their organizations? 

So, we have a basic excel form that is completed with each SOC Report that is reviewed. The form is just a spreadsheet where the Risk Manager can list out the user consideration in one column and then the control that is in place to address the consideration.  

Was the request for all vendors, or specific ones like Critical or GLBA?

Thank you 

In recent years our external auditors have asked for our review of CUECs from critical vendors that fall within GLBA. I pull the CUEC's from the SOC and provide them to the admin who is over that vendor and they are expected to document the control(s) we have in place and return it to me by a due date. I do not have a separate form or memo. We document everything on the CUEC form (I create a pdf of the CUEC's and then the admin just adds their comments within the doc next to each control.) 

The request was for all vendors in general.

We track CUECs and document whether they pertain to us and what our specific control for that item is. All of that is tracked within our Vendor Management software. Hope that helps :) 

Compiling a common list of SOC CUECs at the onset across our vendor ecosystem has added a lot of value where we aligned internal control owners associated to each designated CUEC. We simply obtain an attestation indicating that these controls are adequately in place (existing providers), or would be in place post-contract (new providers) with future follow up. Trying to extract every CUEC from the SOC report (unless AI capabilities are able to be used) can became overly time consuming and in some cases challenging to copy/paste password-protected documents. YoY we would focus only on documenting new CUEC changes from updated SOC reports for new or changing controls. Every auditor and org has a unique way of explaining CUECs, but they usually accomplish a common internal org control. By obtaining these attestations, it helps ensure control owners were aware of any additional effort which might be required pre/post contract signatures for adequate planning and alignment where proper action plans can be put in place in the event that there was not a control (yet).

Based on past experiences, we used Excel spreadsheets on each occasion.  Pulling from each SOC the CUECs and then expecting the Relationship Managers/risk owners to identify the entity controls.  A couple different risk-based execution expectations were, 1) Required identification of CUECs on an annual basis only for "Critical" vendors, and 2) Required identification of CUECs on financially significant vendors only.  

Based on past experiences, we used Excel spreadsheets on each occasion.  Pulling from each SOC the CUECs and then expecting the Relationship Managers/risk owners to identify the entity controls.  A couple different risk-based execution expectations were, 1) Required identification of CUECs on an annual basis only for "Critical" vendors, and 2) Required identification of CUECs on financially significant vendors only.  

Original Message:
Sent: 03-14-2025 10:45 AM
From: Anonymous Member
Subject: Documenting Complementary User Entity Controls Internal from SOC Reports

This message was posted by a user wishing to remain anonymous

Our auditors recently requested a memo/report that states we are implementing Complementary User Entity Controls from SOC reports. This is not something we do. Do other financial institutions have vendor reports or memos they document stating that CUECs from vendor SOC reports are implemented by their organizations? 

From another list like this, I had an xls for the IT teams to complete (consistently) for responding to CUEC. Feel free to use it. When I actually deployed it, we moved the weighting and just had the questions answered.

Attachment(s)

SOC Review_CUEC Report.xlsx   32 KB 1 version

In section 1of the Checklist, I would suggest adding some wording as to the Qualifications of the SOC Auditor. Such as:

1) Is the SOC Auditor enrolled in the AICPA Peer Review Program?

2) Reviewed the AICPA Peer Review Report and noted under Requested Selections and Considerations that the Peer Review Firm examined the SOC Auditor's SOC 1 and SOC 2 Reports.

Yes, our organization adopts a risk-based approach for all critical third parties and applications. CUECs ensure that specific controls are reviewed and implemented to maintain the effectiveness of the overall control environment. Even if certain controls are not required or implemented, the review process ensures they are thoroughly evaluated and considered.

FFIEC guidance emphasizes that user entities must manage their own access controls and monitor activities to ensure compliance and security.