A user entity is an organization that outsources a business function to a service provider whose internal controls are likely relevant to the user’s own internal control over financial reporting.1American Institute of Certified Public Accountants. AT-C Section 320 – Reporting on an Examination of Controls at a Service Organization Relevant to User Entities Internal Control Over Financial Reporting – Section: Definitions The term comes from the AICPA’s attestation standards, and it matters because the label carries real work. If you use a payroll processor, a cloud host, a benefits administrator, or any similar vendor whose activity feeds your financial statements or touches data your auditor cares about, you are a user entity, and you are responsible for obtaining certain audit reports from that vendor, implementing controls the vendor assumes you have in place, and tracking any subcontractors the vendor uses.
When the Label Applies to You
The test is functional, not contractual. A payroll processor calculates tax withholdings that show up on your income statement. A cloud provider holds records your auditor needs to examine. In each case, the vendor’s controls directly affect the accuracy and security of your reporting, so your auditor cannot simply ignore that vendor’s control environment. Someone has to give the auditor assurance that the vendor’s processes are reliable, and that someone is you.
The obligation runs in three directions at once: outward to the vendor (to get evidence of their controls), inward to your own operations (to run the controls they assume you’re running), and downstream (to account for anyone the vendor has subcontracted to). Miss any of the three and your own audit or compliance review can unravel, even if the vendor is doing everything right on their end.
The Reports You Need to Request
SOC reports are the standard mechanism by which a service organization gives its user entities evidence about controls. There are three types, and asking for the wrong one wastes time or leaves gaps.
SOC 1
A SOC 1 evaluates controls at a service organization that are relevant to user entities’ internal control over financial reporting.2American Institute of Certified Public Accountants. AT-C Section 320 – Reporting on an Examination of Controls at a Service Organization Relevant to User Entities Internal Control Over Financial Reporting If a vendor processes transactions that flow into your general ledger, this is the report to ask for. Payroll processors, loan servicers, and claims administrators typically issue SOC 1s. Distribution is restricted to your organization, your auditors, and certain regulators.
SOC 2
A SOC 2 evaluates controls against the AICPA’s Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.3AICPA. 2017 Trust Services Criteria With Revised Points of Focus 2022 Security is always in scope; the other four depend on what the vendor does. If your vendor handles sensitive data but doesn’t directly process financial transactions, ask for a SOC 2. Cloud infrastructure providers, data centers, and SaaS platforms are typical issuers. SOC 2s are also restricted-use.
SOC 3
A SOC 3 is a condensed, general-use version of a SOC 2, useful as a marketing document but not as audit evidence. It will not satisfy your auditor.
Type I Versus Type II
Both SOC 1 and SOC 2 come in two flavors. Type I evaluates the design of controls at a single point in time: are they set up correctly? Type II tests whether those controls actually operated effectively over a period of at least six months. Type I tells you the locks are on the doors; Type II tells you the locks were used. Most auditors strongly prefer Type II, because only operating effectiveness gives real assurance about day-to-day activity.
When you request a report, confirm the exact legal entity you contracted with matches the entity named on the report, and read the system description to verify that the specific service you consume is within scope. A vendor with multiple products may have a SOC report covering only one of them.
Complementary User Entity Controls
This is the piece organizations miss most often. A SOC report does not claim the vendor’s controls work in isolation. Every SOC report lists Complementary User Entity Controls, or CUECs: controls the vendor assumes you have implemented on your side. The vendor’s controls were designed around that assumption.
Common CUECs include managing user access to the vendor’s systems, promptly disabling accounts for terminated employees, reviewing output reports for accuracy, and reconciling data sent to the vendor against data received back. If you’re not doing these things, the vendor’s report may still be clean, but your control environment has a hole your own auditor will find.
Treating CUECs seriously means assigning a specific person or role to each one, setting a frequency, and keeping documentation that proves the control was performed. A quarterly log showing the HR manager reviewed access permissions on the vendor’s platform is the kind of evidence auditors ask for. Map each CUEC in the vendor’s report to a corresponding internal control on your side, and carry that mapping forward year to year so you don’t rebuild it every audit cycle.
Subservice Organizations
Your vendor may outsource part of its own work to another company, a subservice organization. A payroll processor might rely on a separate cloud host; a benefits administrator might use a third-party analytics firm. How the vendor treats that subcontractor in its SOC report changes how much work lands on you.
Under the carve-out method, the subservice organization’s controls are excluded from the vendor’s report. The report mentions the subservice organization exists but doesn’t test its controls.4Public Company Accounting Oversight Board. AI 18 – Consideration of an Entitys Use of a Service Organization You have to separately obtain and evaluate the subservice organization’s own SOC report if its work is relevant to your financial statements.
Under the inclusive method, the subservice organization’s controls are incorporated into the vendor’s report and tested by the same auditor. You get one report covering the full chain. It’s easier on you, but vendors use it less often because it requires cooperation from the subservice organization.
Either way, the subservice organization must be disclosed. When you first read a SOC report, look in the system description for those disclosures and note which method was used. A carve-out means you have another report to chase.
Reading the Report You Receive
Getting the PDF is only half the work. You need a documented process for reviewing it, and your auditor will expect evidence that you followed one.
Start with the service auditor’s opinion at the front. An unqualified opinion means the controls were fairly described and, for Type II, operating effectively during the period. A qualified opinion means at least some controls failed or were poorly designed. An adverse opinion means the problems were pervasive. Anything other than unqualified, and you cannot simply rely on the vendor’s controls.
Even in a clean report, the tests of controls section may list individual exceptions where a control didn’t operate as described. Whether an exception matters depends on whether it touches a service you actually use and an assertion significant to your financial statements, and whether the testing itself provides appropriate evidence of control effectiveness.5Public Company Accounting Oversight Board. AS 2601 – Consideration of an Entitys Use of a Service Organization An exception in a service you don’t consume may be irrelevant; an exception in a control that directly affects your transaction processing needs an impact assessment.
If the report is qualified in a way that affects you, work out how the failure intersects with your own controls, decide whether you can implement a compensating control internally, and document the analysis in writing. Where the same issues recur year after year, the honest answer may be to evaluate alternative vendors.
Bridge letters matter when the report period doesn’t align with your fiscal year-end. A short letter from the vendor’s management confirming no material changes to the control environment between the report end date and your year-end fills the gap. Bridge letters typically cover no more than three months; a longer gap calls for a different report period or your own testing.
File the completed review with the SOC report and any bridge letter. Documentation should show who reviewed the report, what was concluded about exceptions or opinion qualifications, whether CUECs were confirmed as operating, and whether any remediation was started. That paper trail is the evidence that you managed third-party risk instead of collecting a PDF.
Getting the Right Terms Into the Contract
None of this works if the vendor doesn’t actually produce reports. Your contract should require an annual SOC examination and delivery of the report within a specified timeframe. The FDIC’s guidance on managing technology providers recommends defining performance requirements that include periodic security assessments and specifying that copies of independent assessment reports be provided at a predetermined frequency.6Federal Deposit Insurance Corporation. Tools to Manage Technology Providers Performance Risk – Service Level Agreements
For higher-risk relationships, negotiate a right-to-audit clause letting you assess the vendor directly if a SOC report is unavailable, insufficient, or qualified. This is especially valuable in the first year of a vendor relationship, before the vendor has completed a full Type II cycle. The contract should also spell out how the vendor will notify you of material changes to its control environment between report periods and whether you can request a bridge letter on demand.
If You’re a Public Company
Public companies carry an extra layer. Section 404 of the Sarbanes-Oxley Act requires management to assess and report annually on internal controls over financial reporting. Where a service organization’s activities are part of your information system, management must evaluate whether that vendor’s controls are designed and operating effectively, and a SOC 1 Type II is the usual source of that evidence.
Management also has to maintain and evaluate controls over the flow of information to and from the service organization, which folds in the CUEC work above. If significant time has passed between the report period and your assessment date, ask the vendor about changes: personnel turnover, processing errors, contract or service-level modifications, and shifts in the reports or data you receive. Where the SOC report alone is not sufficient, management may need to perform its own tests at the vendor or re-perform certain procedures internally.
Vendors Outside the United States
If your service provider is based abroad, you may receive an ISAE 3402 report rather than a SOC 1. ISAE 3402 is the international equivalent issued under standards set by the International Auditing and Assurance Standards Board, and it covers the same scope and reporting types. Most U.S. auditors treat it as functionally equivalent, but confirm acceptance with your own auditor before you rely on one, so the point doesn’t surface late in your audit.