What is Complementary user entity controls?
In short
Complementary user entity controls are controls that a service organization assumes its customers have in place, and that are needed, together with the service organization's own controls, to achieve the control objectives in its report.
Key takeaways
- They are listed in the service organization's system description.
- Auditors of the customers test whether they operate at their client.
- An example is a customer reviewing the payroll reports a payroll processor sends back.
Where it's tested
AUD: Attestation & System and Organization Controls (SOC) Engagements — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A user auditor wants to rely on controls at a service organization for the entire audit period. Which report provides appropriate evidence?