CUEC in ISAE 3402: your client’s complementary controls
CUEC stands for complementary user entity controls: controls that you as a service provider assume your client carries out itself. Your controls only work if the client also does its part. Under NOREA Richtlijn 3402 (NOREA guideline 3402) and the international standard, these are controls the service provider assumes the client performs when designing the service. If they are needed to achieve a control objective, you name them in the description. Where you describe them in the report is set out in the system description. You can read how they fit into the engagement in the step-by-step plan.
A CUEC that is not in the report is invisible to the client. They then assume your service covers the full risk, while part of the responsibility lies with them.
Why CUEC exist
Take a payroll processor. The processor calculates the salaries, but the client supplies the data: who is employed, which hours were worked and which changes apply. If the client supplies incorrect data, the processor’s calculation is correct but the result is not. A control at the processor that only tests the calculation does not cover that. The client must check what it supplies.
That control belongs in the report. This way, the client’s accountant knows which control lies with the client, and can include it in their own audit.
Example: CUEC at a payroll processor
| Control at the service provider | CUEC at the client | What the client provides |
|---|---|---|
| Changes are processed as supplied | The client checks the change list before submitting it | A signed change list for each payroll run |
| Only authorised users have access to the client portal | The client manages its own portal users and removes leavers | A quarterly overview of portal users |
| Changes to contracts are processed correctly | The client reports contract changes on time and in full | An email or form with the change and date |
Look at the middle column. Each CUEC is a concrete action the client can carry out and prove. “The client is responsible for the accuracy of the data” is not a CUEC, because nobody knows what the client must do to meet it.
How to describe a CUEC in the report
Use four elements for each CUEC. This makes the list useful for both the client and the auditor.
- The action. What must the client do? One sentence, in the active voice.
- The reason. Which of your controls needs this action?
- The frequency. How often must the client do it?
- The evidence. What must the client keep to show that it has done it?
In practice, a four-column list in the system description is the most workable format. The auditor does not test the CUEC. The report states that they have not assessed them, and that the control objectives are only achieved if the client performs them properly. That is why you must describe them clearly.
Common mistakes
- A CUEC hidden in a footnote. An important agreement in small print is missed by readers.
- A CUEC not linked to the right control. Without the link, the reader does not know why the client must act.
- Vague actions. “The client ensures a secure environment” says nothing. Write what they actually do.
- No conversation with the client. If the client does not know it has a CUEC, it will not carry it out. Go through the list with your clients before the report is final.
- CUEC that change after the period. If you change your process during the year, the CUEC list must change with it.
Example of CUEC text in the description
This is what a CUEC block in the system description can look like. The text is fictional and concerns a payroll processor. Note the fixed structure: action, reason, frequency and evidence.
CUEC 1: Client checks the change list before submission
Action: the client checks the change list for completeness and
accuracy before submitting it via the client portal.
Reason: changes are processed as supplied; the processor only
checks format and authorisation.
Frequency: per payroll period.
Evidence: signed change list, kept by the client.
CUEC 2: Management of portal users
Action: the client keeps track of who may log in to the portal and
removes leavers within the agreed period.
Reason: only authorised users may give instructions.
Frequency: quarterly and with every change in personnel.
Evidence: quarterly overview of portal users.A block like this is directly usable for the client and their accountant. They see which action lies with them, and can include it in their own control.
How to go through the CUEC list with your client
A CUEC list that appears only in the report is rarely carried out. So go through the list with each client before the report is final:
- Send the list before the draft. A client who sees the list only after the report cannot respond to it any more.
- Ask whether the action fits in practice. A control the client cannot perform must be redesigned or made more robust.
- Record the agreement. An email or form with the date on which the client received the list is the evidence you need yourself.
- Repeat it every year. Changed clients, changed systems or new staff change the CUEC with them.
Frequently asked questions about CUEC
Is a CUEC a weakness in my service?
No. It is a shared responsibility. What matters is that you make the boundary clear. Many services have CUEC, because the service depends on data or instructions from the client.
Must the auditor test the CUEC?
No. The CUEC are actions of the client, and the report cannot prove that the client performs them. The auditor states in the report that they have not assessed them. The description must still make clear which CUEC apply, so the client’s accountant can check them.
My client has its own accountant. What should that accountant do with the CUEC?
They use the list to align their own audit. They can check whether the client has carried out its CUEC, and in this way close the gap in the service provider’s report.
Where does my responsibility end and the client’s begin?
This is set out in the scope and the description. Make it as concrete as possible: what you do, what the client does, and where the boundary lies. An unclear boundary is the source of most discussions after an audit.
More information
CUEC are linked to subservice organisations: with suppliers too, part of the responsibility often does not lie with you. Also read the audit checklist, where the CUEC list comes back as a checkpoint, and the report requirements for where the list fits in the overall report.