What does user entities mean on the CPA exam?
Last reviewed
User entities. The customers of a service organization, whose own financial reporting or systems depend on the service organization's controls. They are the audience for a SOC report.
Defined against AU-C 402.08.
Worked example
A payroll processor runs payroll for about 400 companies and gives each of them its SOC 1 Type 2 report. The report says the processor's controls achieve their objectives only if each customer reviews its payroll register before every run is released and tells the processor about each terminated employee within one business day of the termination. Brightline Tools is one of those customers.
Where does Brightline sit in this arrangement, and what does it need to do for the report's conclusions to hold for its own payroll?
- The processor is the service organization; Brightline and the other 399 customers are the user entities whose financial reporting depends on its controls.
- The two steps the report assigns to customers are complementary user entity controls. The processor designed its system assuming each customer performs them.
- If Brightline skips the register review or reports terminations late, the processor's controls may not prevent errors in Brightline's payroll, whatever the report says about the processor.
Answer: Brightline is a user entity. It has to perform the two complementary controls itself, and its auditor will check that it did before leaning on the processor's report.
The trap: Reading a clean SOC 1 report as complete assurance for every customer. The report covers the processor's side; each user entity still owns the controls the report hands back to it.
Based on AU-C 402.08; AT-C 320.
Which CPA exam sections use user entities?
User entities appears in the ISC section of the CPA exam.
Other terms defined against AU-C 402
- service organization: A third party whose processing affects a user entity's financial reporting, such as a payroll bureau or a claims processor.
- user auditor: The auditor of an entity that uses a service organization.
Related terms
- complementary user entity controls: Controls a service organization assumes its customers are running.
- SOC 2 report: A report on a service organization's controls against the trust services criteria, covering security plus any of availability, processing integrity, confidentiality, and privacy that are selected.
- carve-out method: Excludes a subservice organization's control objectives and controls from both the description and the scope of the service auditor's report.
- inclusive method: Brings a subservice organization's controls inside the description and the scope of the service auditor's report, so one report covers both organizations.
- reporting entity: The unit whose statements are being presented, including everything it controls.