Study guide
17.4 Service Organization Exceptions and User Controls
Uniform CPA Examination Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CPA Exam Structure and Licensure Rules
1.1 CPA Evolution Model 1.2 Eligibility, Credit Window, and Scheduling Rules 1.3 Scoring, Pass Rates, and Blueprints
2 Chapter 2: CPA Scoring, Interface, and Exam Strategy
Score Scale and Testlets MCQ/TBS Weighting by Section Sample Test Interface Tools Exam-Day Time Management
3 Chapter 3: AUD Ethics, Independence, and Engagement Acceptance
3.1 Professional Responsibilities and Independence 3.2 Engagement Acceptance and Continuance 3.3 Audit Documentation and Quality Management 3.4 Audit Risk Foundations
4 Chapter 4: AUD Risk Assessment, Controls, and Evidence
4.1 Assertions and Risk Assessment 4.2 Internal Control Design and Operating Effectiveness 4.3 Substantive Procedures and Audit Evidence 4.4 Sampling, Analytics, and Estimates
5 Chapter 21: AUD Sampling, Analytics, and Accounting Estimates
21.1 Audit Sampling Risk and Sample Design 21.2 Substantive Analytical Procedures 21.3 Estimates, Fair Value, and Specialists 21.4 Data Analytics, Exceptions, and Follow-Up
6 Chapter 22: AUD Integrated Audits, IT Controls, and SOC Reliance
22.1 ICFR Integrated Audit Framework 22.2 IT General Controls and Application Controls 22.3 Service Organizations, SOC Reports, and CUECs 22.4 Control Deficiencies and Material Weaknesses
7 Chapter 5: AUD Reporting, Attestation, and Review Engagements
5.1 Audit Opinions and Modifications 5.2 Emphasis, Other Matter, and Going Concern 5.3 Review, Compilation, and Preparation Engagements 5.4 Attestation and Government Auditing Signals
8 Chapter 36: AUD Workbook - From Risk to Report
36.1 Risk-Assertion-Procedure Drill 36.2 Evidence Reliability Drill 36.3 Control Deficiency Classification Drill 36.4 Report Modification Decision Drill
9 Chapter 6: FAR Financial Statements and Reporting Framework
6.1 Conceptual Framework and Standard Setting 6.2 Financial Statement Presentation 6.3 Cash Flow Statement and Disclosures 6.4 Not-for-Profit Reporting Basics
10 Chapter 7: FAR Balance Sheet Accounts and Rollforwards
7.1 Cash, Receivables, and Reconciliations 7.2 Inventory and Cost Flow Errors 7.3 Property, Equipment, and Intangibles 7.4 Debt, Equity, and Contingencies
11 Chapter 8: FAR Selected Transactions and Measurement Models
8.1 Revenue Recognition: Five-Step Model 8.2 Leases, Income Taxes, and Impairment 8.3 Business Combinations and Consolidations 8.4 Accounting Changes, Errors, and Subsequent Events
12 Chapter 32: FAR Revenue, Leases, and Income Taxes Deep Dive
32.1 Revenue Contract Modifications and Variable Consideration 32.2 Lease Classification and Lessee Accounting 32.3 Deferred Tax Assets, Liabilities, and Valuation Allowances 32.4 Simulation Workflows for Revenue, Lease, and Tax Exhibits
13 Chapter 31: FAR Financial Instruments, Fair Value, and Derivatives
31.1 Financial Asset Classification and Measurement 31.2 Fair Value Hierarchy and Disclosures 31.3 Derivatives, Hedge Accounting, and Embedded Features 31.4 Foreign Currency and Comprehensive Income Signals
14 Chapter 24: FAR Consolidations, Equity Method, and Intercompany Workpapers
24.1 Consolidation Decision and Noncontrolling Interest 24.2 Acquisition-Date Measurement and Goodwill 24.3 Equity Method Income, Dividends, and Impairment 24.4 Intercompany Inventory, Debt, and Fixed Asset Eliminations
15 Chapter 9: FAR Governmental Accounting and Fund Reporting
9.1 Governmental Fund Types and Basis 9.2 Government-Wide Statements and Reconciliations 9.3 Budgetary Accounting and Encumbrances 9.4 Governmental and NFP Comparison Traps
16 Chapter 23: FAR Not-for-Profit and Special Reporting Topics
23.1 Not-for-Profit Net Assets and Restrictions 23.2 Contributions, Conditional Gifts, and Agency Transactions 23.3 Functional Expenses and Statement Presentation 23.4 Interim, Segment, and EPS Reporting Traps
17 Chapter 37: FAR Workbook - Journal Entries, Rollforwards, and Reconciliations
Adjusting Entry Workflow Account Rollforward Workflow Reconciliation and Error Correction Drill Statement Presentation Workpaper Drill
18 Chapter 10: REG Tax Procedure, Ethics, and Business Law
10.1 Tax Practice Ethics and Preparer Responsibilities 10.2 IRS Procedure, Statutes, and Penalties 10.3 Contracts, Agency, and Business Entities 10.4 Secured Transactions, Bankruptcy, and Priority
19 Chapter 11: REG Individual Federal Tax Workflows
11.1 Gross Income, Exclusions, and Adjustments 11.2 Filing Status, Dependents, and Deductions 11.3 Credits, Payments, and AMT Concepts 11.4 Retirement, Passive Activity, and Loss Limitations
20 Chapter 12: REG Property Transactions and Entity Taxation
12.1 Basis, Realized Gain, Recognized Gain, and Character 12.2 C Corporations and Shareholder Transactions 12.3 S Corporations, Partnerships, and Basis 12.4 Entity Tax Simulations and K-1 Workflows
21 Chapter 25: REG Entity Choice, Basis, and Owner Tax Consequences
25.1 C Corporation, S Corporation, and Partnership Comparison 25.2 Formation Contributions and Built-In Gain 25.3 Distributions, Redemptions, and Liquidations 25.4 Loss Limits: Basis, At-Risk, and Passive Rules
22 Chapter 26: REG Property Tax, Character, and Deferral Transactions
26.1 Capital, Ordinary, and Section 1231 Character 26.2 Depreciation Recapture and Unrecaptured Gain 26.3 Like-Kind Exchanges, Involuntary Conversions, and Installment Sales 26.4 Related-Party, Wash-Sale, and Imputed-Interest Traps
23 Chapter 33: REG Trusts, Estates, Gifts, and Exempt Organizations
33.1 Trust and Estate Income Tax Basics 33.2 Gift, Estate, and Beneficiary Planning Concepts 33.3 Tax-Exempt Organizations and Unrelated Business Income 33.4 Fiduciary K-1 and Distribution Simulation Workflows
24 Chapter 38: REG Workbook - Tax Return Schedules and Basis Workpapers
38.1 Individual Return Classification Drill 38.2 Property Basis and Character Workpaper 38.3 Pass-through K-1 and Owner Basis Workpaper 38.4 Business Law Issue Spotting Drill
25 Chapter 13: BAR Business Analysis, Economics, and Forecasting
13.1 Financial Statement Analysis and Ratios 13.2 Variance, Forecasting, and Budgeting 13.3 Cost Accounting and Performance Management 13.4 Economics, Finance, and Decision Models
26 Chapter 14: BAR Technical Accounting and Advanced Reporting
14.1 Revenue, Leases, and Complex Arrangements 14.2 Derivatives, Hedges, and Fair Value 14.3 Business Combinations and Consolidations 14.4 SEC Reporting and Public Company Context
27 Chapter 15: BAR State and Local Government Analysis
15.1 Governmental Fund Analysis 15.2 Government-Wide Conversion Workflows 15.3 Budgetary Reconciliation and CAFR/ACFR Reading 15.4 Government Simulation Strategy
28 Chapter 16: ISC Information Systems and Data Management
16.1 Systems Architecture and Data Flow 16.2 ERP, Accounting Systems, and Change Management 16.3 Data Governance, SQL, and Analytics 16.4 Availability, Backup, and Recovery Controls
29 Chapter 17: ISC Security, Privacy, and SOC Engagements
17.1 Security Threats and Control Selection 17.2 Privacy, Confidentiality, and Compliance Frameworks 17.3 SOC 1, SOC 2, SOC 3, and Cybersecurity Reports 17.4 Service Organization Exceptions and User Controls
30 Chapter 18: TCP Individual Tax Planning and Personal Financial Issues
18.1 Nonroutine Individual Income and Estimated Tax 18.2 Passive, At-Risk, and Investment Planning 18.3 Retirement, Education, and Insurance Planning 18.4 Gift, Estate, and Beneficiary Concepts
31 Chapter 19: TCP Entity Compliance and Planning
19.1 C Corporation Tax Planning 19.2 S Corporation Basis and Distributions 19.3 Partnership Tax Planning and Allocations 19.4 Trusts, Tax-Exempt, and International Signals
32 Chapter 34: TCP International and Advanced Entity Tax Topics
34.1 International Tax Signals and Source of Income 34.2 CFC, Foreign Tax Credit, and Permanent Establishment Concepts 34.3 Consolidated Returns and Affiliated Corporations 34.4 Advanced Partnership and S Corp Planning Scenarios
33 Chapter 35: Choosing and Preparing for BAR, ISC, or TCP
35.1 Discipline Fit Matrix by Background 35.2 BAR, ISC, and TCP Blueprint and Skill Comparison 35.3 Discipline Study Plans and Practice Balance 35.4 Switching Disciplines, Retake, and Score Interpretation
34 Chapter 39: CPA TBS Research, Authoritative Literature, and Document Review
39.1 Document Review Simulation Method 39.2 Research and Authoritative Literature Workflow 39.3 Exhibit Overload and Relevant Data Selection 39.4 Written Explanation and Professional Judgment Drills
35 Chapter 20: CPA Simulations, Retakes, and Final Review
20.1 TBS Exhibit Triage and Workpaper Method 20.2 Section-Specific Final Review Plans 20.3 Score Release, Retake, and Credit Window Decisions 20.4 Four-Section Study Roadmaps
36 Chapter 40: Discipline Workbook Drills for BAR, ISC, and TCP
40.1 BAR Ratio, Variance, and Government Drill 40.2 ISC Control Evidence and SOC Drill 40.3 TCP Basis Planning and Entity Drill 40.4 Discipline Final Mock and Review Log
17.4 Service Organization Exceptions and User Controls
Key Takeaways Explain This Topic AI
Complementary user entity controls (CUECs) are controls the service organization assumes user entities will implement for its controls to meet objectives or commitments.
Complementary subservice organization controls (CSOCs) arise when a vendor is a subservice organization whose controls are needed for the service organization's commitments or objectives.
The inclusive method includes a subservice organization's relevant controls in the SOC report; the carve-out method excludes them and only describes the services.
Exceptions are evaluated by nature, cause, frequency, population, severity, and effect on the control objective or Trust Services Criteria point.
A report reader should not treat management responses, compensating controls, or user controls as automatic fixes for exceptions.
Last updated: June 2026
User and Subservice Controls
SOC reports rarely describe a system that operates alone. A service organization may rely on customers to perform certain controls, and on vendors to deliver parts of the system. The ISC Blueprint specifically includes complementary user entity controls, complementary subservice organization controls, the inclusive and carve-out methods, and the reporting effect of exceptions.
Complementary user entity controls (CUECs) are controls the service organization assumes user entities will implement. They matter because the service organization's controls achieve the objective only if the user does its part. A payroll processor may authenticate files and process them accurately, but the user entity must authorize employees, review payroll registers, and restrict who can submit changes. If the user fails to perform its CUEC, the objective is not met even if the processor's controls work perfectly.
Complementary subservice organization controls (CSOCs) are controls expected at a subservice organization. A vendor becomes a subservice organization when its services are relevant to the service organization's system and to the control objective or service commitments. A cloud-infrastructure provider, data-center operator, payment gateway, or managed-security provider can be a subservice organization when its controls are necessary to the system being reported on.
Inclusive Versus Carve-Out
Method Treatment of the subservice organization Reader implication
Inclusive Includes the subservice organization's relevant controls and testing in the report Coverage extends to those controls; independence and evidence must reach the subservice organization
Carve-out Excludes those controls but describes the services performed Reader may need a separate SOC report or other evidence for the carved-out vendor
Neither method is automatically better. Inclusive reports give more complete coverage but require access, coordination, and independence over the subservice organization. Carve-out reports are far more common, but the user must judge whether the excluded services leave a gap in evidence.
Reading Exceptions
An exception is a deviation identified in testing. It does not automatically modify the opinion, but it must be evaluated against the control, test procedure, population, sample size, number of exceptions, period affected, cause, and management response. One missing approval in a low-risk sample of 60 has a very different effect from three failures of privileged-access review out of a sample of 5. Key questions:
Is the exception a matter of design or of operating effectiveness?
Does it affect a control objective, service commitment, system requirement, or Trust Services Criteria point?
Is it isolated or systemic?
Are compensating controls present, tested, and precise enough to address the risk?
Must CUECs or CSOCs also operate before the user's residual risk is reduced?
Reporting Effects
A service auditor's opinion may be unmodified (clean) or modified . A control that was not suitably designed or did not operate effectively for one or more objectives or criteria can lead to a qualified opinion; pervasive failures can push toward an adverse opinion, and a scope restriction can produce a disclaimer . Management's response is useful context but is not the auditor's opinion, and it does not erase the exception.
CPA Use of the Report
A user auditor or vendor-risk reviewer maps report content to the user entity's own risk. For SOC 1 , determine whether the control objectives relate to assertions in the financial-statement audit and whether the CUECs are actually implemented at the user entity; an unimplemented CUEC is a gap the user auditor must address with its own procedures. For SOC 2 , check whether the selected Trust Services Criteria match the vendor risk, whether the report period covers the reliance period, and whether the noted exceptions touch the service commitments that matter to the user.
The disciplined exam answer always connects the exception to reliance, not to boilerplate language.
Worked Scenario: Evaluating an Exception
A SOC 2 Type 2 report for an identity-management vendor notes that, of a sample of 25 terminated employees, access was revoked timely for 23 but two accounts remained active for 11 and 14 days after termination. The control is logical-access removal, tied to the Common Criteria for access. Walk the evaluation: the deviation is operating effectiveness (the control was designed correctly but not performed for two items); it affects a security commitment; with two of 25 it may be more than isolated; and you would ask whether a compensating control, such as session monitoring or periodic access recertification, caught the orphaned accounts.
The user entity must then decide whether the gap affects its reliance, perhaps by performing its own access review of vendor-managed accounts. The exam reward is connecting the exception to the user's residual risk , not simply noting that an exception exists.
Period and Reliance Mismatches
A frequent trap is a SOC 2 report whose coverage period ends months before the user's reliance period. A report covering January through June does not provide operating-effectiveness evidence for the following December. The user auditor must obtain a bridge letter (also called a gap letter) from management for the interim period or perform additional procedures. A bridge letter is management's representation, not the service auditor's opinion, so it carries less assurance and does not extend the auditor's testing.
Quick Reference: Who Performs the Control
- Term Who performs it Why it matters to the reader
- CUEC The user entity (customer) Objective is not met unless the customer implements it
- CSOC A subservice organization (vendor) Needed for the service organization's commitments
- Carve-out vendor Not tested in the report Reader needs separate evidence for those controls
- Inclusive vendor Tested within the report Coverage and independence extend to the vendor