User Entity Responsibilities for Complementary User Entity Controls (CUECs)

Which of the following is a responsibility of user entity management over complementary user entity controls (CUECs)?

• A Implement CUEC(s) that address each control deemed necessary by the service organization for each relevant control objective.

• B Obtain an understanding of the CUEC(s) designed and implemented by the service organization.

• C Implement CUEC(s) exactly as specified by the service organization for each relevant control objective.

• D Confirm that the service auditor’s report provides an opinion on the operating effectiveness of the CUEC(s).

Answer: B

User entities are responsible for understanding the CUECs designed and implemented by the service organization. This includes understanding how the CUECs address the relevant control objectives and how they impact the user entity's overall control environment.