Complementary user entity controls (CUECs) are the controls a service organization designs its service around on the assumption that its clients will run them, and that its controls report lists as necessary to achieve its control objectives. For a fund using an administrator, typical examples are approving the administrator's price challenges and overrides, sending trade, hedging and capital instructions through authorised signatories, reviewing the daily NAV and cash reconciliation exceptions the administrator flags, approving distribution and fee calculations before they are paid, and keeping the list of people allowed to instruct the administrator up to date. They are the half of a SOC 1 or ISAE 3402 report that is the fund's to run, and the auditor who issued the report did not test them. Botminds' Fund Administration Oversight maps every complementary control in every administrator's report to an owner at the fund and the quarter's evidence, so the fund COO and the CCO can sign an attestation that is true.
One sample quarter: how many controls the administrators' reports left with the manager
61
complementary controls listed across six administrators' SOC 1 and ISAE 3402 reports
57
evidenced by an owner at the manager that quarter
4
gaps, each disclosed with an owner and a date
2
signatures on the attestation: the fund COO and the CCO
What are complementary user entity controls?
They are controls the administrator relies on but does not perform. The international standard defines them as "controls that the service organization assumes, in the design of its service, will be implemented by user entities, and which, if necessary to achieve control objectives stated in the service organization's description of its system, are identified in that description" (ISAE 3402, paragraph 9(b)). The US SOC 1 report uses the same idea and the same name. In a fund's case the user entity is the fund, and in practice the controls are run by the manager's people on the fund's behalf.
The word that matters is necessary. A complementary control is not a courtesy suggestion at the back of the report; it is a condition on the report's conclusions. When the description refers to them, the auditor's report must say so in plain terms.
The control objectives stated in the service organization's description of its system can be achieved only if complementary user entity controls are suitably designed or operating effectively, along with the controls at the service organization.
ISAE 3402, paragraph 53(c)(iii)
The same paragraph requires the report to state that the service auditor "has not evaluated the suitability of design or operating effectiveness of complementary user entity controls." So a clean opinion has a hole of known shape in it. Where the fund's half did not run, the administrator's half may have operated perfectly and the objective still failed. How to review a SOC 1 report covers the administrator's half; this page is about the fund's.
Complementary user entity controls examples for a fund administrator
Most complementary controls in an administrator's report fall into five families: instructions the administrator acts on, prices and valuations the fund must approve, exceptions the administrator escalates for a decision, calculations the fund must approve before money moves, and access, meaning who may instruct or see what. The checklist below gives one or more examples in each, the kind of wording to look for in a fund administrator's report, and what each protects against.
Complementary user entity controls examples for funds, grouped by what they protect
- Authorised instructions only
The fund sends trade, cash, hedging and capital instructions through authorised signatories, in the agreed form. Without it, the administrator's checks on instructions verify the wrong thing.
- Authorised signatory lists kept current
The fund tells the administrator promptly when people join, leave or change limits. A stale list is how an instruction from a departed employee gets processed.
- Approval of price overrides and stale-price challenges
The administrator flags a price that has not moved or that it doubts; the fund decides and records the decision. If nobody decides, the stale price stays in the NAV.
- Review of the daily NAV and movements outside tolerance
The fund reviews the NAV and investigates moves the administrator reports as unusual before release or within an agreed window.
- Review of reconciliation exceptions
Cash and position breaks the administrator cannot resolve without the fund are reviewed and closed by the fund's team.
- Approval of distributions, fees and waterfalls
Distribution calculations, fee rate changes and private fund waterfalls are approved by the fund before payment or before they take effect.
- Review of investor onboarding referrals
Where the administrator refers investor eligibility or anti-money-laundering decisions to the fund, someone at the fund decides each one, on the record.
- Review of reports before they go out
Monthly financial reports, investor statements and creation basket files are reviewed by the fund before the administrator publishes or sends them.
Read the list against the definition and a pattern appears. Nearly every complementary control is a decision the administrator cannot take for the fund: what an illiquid bond is worth, whether a distribution is right, whether an investor may come in. The administrator's controls make sure the question is raised. The fund's control makes sure it is answered.
What happens if you do not perform a CUEC?
The administrator's control objective may fail for your funds even though its report is clean, and the failure is yours, not the administrator's. The objective in the description was achievable "only if" both halves ran. A stale price the administrator flagged correctly and the fund never reviewed is a stale price in the NAV, and the administrator's grade should not be marked down for it.
It also shows up in the fund's own audit and compliance program. The fund's auditor, if it relies on the administrator's type 2 report, must determine "whether complementary user entity controls identified by the service organization are relevant to the user entity and, if so," understand whether the fund designed and implemented them and test their operating effectiveness (ISA 402, paragraph 17(b)). Among the matters the standard says an auditor may raise with management and those charged with governance are "instances where complementary user entity controls are noted in the type 1 or type 2 report and are not implemented at the user entity" (paragraph A39). For a registered fund, a control the fund's policies depend on and nobody runs is also a weakness in the fund's own procedures under Rule 38a-1, which the CCO's annual report to the board has to address (17 CFR 270.38a-1).
The sample firm in Fund Administration Oversight shows how quickly the line blurs. Its administrator Pellmont had seven NAV restrikes in the third quarter, four from bond prices left unchanged. Pellmont's report has a complementary control, on page 140, under which the fund reviews and approves stale-price challenges the administrator raises. For August, nine challenges were raised and the fund's approvals were not retained. Asked whether part of the weakness was the fund's own, the solution's agents answered that it was, partly, and placed that gap on the fund's attestation rather than in Pellmont's grade.
How to map complementary user entity controls to owners and evidence
Mapping complementary controls means turning a list in the back of each report into named duties at the fund, each with evidence on a schedule. It has to be done per report, because each administrator's description lists its own, and again each year, because descriptions change. A mapping that was done once at onboarding and filed is not a mapping.
Complementary user entity controls mapping, from the report to a signed attestation
Agent
Controls agentExtracts every complementary control from each SOC 1 or ISAE 3402 report, with its page and the control objective it supports.
Never: Never marks a control as run without evidence
A person decides
Oversight analystAssigns each control to an owner in the right team: valuation, treasury, fund accounting, investor services, compliance.
Never: Does not leave a control without an owner
A person decides
Control ownerAttaches the quarter's evidence: a signed checklist, an approval, a review log, committee minutes.
Never: An email that says "approved" is not a retained approval
Agent
Controls agentChecks the evidence covers the period and the volume, such as every challenge raised in the month, and lists the gaps.
Never: Never accepts evidence dated outside the period
A person decides
Fund COO and CCOCo-sign the quarter's attestation, with each gap disclosed with an owner and a date.
Never: Neither signs alone
Four complementary control gaps in one sample quarter, and what would have closed each
| Administrator · control | What the fund must do | What was found | Evidence that would close it |
|---|---|---|---|
| Pellmont · CUEC-04 | Review and approve price overrides and stale-price challenges the administrator raises | August: 9 challenges raised, approvals not retained | A dated approval for each challenge, by a named member of the valuation committee |
| Corbière · CUEC-02 | Send share-class hedging instructions to the administrator | Instructions for 3 new hedged share classes sent by email; no signed instruction on file | Signed instructions from an authorised signatory, in the agreed channel |
| Vellacourt · CUEC-02 | Review investor onboarding decisions the administrator refers | No evidence of review for 4 referrals in the quarter | A decision and reason for each referral, by the named reviewer |
| Vellacourt · CUEC-03 | Approve distribution waterfalls | Waterfall for one secondaries fund approved by email only | An approval record against the final calculation, before payment |
What are user entity controls, and how do they differ from complementary ones?
User entity controls are all of the fund's own controls over its financial reporting; complementary user entity controls are the subset the administrator's service was designed to depend on. The difference is who wrote them down. The fund's valuation policy, its NAV error policy and its board reporting are user entity controls whether or not any administrator mentions them. A complementary control is one the administrator's description names, because without it the administrator's own controls cannot do their job.
The auditing standard's own example is the plainest. A service "may be designed with the assumption that the user entity will have controls in place for authorizing transactions before they are sent to the service organization for processing", in which case the description may include those controls (ISA 402, paragraph A36). For a fund, the authorised-instruction control is the first one to check, because nearly every other control the administrator runs assumes the instruction it received was genuine.
What is a subservice organization carve-out?
A carve-out is the report's way of leaving out a provider the administrator itself relies on. Under the carve-out method, the description "includes the nature of the services provided by a subservice organization, but that subservice organization's relevant control objectives and related controls are excluded" from the description and from the auditor's work, while the administrator's own controls "to monitor the effectiveness of controls at the subservice organization" stay in, and those "may include the service organization's review of an assurance report on controls at the subservice organization" (ISAE 3402, paragraph 9(a)). The alternative, the inclusive method, brings the subservice organization's controls into the auditor's scope.
In the sample administrator's report in Fund Administration Oversight, three providers are carved out: a pricing data provider, a cloud hosting provider and a print and mail vendor. A carved-out pricing feed is the one to follow up: the administrator's report tells you it monitors the feed, not that the feed's controls worked. Ask which report covers the pricing provider, who at the administrator reads it, and what they concluded.
The carve-out does not create a new fund duty by itself, but it widens the area where the fund's own evidence is the only evidence. If a stale or wrong price arrives from a carved-out provider, the administrator's complementary control, a price challenge, and the fund's response to it, become the controls that matter. When a fund is choosing an administrator, these are among the first things to ask about; the 90-day plan for outsourcing fund accounting puts the mapping before the first NAV.
What is a SOC 1 bridge letter? An example of what one should say
A bridge letter, also called a gap letter, is a short letter from the administrator's management covering the months between the end of its last SOC 1 period and a date the client needs, usually the client's year-end. It is the administrator's statement, not the auditor's, and it is only worth what it specifically says. The sample administrator's bridge letter arrived on October 8 and covered July 1 to September 30, 2026, reporting no changes.
A SOC 1 bridge letter example: the five statements to look for
| Statement | Example wording a fund should expect | Why it matters |
|---|---|---|
| The report it bridges | Our SOC 1 type 2 report for July 1, 2025 to June 30, 2026, issued August 21, 2026 | Ties the letter to one report, one entity and one set of services |
| The bridge period | This letter covers July 1, 2026 to September 30, 2026 | Must reach the date the fund relies on, such as its year-end |
| Changes to the system and controls | There have been no significant changes to the controls described, or the following changes … | A new system, location or subservice provider can change what the report described |
| Known failures | We are not aware of controls that did not operate as described, other than … | A failure after the period is exactly what the fund needs to hear |
| Subservice organizations and complementary controls | No change to carved-out providers or to the complementary controls listed | A new carve-out or a new fund duty must be mapped before it bites |
How Fund Administration Oversight keeps the fund's half evidenced
The solution treats complementary controls as part of each quarter's oversight, not a once-a-year exercise. The Controls agent extracts them from every report and bridge letter, the analyst assigns owners, the owners attach evidence, and the agent checks that the evidence covers the whole period and volume. The fund COO and the CCO each sign the attestation, and gaps are listed first with an owner and a date.
Every complementary control from six reports, with its owner and this quarter's evidence
The separation matters for what happens next. The administrator's exceptions go into its report card and remediation letter. The fund's gaps go into its own attestation and, where material, into the CCO's report. Neither side's failure is allowed to hide inside the other's.
The COO's attestation is one of the decisions waiting for her that morning
Questions people ask
Do ISAE 3402 reports list complementary user entity controls as well as SOC 1 reports?
Yes. ISAE 3402 defines them in paragraph 9(b) and requires the service auditor to check that any the description relies on are adequately described. A European administrator's ISAE 3402 report and a US administrator's SOC 1 report should both be mapped the same way.
Does the service auditor test complementary user entity controls?
No. ISAE 3402 requires the report to state that the service auditor has not evaluated their design or operating effectiveness. If anyone tests them, it is the fund's own auditor, under ISA 402, when it relies on the administrator's report.
How many complementary user entity controls does a fund administrator's report usually list?
No regulator or independent study publishes a typical number; it depends on the services and how the description is written. In the sample firm in Fund Administration Oversight, six administrators' reports listed 61 between them. Count yours per report, because each administrator's list is its own.
Who should own complementary user entity controls at a fund manager?
The team that takes the decision the control describes: valuation for price challenges, treasury for cash and hedging instructions, fund accounting for NAV and reconciliation reviews, investor services for onboarding referrals, compliance for signatory lists. The COO or CCO owns the mapping itself and signs that it is complete.
Should complementary controls be in the administration agreement?
The fund's duties to the administrator usually are, in the form of instruction, approval and notification obligations. Compare the agreement with the report's list each year: a complementary control the agreement does not mention is a duty nobody negotiated, and one the agreement mentions but the report omits may mean the description is out of date.