Exam CISA topic 1 question 662 discussion

Reviewing complementary user entity controls involves assessing the controls implemented by the organization that complement the controls provided by the third party. This approach allows the auditor to evaluate the overall effectiveness of the control environment by considering how both parties contribute to achieving control objectives.

Answer B

D: Complementary user entity controls (CUECs) are essentially controls provided by a third-party service provider to help achieve the vendor’s control objectives. CUECs can be thought of as a laundry list of controls and activities that customers or clients of a service provider must have in place to receive services. Complementary user entity controls (CUECs) are controls that exist on a user-entity level in a vendor company. CUECs ensure that an agreement to agreed-upon requirements binds clients’ or customers’ access to specific services.

On-site evaluation is the best way to evaluate a control environment .