CPA (CPA Exam): Relying on a SOC 1 Report With a Carve-Out, a Gap, and a Failed CUEC

Not as-is. Three separate gaps must be closed before reliance is supported.

1. The period gap. The report covers through September 30; the audit period runs through December 31. The auditor needs a bridge letter from the processor or should perform alternative procedures for the three uncovered months - inquiry of the processor, inspection of control-testing evidence or management's monitoring reports, and tests of Ridgeway's own controls over the payroll interface and output review. A bridge letter alone is weaker evidence; corroborate it.

2. The carve-out. The data center's controls are not described or tested. Because hosting and backup bear on availability and completeness of payroll processing, the auditor must obtain evidence about the subservice organization: a separate SOC 1 report for the data center, a SOC 2 relevant to availability where it bears on the financial assertions, or perform procedures at the subservice organization. If none is available, the risk must be addressed with substantive procedures over payroll completeness and accuracy.

3. The complementary user entity controls. SOC 1 reliance is predicated on the user entity performing the CUECs the service auditor assumed. The controller's admission that she never reviews the exception report means the CUEC did not operate, so the related control cannot be relied upon and the auditor cannot treat the payroll control environment as effective. Also evaluate the service auditor's competence, independence, and reputation, and whether the description and tests of controls are sufficient for the assertions the auditor intends to support.

Assess it on two dimensions: precision of the control and the risk it addresses.

Deviation rate. 14 / 250 = 5.6%. Against a tolerable deviation rate typical for a key control (often 5%), this exceeds tolerance. Even at a higher tolerance, a 5.6% rate is not an isolated anomaly, and the exceptions are clustered in a defined two-week period - a systemic cause (the approver was on leave) rather than random error.

What the control actually protects. The missing element is independent approval before promotion to production. Two mitigating facts matter:

• Developers could not deploy their own code, so segregation of duties between development and production was preserved. The risk of unauthorized or self-approved changes reaching production is therefore reduced, though not eliminated.
• The population is change tickets, not payroll transactions. The auditor must link the deficiency to the payroll assertions: did any of the 14 changes touch pay-rate tables, tax calculations, deduction logic, or the exception report itself?

Procedures.

1. Inspect the 14 changes and determine what they modified and whether they were subsequently reviewed.
2. Test compensating controls - user acceptance testing, post-implementation review, reconciliation of payroll output to prior periods.
3. If the control cannot be relied upon, remove it from the reliance strategy and expand substantive testing of payroll calculations, rates, and withholdings.
4. Consider whether the deficiency is a significant deficiency in the service organization's controls relevant to user entities and whether it must be communicated to those charged with governance at Ridgeway. A service organization control exception is not automatically a Ridgeway ICFR deficiency, but it elevates assessed risk and may require disclosure in the auditor's communications.

The control is not operating, so reliance on it is foreclosed. The auditor cannot assume a CUEC was performed; a CUEC that is described but not executed is a control deficiency at the user entity, not at the service organization.

Options, in order of preference:

1. Perform the CUEC as an auditor procedure for a period. Review the monthly exception reports for the periods not covered by Ridgeway's staff and test a sample of pay-rate changes to HR authorization. This gives evidence about the operation of the underlying processing control but does not cure the deficiency in Ridgeway's monitoring control; it only supports the auditor's substantive conclusion.
2. Substantive approach. Treat payroll processing risk as high and test directly: recompute gross pay for a sample of employees, agree rates and deductions to authorized HR records and benefit elections, agree headcount to HR files and to the quarterly 941s, recalculate employer taxes, and reconcile total payroll expense to the general ledger and to the benefits invoices.
3. Consider whether the assets/liabilities are still supportable on other evidence. If substantive procedures are sufficient, no opinion modification is needed.

Reporting consequences:

• Communicate the deficiency in writing to management and those charged with governance as part of the internal control communication; the absence of monitoring over payroll exception reports is at least a deficiency and could be a significant deficiency if payroll is material and the volume of exceptions is high.
• Document the revised risk assessment, the change in the planned audit approach, and the conclusion on whether the deficiency, alone or combined with others, constitutes a material weakness.
• Do not issue an unmodified internal control opinion assuming the control operated; if the engagement includes an integrated audit, the control must be assessed on the evidence actually obtained.