SOC 1 (SSAE 18 / ISAE 3402) B.8: SOC 1 B.8 Identify the complementary user entity controls assumed in the design of the service organisation's controls

Where achieving a control objective depends on controls that user entities themselves must implement (for instance, that user entities authorise their own users or review the reports they receive), the description identifies those complementary user entity controls, the assertion and the report say that the objectives can be achieved only if user entities apply them, and the auditor states that it has not evaluated them.