SOC 1 Companion Report
SOC 1 (AT-C 320) Type I or Type II: a separate report for your customers’ financial-statement auditors, with its own control objectives and assertion. We coordinate timing and reuse overlapping IT general control evidence with your SOC 2.
- Criteria
- Your control objectives under SSAE 18 (AT-C 320)
- Report
- SOC 1 Type I or Type II, a separate report
- Engagement
- Separate attestation engagement
Timeline: Coordinated with your SOC 2 timing. The report period is set with your customers’ auditors in mind, and we tell you on the scope call what is achievable.
Who needs SOC 1 companion report?
Payroll, billing and payments platforms
Your output lands in your customers’ ledgers. Their auditors want assurance over the controls that produce it.
Fintech and ledger infrastructure
You calculate balances, interest, fees or reconciliations that customers rely on for their own financial statements.
SaaS asked for a SOC 1 at year-end
A customer’s external auditor sent a request, and your SOC 2 does not cover what they need.
What is in the report
- Management’s description of the system, management’s assertion, and the control objectives relevant to your customers’ financial reporting
- The controls that meet each objective, and in a Type II report, tests of their operating effectiveness over the period
- Tang Advisory’s opinion under SSAE 18 (AT-C section 320) for the use of your customers and their auditors
- Complementary user entity controls, the items your customers’ auditors look for first
What it is not
Not a SOC 2+ add-on and not extra criteria inside your SOC 2. SOC 1 is a separate attestation engagement under AT-C 320 with its own control objectives, its own assertion and a different audience: your customers’ financial-statement auditors. It does not cover security, availability or privacy for their own sake, only the controls that affect your customers’ financial reporting.
We do not design, implement, or operate the controls we examine.
How it works
A separate attestation engagement with its own report, coordinated with your SOC 2 fieldwork so overlapping evidence is requested once.
- 1
Scope call
Identify which customer financial processes your service affects and who will use the report.
- 2
Objectives and description
Management drafts the system description, assertion and control objectives. We evaluate them for completeness.
- 3
Examination
A separate engagement coordinated with your SOC 2 timing. Overlapping IT general control evidence is requested once and reused.
- 4
Separate report
Signed SOC 1 report, issued separately from your SOC 2 and written for its own audience.
Scope, timing and fees
The engagement is scoped as its own report alongside your SOC 2 during the preliminary scope discussion. Formal scope, timing, and fees are established only after the firm completes its required acceptance and quality gates.
We do not design, implement, or operate the controls we examine.
Frequently asked questions
A customer’s auditor asking for a SOC 1?
Schedule a free 30-minute preliminary scope discussion. We will confirm whether the request is really for a SOC 1 and how to coordinate it with your SOC 2.