SOC 1 + SOC 2 Audit Software · Combined audit

One platform for SOC 1 + SOC 2, tested once

Run SOC 1 and SOC 2, Type 1 or Type 2, as one combined audit: one scoping pass, one set of evidence requests, one pass of testing, and both reports your client needs. Built by auditors, on one platform for the auditor’s side of the table.

The Audit Process Benchmark: three calls or fewer, with a free sandbox to run a real SOC 1 + SOC 2 engagement in Audora.

For audit firms

Your clients need both reports. Your team shouldn’t test the same controls twice.

Most firms run SOC 1 and SOC 2 as two engagements for the same client: the same access reviews, change tickets, and backup evidence requested and tested twice, often on two different timelines. A combined audit in Audora tests each shared control once, and the work supports both.

Audora is the audit management software built for the auditor’s side: one platform that runs your whole engagement and connects the tools your firm already uses.

A crossword of audit terms, including audit, compliance, control, and review

How Audora runs a SOC 1 + SOC 2 combined audit

One path from the first scoping call to the signed report, with every request, test, and approval in the same file.

1

Scope both

  • Set the SOC 1 control objectives and the SOC 2 Trust Services Categories, with the report types and periods, in one engagement.
  • Guided engagement setup loads your firm’s defaults and templates.
2

Request once

  • One set of requests covers both, so the client answers once.
  • Audora Connect pulls client evidence from Vanta as clean CSVs, with comments synced both ways.
3

Test once

  • Test each shared control once, and the work supports both reports.
  • Bulk-edit test details in the Walkthrough tab; staff self-claim open work from the Task Queue.
4

Review

  • Multi-step approvals with a full audit trail on every request, test, and sign-off.
  • Give an external peer reviewer their own role in the engagement.
5

Report and sign

  • Edit the .docx report inside Audora with two-way sync to the engagement.
  • Collect e-signatures without leaving the file.

Built for the overlap

Logical access, change management, IT operations, and subservice organizations are tested once and support both reports.

The work around the engagement

A scheduling dashboard with Gantt view, a practice dashboard that flags engagements at risk, and HubSpot and Slack connected, so client and team updates don’t live in a side process.

AI on a process built first

Audora AI drafts walkthrough interview fields from your transcripts. Audora drafts, you keep the judgment.

Consistency

One method on every combined audit, whoever runs it

Your firm’s reading of SSAE 18 and the Trust Services Criteria, your control matrix and workpaper templates, and the review points your partners keep raising go into the engagement template. Every senior works the same way, review comes back with one answer instead of one per partner, and what your firm knows stays when people move on.

  • Standard control matrices and workpapers across every engagement
  • Peer-review-ready files, with every request, test, and approval on the audit trail
  • Faster and more consistent at once: automation runs every engagement the same defensible way

Partners and owners

Run more concurrent SOC 1 and SOC 2 engagements with the same team, with engagements at risk and reports projected in one dashboard.

Engagement managers

Standard control matrices and workpapers, one methodology across seniors, and a file that’s ready for peer review.

Seniors and staff

Less re-keying and chasing evidence, more time on the judgment calls.

Audit Process Benchmark

Run a real SOC 1 + SOC 2 engagement in Audora before you decide

In three calls or fewer we learn how your firm runs SOC 1 and SOC 2, scope Audora to match, and you run an engagement in a free sandbox against your own success criteria. Whether or not you buy, you keep a gap read-out on your process, a Benchmark Summary, and a free QA of one engagement by a working auditor.

Book a Workshop Not ready for a workshop? Talk to our team

SOC 1 + SOC 2 guide

SOC 1 + SOC 2: why you might need both, and how a combined audit works

For service organizations whose customers ask for both reports, and for anyone who wants a quick reference. Your auditor makes the final call on scope and approach.

An auditor working at her desk with a computer and headset

What is a SOC 1 + SOC 2 combined audit?

One engagement that produces two reports, a SOC 1 and a SOC 2, for the same service organization. The controls that serve both, mostly IT general controls, are requested and tested once, and the work supports each report.

Is it one report or two?

Two. A SOC 1 and a SOC 2 serve different readers under different standards, so each is issued separately. Combining the audit removes duplicate work, not a report.

How are SOC 1 and SOC 2 different?

SOC 1

  • Controls relevant to customers’ internal control over financial reporting (ICFR)
  • SSAE 18, AT-C 320
  • Read by customers’ financial statement auditors
  • Control objectives defined by the service organization

SOC 2

  • Controls over security and the other Trust Services Categories
  • SSAE 18, AT-C 105 and AT-C 205
  • Read by customers’ security and vendor risk teams
  • Criteria set by the AICPA Trust Services Criteria

One report can’t stand in for the other, so a provider whose service touches both customers’ financial reporting and their data often needs both.

Who needs both?

Providers whose processing feeds customers’ financial statements and who also hold customer data: payroll and HR platforms, payment processors, billing and invoicing platforms, claims processors, fund and loan administrators, fintech, and BPOs.

You likely need both if
  • Customers’ auditors rely on your service for ICFR
  • Customers’ security teams also send you security reviews
  • Both reports are written into your contracts or RFPs
One report may be enough if
  • Your service doesn’t affect customers’ financial reporting (SOC 2 alone)
  • Customers only ask about financial processing (SOC 1 alone)

What does a combined audit cover?

SOC 1 only

  • Control objectives and business process controls over financial processing
  • Risk and control matrix tied to ICFR
  • Complementary user entity controls (CUECs) for financial reporting

SOC 2 only

  • Trust Services Categories: Security required, others as committed
  • System description against DC 200
  • Criteria such as risk assessment, incident response, and confidentiality

Tested once for both

  • Logical access: provisioning, reviews, and privileged access
  • Change management
  • IT operations: job scheduling, monitoring, and backups
  • Subservice organizations and vendor SOC reports

How does a combined audit run?

  1. Confirm which customers need which report, and align the report types and periods where you can.
  2. Scope both: the SOC 1 control objectives and ICFR boundary, and the SOC 2 Trust Services Categories and system boundary.
  3. Identify the controls that serve both reports, usually the IT general controls.
  4. Run a combined readiness assessment, then remediate.
  5. Fieldwork: one set of requests and shared walkthroughs and samples where periods and populations line up.
  6. Issue two reports, a SOC 1 and a SOC 2, from the same engagement, with bridge letters between periods.

How long does it take?

A combined audit follows the same timelines as the individual reports, set by the larger of the two scopes.

Type 1 (point in time)

  • Startup: 3–8 weeks
  • Small: 6–12 weeks
  • Medium: 12–18 weeks
  • Large: 16–24+ weeks

Type 2 (including the observation period)

  • Startup: 6–12 months
  • Small: 8–14 months
  • Medium: 9–15 months
  • Large: 10–18 months

Why combine SOC 1 and SOC 2?

  • The IT general controls behind both reports are tested once.
  • The client answers one set of evidence requests.
  • Aligned periods mean one fieldwork window and one set of bridge letters.
  • Each audience gets the report written for it.

Working with an audit firm on your SOC 1 and SOC 2?

Firms that run on Audora give their clients a collaboration dashboard: open requests, uploads, and comments in one place, instead of a thread of emails and spreadsheets. If you already use Vanta, your auditor can pull evidence straight from it.