# SOC 2 Audit Timeline: How Long It Takes, Phase by Phase (2026) > Plan a SOC 2 examination by separating preparation, the observation period, fieldwork, and report review. This guide explains the dependencies that affect the delivery date and the questions to resolve before scheduling a Type I or Type II report. - Canonical: https://auditsuisse.com/soc-2-audit-timeline-what-to-expect - Language: en - Author: Sébastien Ruosch, CPA — Director of Audits - Published: 2026-02-22 - Updated: 2026-10-18 SOC 2 Plan a SOC 2 examination by separating preparation, the observation period, fieldwork, and report review. This guide explains the dependencies that affect the delivery date and the questions to resolve before scheduling a Type I or Type II report. The short answer SOC 2 timing depends on readiness, scope, evidence, and the reporting schedule. A Type I examination addresses a specified date. A Type II examination also covers an agreed observation period. Preparation, the observation period, fieldwork, and report review are separate stages. Confirm which stages an estimate includes before committing to a delivery date. Evidence must support what actually happened during the reporting period. Evidence gathered later can document a control that operated at the time, but creating a new record cannot make an omitted control occur retroactively. The auditor evaluates any gaps and their effect on the examination; a gap does not automatically determine the final opinion. ## Key takeaways - SOC 2 timing depends on readiness, scope, evidence, and the reporting schedule. A Type I examination addresses a specified date. A Type II examination also covers an agreed observation period. Preparation, the observation period, fieldwork, and report review are separate stages. Confirm which stages an estimate includes before committing to a delivery date. - Choose the reporting period with the auditor and intended recipients. Assess the control evidence available across that period, the frequency of relevant controls, and the buyer's requirements. A three-month, six-month, or twelve-month period should never be presented as automatically acceptable to every recipient. - A missed control may create an exception. The auditor evaluates its nature, frequency, significance, and effect on the examination. Remediation can improve future operation but does not change what occurred during the earlier period. - Automation can help collect evidence and track recurring controls. Its effect on preparation and fieldwork depends on the environment and the completeness of the evidence. It does not replace the auditor's work or change the actual elapsed time covered by the agreed reporting period. ## SOC 2 audit timeline at a glance Every SOC 2 examination is issued by a licensed CPA firm under the AICPA’s attestation standards — specifically SSAE 18, with the examination performed under **AT-C section 205** (Examination Engagements) against the 2017 Trust Services Criteria (TSP section 100). The timeline differs sharply by report type because Type I evaluates control *design* at a single “as of” date, while Type II evaluates *design plus operating effectiveness* across an observation period. The single most useful number is the **total elapsed time from kickoff to an issued report**, which for Type II is dominated by that observation window. The schedule is agreed for each engagement. Readiness starts from your current control maturity; a Type II observation period covers actual elapsed time; fieldwork and report review depend on the scope, evidence, findings, and reviewer availability. Activities may overlap where appropriate. Do not add the rows below as though every stage always runs sequentially. SOC 2 master phase timeline — who owns each phase, typical duration, and the gate to the next phase | Phase | What happens | Who owns it | Scheduling basis | Gate to next phase | | --- | --- | --- | --- | --- | | Scoping & kickoff | Select TSC, define system boundary, identify CUECs | Client + auditor | Confirm scope and availability before scheduling. | Agreed scope & assertion draft | | Optional readiness / gap assessment | Test control design against criteria, list gaps | Client (often with auditor) | Depends on existing controls and documentation. | Prioritized remediation plan | | Remediation | Implement and operationalize missing controls | Client | Depends on the gaps and management's implementation capacity. | All controls live & generating evidence | | Observation period start | Day 1 of the tested window (Type II) | Client | Agreed start date for the Type II reporting period. | Controls must already be operating | | Observation period (Type II only) | Controls run and produce dated evidence | Client | Agreed reporting period, based on purpose and recipient requirements. | Window closes on period-end date | | Evidence QA gap | Compile and quality-check final evidence | Client | Allow time to check completeness and date coverage. | Evidence package ready for sampling | | Fieldwork / testing | Auditor samples and tests operating effectiveness | Auditor | Depends on scope, evidence, findings, and auditor scheduling. | Testing complete, exceptions noted | | Draft report & management response | Review draft, respond to any exceptions | Auditor + client | Depends on report review and responses to findings. | Management response finalized | | Final report issuance | Report signed and delivered | Auditor | Follows completion of required review and engagement procedures. | Report in hand for buyers | For a Type I report, the plan identifies the examination date, preparation tasks, fieldwork, and review milestones. A Type II plan also identifies the reporting period and the evidence required across that period. The report delivery date follows completion of the applicable examination and review procedures. ## The full SOC 2 timeline, phase by phase Below is what actually happens in each phase, what determines its length, and where teams lose weeks they never get back. ### Phase 1 — Scoping & kickoff You select which Trust Services Criteria apply (Security is mandatory; Availability, Processing Integrity, Confidentiality, and Privacy are optional and each adds testing), define the system boundary, and identify complementary user entity controls (CUECs) — the controls your customers must operate for your controls to be effective. For a Type I, this phase also includes picking the point-in-time **“as of” date**, the Type I analog of choosing an observation period. Scope size is the primary duration driver downstream, so [scoping your systems](https://auditsuisse.com/how-to-scope-systems-for-soc-2) correctly here prevents cascading rework. ### Phase 2 — Preparation and optional readiness assessment Identify gaps before the examination through a separately scoped assessment. Readiness work does not provide an auditor's opinion. Management remains responsible for the controls, remediation decisions, and supporting evidence. Management prepares controls and evidence for the examination. If a separate readiness service is agreed, identified gaps inform the remediation plan, subject to applicable independence requirements. ### Phase 3 — Remediation & control implementation Management implements and operates the controls identified in the preparation plan. The time needed depends on the gaps, system complexity and implementation capacity. Discuss control readiness, evidence availability and the proposed observation period with the auditor before setting the schedule. ### Phase 4 — Observation / monitoring period Choose the reporting period with the auditor and intended recipients. Assess the control evidence available across that period, the frequency of relevant controls, and the buyer's requirements. A three-month, six-month, or twelve-month period should never be presented as automatically acceptable to every recipient. ### Phase 5 — Evidence QA gap before kickoff As recommended practice, leave a short buffer between the observation period closing and fieldwork beginning to compile and quality-check the final evidence package — validating date ranges, approvals, and completeness before auditors start sampling. This is not a mandated step, but skipping it tends to produce request-and-resubmit cycles that cost more time than the buffer would have. ### Phase 6 — Fieldwork & control testing The CPA firm samples dated evidence from across the observation period and tests whether each control operated as designed. For a Type I, fieldwork instead inspects design as of the chosen date. Length depends on scope size and how clean the evidence package is. See [how Auditsuisse runs fieldwork](https://auditsuisse.com/audit-methodology) for the mechanics of sampling and testing. ### Phase 7 — Draft report, management response & final issuance The auditor drafts the report, you review it and add management’s response to any exceptions, and the firm issues the final signed report. If testing surfaced exceptions, a qualified rather than unqualified opinion may result — reviewing the [common findings that extend the timeline](https://auditsuisse.com/soc-2-common-findings-and-how-to-fix-them) in advance is the best way to reach an unqualified opinion without added review cycles. ## SOC 2 Type I vs Type II timeline A SOC 2 Type I report addresses the system description and the suitability of control design at a specified date. A Type II report also addresses the operating effectiveness of controls throughout a specified period. The appropriate report type and period depend on the purpose of the report, available evidence, and recipient requirements. SOC 2 Type I vs Type II — timeline comparison | Dimension | SOC 2 Type I | SOC 2 Type II | | --- | --- | --- | | What’s assessed | Control design at a point in time | Control design *and* operating effectiveness over a period | | Observation period | Specified examination date | Agreed reporting period | | Total elapsed time | Preparation, examination, and report review | Preparation, the agreed observation period, examination, and report review | | Typical fieldwork length | Confirmed at scoping | Confirmed at scoping | | Buyer assurance strength | Confirm suitability with intended recipients. | Confirm suitability with intended recipients. | | Best first-audit use case | Discuss the specified date and purpose with the auditor. | Discuss the reporting period and evidence with the auditor. | ## How to choose your observation period (3 vs 6 vs 9 vs 12 months) These are period lengths to discuss during scoping, not universal acceptance thresholds. The purpose of the report, control frequency, evidence, and recipient requirements determine whether a proposed period is appropriate. Observation-period length trade-offs | Period length | Assurance to buyers | Time to report | Best for | | --- | --- | --- | --- | | 3 months | Confirm suitability with the auditor and intended recipients. | Fastest Type II path | A named deal on the line; first-ever Type II under time pressure | | 6 months | Confirm suitability with the auditor and intended recipients. | Moderate | Most first Type II reports | | 9 months | Confirm suitability with the auditor and intended recipients. | Longer | Bridging toward an annual cadence | | 12 months | Confirm suitability with the auditor and intended recipients. | Longest | Mature programs on a continuous annual cycle | A longer window also means more evidence to sample, which modestly raises fieldwork effort and cost; if budget matters, weigh the observation length against your [SOC 2 audit cost](https://auditsuisse.com/soc-2-audit-cost) before committing. ## Why Type II evidence cannot be created retroactively Evidence must support what actually happened during the reporting period. Evidence gathered later can document a control that operated at the time, but creating a new record cannot make an omitted control occur retroactively. The auditor evaluates any gaps and their effect on the examination; a gap does not automatically determine the final opinion. A missed control may create an exception. The auditor evaluates its nature, frequency, significance, and effect on the examination. Remediation can improve future operation but does not change what occurred during the earlier period. ## Illustrative planning example Illustrative planning example, not a delivery commitment: two months of preparation, a six-month observation period, and one month for examination and report review would total nine months if the stages run sequentially. Actual engagements may involve different durations or overlapping work. Well-organized evidence can reduce follow-up work. Actual delivery time still depends on scope, findings, review requirements, and scheduling. ## What extends a SOC 2 timeline — and how to prevent it Most slippage is predictable. These are the delay drivers we see most often and the preventive action for each. SOC 2 timeline risk factors & schedule impact | Delay driver | Why it slips the timeline | Typical impact | Preventive action | | --- | --- | --- | --- | | Late readiness start | Controls aren’t live on day one, so the window effectively starts later | Weeks to months | Finish remediation before setting the observation start date | | Retroactive evidence gaps | A missed control may create an exception. | Auditor assessment required | Monitor controls and evidence throughout the agreed period. | | Control-owner turnover | Knowledge and evidence trails break mid-period | 1–3 weeks | Assign controls to roles, not individuals; document runbooks | | Over-scoping | More systems and criteria mean more evidence and testing | 1–4 weeks | Start with defensible scope; expand later | | Slow evidence turnaround in fieldwork | Repeated request-and-resubmit cycles stall testing | 1–3 weeks | Centralize request intake with SLAs; QA before submission | | Auditor scheduling / busy season | Fieldwork weeks must be booked in advance; CPA capacity is finite | Weeks to months | Book fieldwork dates early; avoid year-end crunch when possible | ## Do compliance-automation platforms make SOC 2 faster? Automation can help collect evidence and track recurring controls. Its effect on preparation and fieldwork depends on the environment and the completeness of the evidence. It does not replace the auditor's work or change the actual elapsed time covered by the agreed reporting period. ## Bridge letters and the annual re-examination cadence A SOC 2 report describes a specified date or reporting period; it is not a certificate with a universal expiry date. Customers decide how recent a report must be for their assessment. Check the period end, subsequent changes, and customer requirements when planning the next examination. Plan the next examination around your customers' requirements and the period covered by the current report. Consecutive reporting periods can reduce gaps in the history available to customers. A management bridge letter may describe developments after a report's period end, but it does not extend the auditor's opinion. Agree any acceptable interval directly with the intended recipient. ## How to compress your SOC 2 timeline without cutting corners Automation can help collect evidence and track recurring controls. Its effect on preparation and fieldwork depends on the environment and the completeness of the evidence. It does not replace the auditor's work or change the actual elapsed time covered by the agreed reporting period. SOC 2 timing depends on readiness, scope, evidence, and the reporting schedule. A Type I examination addresses a specified date. A Type II examination also covers an agreed observation period. Preparation, the observation period, fieldwork, and report review are separate stages. Confirm which stages an estimate includes before committing to a delivery date. ## Frequently asked questions ### How long does a SOC 2 audit take? SOC 2 timing depends on readiness, scope, evidence, and the reporting schedule. A Type I examination addresses a specified date. A Type II examination also covers an agreed observation period. Preparation, the observation period, fieldwork, and report review are separate stages. Confirm which stages an estimate includes before committing to a delivery date. ### How long is the SOC 2 Type II observation period? The reporting period is agreed for the engagement and must support the purpose of the examination and the needs of intended users. Discuss the proposed period with the auditor and key report recipients before committing. A shorter period can provide less history for recipients to evaluate; no particular duration guarantees buyer acceptance. ### Can you get SOC 2 compliant in 3 months? Possibly, depending on the report type and starting position, but a three-month observation period is not the same as a three-month delivery promise. A Type II report still requires evidence across the agreed period and completion of examination and review procedures. Confirm feasibility with the auditor and the customer requesting the report. ### Why can’t SOC 2 Type II evidence be created retroactively? Evidence must support what actually happened during the reporting period. Evidence gathered later can document a control that operated at the time, but creating a new record cannot make an omitted control occur retroactively. The auditor evaluates any gaps and their effect on the examination; a gap does not automatically determine the final opinion. ### What is a SOC 2 bridge letter and when do you need one? A bridge letter is a management representation about the interval after a SOC report's period end. It describes relevant changes, or management's representation that no material changes occurred. It does not extend the auditor's opinion, provide a new examination, or replace a report. Recipients determine whether they can rely on it and may impose their own time limits. ### How long is a SOC 2 report valid? A SOC 2 report describes a specified date or reporting period; it is not a certificate with a universal expiry date. Customers decide how recent a report must be for their assessment. Check the period end, subsequent changes, and customer requirements when planning the next examination. ### Does a compliance automation platform make SOC 2 faster? Automation can help collect evidence and track recurring controls. Its effect on preparation and fieldwork depends on the environment and the completeness of the evidence. It does not replace the auditor's work or change the actual elapsed time covered by the agreed reporting period. ## Sources & further reading 1. AICPA & CIMA — [SOC 2® — SOC for Service Organizations: Trust Services Criteria](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2) (guidance on observation-period length and sufficiency of assurance). 2. AICPA & CIMA — [2017 Trust Services Criteria (with Revised Points of Focus — 2022), TSP section 100](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022). 3. AICPA — Statement on Standards for Attestation Engagements No. 18 (SSAE 18); SOC 2 examinations are performed under AT-C section 205 (Examination Engagements), and SOC 1 under AT-C section 320. Continue Reading ## Related Resources [### SOC 2 Readiness Checklist (2026) A complete playbook for getting your organization SOC 2 ready. Read More →](https://auditsuisse.com/soc-2-readiness-checklist-2026) [### SOC 2 Type I vs Type II Understand the key differences between Type I and Type II reports. Read More →](https://auditsuisse.com/soc-2-type-1-vs-type-2) [### How to Scope Systems for SOC 2 Define your SOC 2 boundaries without over-auditing. Read More →](https://auditsuisse.com/how-to-scope-systems-for-soc-2) --- Source: https://auditsuisse.com/soc-2-audit-timeline-what-to-expect · This Markdown edition is generated from the same content as the HTML page.