Learn
A SOC 2 takes as long as the period you choose, plus the work on either side of it. The AICPA sets no minimum: a Type 1 reports on the design of your controls "as of the date of the description", and a Type 2 on how they operated "throughout a specified period" whose length you agree with your auditor. Using the phase ranges published by the CPA firm Cherry Bekaert, a Type 1 for a company whose controls mostly exist lands in roughly three to six months. A first Type 2 on the three month period that firm calls the shortest it sees in practice lands in roughly six to eleven months from a standing start, and one on a twelve month period in well over a year. The phases you control, readiness and remediation, are where most calendars slip; the period itself cannot be shortened once it starts.
This guide walks through each phase, what the AICPA standards actually fix, and where the time goes. What the two report types are is explained in what is SOC 2: Type 1 vs Type 2; what happens inside the examination is in SOC 2 audit: what to expect.
| Phase | Typical duration | Who sets the pace |
|---|---|---|
| Readiness assessment, optional | 1 to 2 months with a third party | You and your adviser |
| Policies, remediation and control implementation | 1 to 6 months, depending on maturity | You |
| Type 1 fieldwork | A few weeks to 1 to 2 months | Your auditor and your response time |
| Type 2 period | 3 to 12 months in practice; no AICPA minimum | The period you agree; fixed once it starts |
| Type 2 fieldwork | 1 to 2 months, overlapping the end of the period | Your auditor and your response time |
| Firm review and quality control | Around 3 to 4 weeks | Your auditor |
Durations are Cherry Bekaert's published ranges; they are one firm's guidance, not a standard. Your auditor's own estimate should replace them as soon as you have one.
How long does a SOC 2 Type 1 take?
A Type 1 has no period. Under the AICPA's description criteria, DC section 200, its subject matter is the description of your system and "the suitability of the design of the controls", assessed as of a single date. Testing can start once your controls are in place. Adding Cherry Bekaert's ranges gives the arithmetic: one to two months of readiness, about a month of fixes for a company that already runs most controls, a few weeks to two months of fieldwork, and three to four weeks of review. That is roughly three to six months. If remediation runs to the six month end of the range, so does the Type 1.
The speed has a cost: a Type 1 says nothing about whether the controls worked over time, which is what most enterprise buyers ask for. Many companies use it as a first report while the Type 2 period runs.
How long does a SOC 2 Type 2 take?
A Type 2 adds "the operating effectiveness of controls" over a period, so the calendar is fixed by that period. The AICPA does not prescribe its length. Cherry Bekaert puts it plainly: "the AICPA does not specify a minimum allowable audit period for a SOC 2 Type 2 examination, the shortest testing period typically seen in practice is three months", and once established, "most organizations undergo annual examinations".
| Route | Arithmetic on the published ranges | Rough total |
|---|---|---|
| Type 1 only, controls mostly in place | 1 to 2 months readiness, about 1 month of fixes, weeks to 2 months fieldwork, 3 to 4 weeks review | 3 to 6 months |
| First Type 2, 3 month period | 2 to 5 months readiness and fixes, 3 month period, fieldwork overlapping its end, 1 to 2 months to finish and review | 6 to 11 months |
| First Type 2, 12 month period | 2 to 8 months readiness and fixes, 12 month period, 1 to 3 months to finish and review | 15 to 23 months |
| Renewal Type 2, annual | The next 12 month period starts when the last one ends | One report a year |
The middle row is the common first route: a short period gets a report into a buyer's hands, and the next period is a full year. Your auditor decides whether a short period produces a useful report for the controls you run; a quarterly control tested over three months has only one occurrence to look at.
When can the Type 2 period start?
Only once every control in scope is operating, because the opinion covers operation throughout the period. A control switched on in week six of a twelve week period has no evidence for the first five weeks, and the auditor will report it as such. That makes the readiness phase the one decision that moves the whole calendar: start the period too early and you buy exceptions; start it too late and you lose months you cannot recover.
Scope moves it too. The common criteria, which cover security, apply to every SOC 2 under the Trust Services Criteria; each optional category, availability, processing integrity, confidentiality or privacy, adds controls that must run for the whole period. Choose the categories your customers actually ask for before you set a start date.
What happens between the end of the period and the report?
Fieldwork finishes, the firm reviews its work, and you sign the paperwork. The attestation standards set no fixed gap. Under AT-C section 205, restated in SSAE No. 21, the report "should be dated no earlier than the date on which the practitioner has obtained sufficient appropriate evidence", including evidence that the documentation has been reviewed and that you, the responsible party, "provided a written assertion". The auditor also asks about events after the period up to the report date. So the tail is set by how quickly you answer sample requests, deliver the final system description and sign the assertion and the representation letter.
Most of that can be prepared during the period. A system description drafted against the nine description criteria in DC 200 before fieldwork starts, and evidence filed control by control as it is produced, takes weeks off the end; the method is in how to collect audit evidence.
Where do SOC 2 timelines slip?
Four places, all before or after the period rather than inside it. Scope decided late, so controls are added after the period has begun. Remediation without owners, so the start date moves month by month. Evidence produced only when the auditor asks, so a periodic control turns out not to have run. And a description and assertion written in the last week. Each is a planning failure, which is why the fill in table below starts with dates rather than controls.
What do other answers get wrong?
Most of page one gives a range and stops there, and several repeat claims the AICPA material does not support. The first is a minimum period stated as a rule, three months on some pages and six on others. The SOC 2 standards prescribe none; three months is a practice figure, and the six month figure some pages attribute to the AICPA is not in the SOC 2 standards. The second is that a SOC 2 report "is valid for 12 months". The standards give it no expiry: the opinion speaks to its date or period, and under AT-C 205 the auditor has no responsibility to perform procedures after the report date. Twelve months is what many buyers accept, which is a contract question, not a rule. The third is the word certification. A SOC 2 is an attestation examination by a CPA, which ends in an opinion, not a certificate.
Between reports, many companies give customers a bridge letter covering the gap since the last period ended. In practice it is the company's own statement, not something the auditor tested.
Plan your own SOC 2 calendar
Fill in the middle column with dates, not durations. If the first row is blank, the rest will move.
| Question | Your answer | Why it matters |
|---|---|---|
| When does the customer who asked need the report, and which type will they accept? | Sets whether a Type 1 or a short Type 2 is the first target. | |
| Which Trust Services categories are in scope? | Every optional category adds controls that must run for the whole period. | |
| On what date will every in scope control be operating? | That is the earliest the Type 2 period can start. | |
| How long is the first period, and has the auditor agreed it is useful? | No AICPA minimum, but the auditor must be able to test each control. | |
| Who drafts the system description, and by when? | The report cannot be dated before the assertion is signed. | |
| When does the next period start? | Annual renewals run back to back so the coverage has no gap. |
SOC 2 in Venvera maps your controls to the Trust Services Criteria, files evidence against each control as it is produced and puts every review on a calendar, so the period starts on a known date and the end of it is not a scramble. Budgets for the same phases are in SOC 2 cost outside the US, the control list is in the SOC 2 readiness checklist, and the free compliance check gives you a starting position. For a certificate based comparison, see how long ISO 27001 certification takes.
Frequently asked questions
What is the minimum SOC 2 Type 2 period?
The AICPA sets none. In practice the shortest periods are around three months, and your auditor has to agree the period is long enough to test the controls you run.
Can you get a SOC 2 in one month?
A Type 1 can, in principle, if the controls already exist and the description is ready, because it covers a single date. A Type 2 cannot: its period alone is usually three months or more.
Do I need a Type 1 before a Type 2?
No. A Type 1 is optional. Some companies use one as a first report while the Type 2 period runs.
How long is a SOC 2 report valid?
The AICPA standards give it no expiry. Buyers usually want a report whose period ended within the last year, which is why most companies renew annually.
Is a readiness assessment required?
No standard requires one. It is a planning step that tells you when the period can safely start.
Primary sources
Type 1 and Type 2 subject matter, management's description and the nine description criteria are from the AICPA's DC section 200 description criteria. The common criteria, the five categories and the Type 2 "throughout a specified period" wording are from the 2017 Trust Services Criteria with revised points of focus (2022). Report dating, subsequent events and the written assertion are from AT-C section 205 as restated in SSAE No. 21. Phase durations and the three month practice figure are from Cherry Bekaert's SOC 2 examination timeline; the route totals are our arithmetic on those ranges. Several AICPA documents require a free account.
