ZCybersecurity

SOC 2 compliance › Audit timeline

SOC 2 timing

SOC 2 audit timeline: what sets the clock

A single number would mislead you. This guide shows the phases in order, who controls the clock in each, and how to plan backwards from the date a customer needs your report.

Tell Us What You NeedJump to the phases

Free for buyers · provider-funded introductions · Updated October 2026

At a glance
ForTeams with a customer deadline for a SOC 2 report
CoversSix phases, who controls each, and planning backwards
You end withQuestions to put to your auditor in writing
It is notA promise of duration. Providers’ ranges are estimates
The short answer

How long does a SOC 2 audit take?

There is no single answer. The timeline has up to six phases: readiness and remediation, an optional Type 1, the Type 2 observation window, fieldwork, draft report and review, and final issuance. You and your auditor agree the window, and spending more does not shorten it. The other phases depend on your readiness and how quickly each side responds, so ask your auditor for a written schedule.

  • Work out which phases you control and which belong to the auditor.
  • Plan backwards from the date your customer needs the report.
  • Treat online ranges as estimates. We found none backed by AICPA.
The phases

Six phases, and who controls the clock

Each phase has a different owner of its pace.

The six phases and who controls the clock. No durations are shown.SOC 2 audit timeline in six phases: readiness and remediation, optional Type 1, Type 2 observation window, fieldwork, draft report and review, letters and final report, each showing who controls the clock.1Readiness and remediationYou2Type 1 (optional)You and auditor3Type 2 observation windowAgreed with auditor4FieldworkAuditor, your responses5Draft report and reviewBoth6Letters and final reportAuditor, your signatoriesNo durations shown. Ask your auditor for a written schedule.
The six phases and who controls the clock. No durations are shown.
SOC 2 timeline phases with who controls the clock and what speeds or delays each
PhaseWhat happensWho controls the clockWhat speeds or delays it
1. Readiness and remediationFind gaps and fix them. See the readiness checklist.YouHow many controls already operate, and whether owners and budget are agreed
2. Type 1 (optional)The auditor tests design at one date.You and the auditorOnly worth it if a customer needs a report sooner. See Type 1 vs Type 2.
3. Type 2 observation windowControls run and evidence builds over a period.Agreed with the auditorThe period is set by agreement, and it cannot be compressed by spending more.
4. FieldworkRequests, sampling and testing.The auditor, with your responsesScope, number of systems, quality of evidence and how fast you answer
5. Draft report and reviewExceptions are documented and you review the draft.BothNumber of exceptions and comment turnaround
6. Letters and final reportManagement letters are signed and the report is issued.The auditor and your signatoriesAvailability of signatories

Vendors publish ranges for these phases, but we found none backed by AICPA. We could not confirm a minimum observation period in AICPA’s public materials, so confirm the period with your auditor.

Plan backwards

Start from the date the customer needs the report

Work from the deadline to what you must do this month.

  • Find the date the customer needs the report, and which type and period they accept.
  • Ask your auditor for the earliest window start and the fieldwork and issuance schedule, in writing.
  • Subtract those phases from the deadline to see when readiness must finish.
  • If the date cannot be met, agree interim evidence with the customer. See SOC 2 vs ISO 27001 for common options.
Ask your auditor

Questions to put in writing

Written answers turn a vague timeline into a plan.

Questions to ask your auditor about timing
QuestionWhy it matters
What is the earliest date the observation window can start?Sets the first fixed point in your plan.
What period will you accept for a first Type 2 report?The period is agreed, not fixed by the criteria.
When is fieldwork scheduled relative to the end of the window?Auditor capacity can add a wait.
How long between fieldwork and the draft, and how many review rounds?Draft turnaround and review cycles shape the end date.
What would move us to a later slot?Late evidence or scope changes can push you back.
Delays

What usually delays a SOC 2 audit

Most are within your control.

  • Controls that exist on paper but do not run consistently.
  • Evidence that was not kept as controls ran.
  • Scope changes after the window has opened.
  • Slow answers to the auditor’s requests or draft comments.
  • Signatories who are unavailable at the end.
FAQ

SOC 2 timeline questions

How long does a SOC 2 audit take?
It depends on your report type, your readiness and the auditor’s schedule. The phases are readiness, an optional Type 1, the observation window, fieldwork, draft review and final issuance. Ask your auditor for a written schedule.
How long is the Type 2 observation window?
It is agreed with your auditor and customer. We could not confirm a fixed minimum in AICPA’s public materials, so confirm the period you need before you plan.
Can I speed up a SOC 2 audit?
You can speed up readiness, evidence capture and your responses. You cannot compress the observation window by spending more.
Is a Type 1 report faster?
A Type 1 tests design at a date, so it does not need an observation window. You still need the controls in place first.
How often is the audit repeated?
Most organisations repeat it annually. Customers generally expect a report that covers a recent period.
What can I send a customer while the audit is under way?
Agree it with the customer. Options include a Type 1 report once available, an auditor engagement letter or a bridge letter. None replaces the final report.
Start here

Start with the requirement, not the auditor.

Requirement→Scope→Price→Matched provider
Tell Us What You Need

Free for buyers · provider-funded introductions

Scroll to Top