Every Type 2 report is only as wide as its observation window.

A Type 2 report does not look at one day. It looks at a stretch of months and asks whether your controls ran the whole way through. That stretch is the observation period, and every sample the auditor picks comes from inside it.

Spelled out: Also called the review period or the period of examination.

Buyers read the dates before they read the opinion. A report whose period ended long ago says little about today, and a short period gives the auditor fewer occurrences to test. For the company, the period is a commitment: from the start date, every access review, change approval and backup check needs evidence. A control that only began halfway through is tested from that point, and a gap in the middle can become an exception. Choosing the start date is therefore a planning decision, not an administrative one. It should come after readiness work, not before it.

The auditor's opinion in Section 1

The opinion names the exact dates, for example 1 April to 30 September, and speaks only to that window.

The engagement letter

The CPA firm and the company fix the period in writing before testing starts.

Section 4 test results

Each test describes the population drawn from the period and how many items were sampled.

A bridge letter

Covers the gap between the period end and the date a customer reads the report, signed by management, not the auditor.

Report date

The date the auditor signs the report, usually some weeks after the period ends. It is not part of the period.

Type 1 as-of date

A Type 1 report is a single point in time. It has a date, not a period.

• Start the period only after controls have been running with evidence for a while.
• Line up the period end with the month your largest customers usually ask for a fresh report.
• Plan big system changes before or after the window, or document them carefully if they fall inside it.
• For year two, start the next period the day after the last one ends so there is no gap.

• GuideChoosing the length of the observation periodThe trade-offs between a short and a long Type 2 window.
• GuideSOC 2 Type 1 vs Type 2Snapshot or period, the observation window, and moving between them.
• GuideChanging systems mid-auditHow the observation period copes with migrations, tools and people.

Sources: AICPA SSAE 18, AT-C section 205 and AT-C section 320; AICPA guide, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy.