Running the engagement

Choosing the length of your observation period.

A Type 2 report covers a stretch of time, not a single day. That stretch is the observation period, and every control in the report must be shown to work across it. You choose its start and length with your CPA firm. The choice shapes how soon you have a report and how much it is worth to a buyer.

Back to SOC 2 services

01 · What it is

The window the opinion covers

Everything the auditor tests in a Type 2 happened inside these dates.

The observation periodThe opinion speaks only for the dates between the start and the end.

The period's dates appear in the report title, in management's assertion and in the auditor's opinion. Anything that happened before the start or after the end is outside the opinion. That's why the dates matter as much as the length.

02 · Common lengths

How long periods commonly run

A matter of practice, agreed with your CPA firm, not a fixed rule.

months
3–6
A range commonly seen for a first Type 2 period.
months
12
The usual length once reports renew each year.
length set by the criteria
None
TSP 100 doesn't fix a length; your CPA firm judges whether the period is long enough to test.

A period must be long enough for each control to occur. A quarterly control in a three-month window may run only once, which gives the auditor a single item to test.

03 · Short or long

A shorter or a longer first period

Speed to a report against the weight the report carries.

Shorter first period

  • Report sooner after the period starts
  • Fewer occurrences of each control to keep right
  • Annual controls may not fall inside it
  • Some buyers discount a short window
  • Next period follows soon, often longer

Longer first period

  • Report later
  • More occurrences, more chances to slip
  • Quarterly and annual controls are properly tested
  • Reads as stronger evidence to a reviewer
  • Lines up with a yearly renewal cycle

Neither is wrong. A short first period followed by an abutting full-year period is a common pattern.

04 · Choosing

Factors that decide the length

Start from the buyer's deadline, then check your controls can carry it.

  1. What buyers ask forIf a contract or questionnaire names a minimum period, that sets your floor.
  2. Control maturityControls that have just started benefit from a shorter first window; a long one gives a new process more time to miss.
  3. First report or renewalRenewals usually run a full year and abut the last period, so coverage has no gap.
  4. Annual and quarterly controlsMake sure each one falls inside the period at least once, ideally more than once.
  5. Planned changesA migration halfway through is manageable but adds testing. Some teams time the period around it.

05 · Dates

Start dates, backdating and the fiscal year

The start is the day your controls and their evidence begin.

Picking the start date

Start the period once every control in scope is running and leaving records, not when the last policy is signed. A dry run of each recurring control before the start removes the risk of a weak first month.

Why a period can't be stretched backwards

The period is agreed with the CPA firm, and the auditor needs evidence for every day of it. You can't place the start before your controls existed, and evidence can't be produced after the fact: approvals, logs and reviews carry timestamps, and records made later show it. In practice, a period only reaches as far back as your real, dated evidence does.

Aligning with your fiscal year

SOC 2 doesn't require a period to match your fiscal year. Some companies align the end date with year-end planning, board reviews or the annual risk assessment so one cycle drives them all. Others pick an end date that suits the buyers who ask most often. Choose one, then keep it, since consecutive periods should abut.

06 · At the end

What happens when the period closes

Testing finishes, the report is written, and the next period starts.

  1. The CPA firm completes fieldwork on the full period, drawing samples from each population.
  2. Management finalises the system description and signs its assertion for the period.
  3. The firm issues the report with its opinion, dated after the period end.
  4. The next period, if you renew, begins the day after the last one ended.
  5. Between the period end and the next report, a bridge letter from management can cover questions from buyers.

Sources: AICPA AT-C section 205; AICPA guide, SOC 2 Reporting on an Examination of Controls at a Service Organization (type 2 engagements and the period covered); AICPA TSP section 100; AICPA DC section 200.

Questions about the observation period

Can we extend the period once it has started?

Talk to your CPA firm; it's possible before fieldwork is planned.

The period is part of the engagement terms. Changing it means agreeing new dates with the firm and making sure evidence covers the longer window. It's simpler to choose the right length at the start.

Is a longer period always better?

Not for a first report.

A longer window carries more weight with reviewers, but it also gives new controls more chances to slip and delays the report. For a first Type 2, a shorter period followed by a full year is often the steadier route.

What if a control fails in the first month?

It's a deviation to evaluate, not a reason to restart.

The auditor evaluates it with everything else. Fix the cause, document what happened and keep the control running. Restarting the period would only delay the report and throw away good evidence.

Does the period length change what's in the report?

The structure is the same; the samples aren't.

Section 4 lists the same kinds of tests. A longer period gives larger populations, so the auditor's samples and results reflect more of your history.

Pick a period your controls can carry.

We help you choose dates and length that suit your buyers, and check every control will occur inside them.

Get a SOC 2 readiness assessmentBook a free consultationBack to SOC 2 services