Report age
A SOC 2 report doesn't expire. It ages.
There is no expiry date on a SOC 2 report and no rule that voids it after a year. What changes is how much a reader can rely on it. Buyers judge a report by when its period ended, what it covered, and whether anything newer exists. This page explains how they read age, and what you can truthfully say at each point.
Back to SOC 2 services01 · No expiry
Why there is no expiry date
An opinion describes the past. It is never withdrawn by the calendar.
A SOC 2 report is an examination report: a CPA firm's opinion about a system over a stated period (Type 2) or as of a stated date (Type 1). It describes something that already happened. The opinion stays true about that period forever; it just says less and less about today.
So where does “valid for a year” come from?
From buyers. Annual vendor reviews and contract clauses commonly ask for a report no older than about a year, which is why most service organizations report annually. It is a market expectation, not a feature of the report.
02 · What buyers check
What a reviewer actually looks at
Five facts on the first pages settle most of it.
- Period end dateThe real starting point for age. A Type 2 is usually measured from the last day tested, not the issue date.
- Report dateWhen the CPA firm signed. A long distance between period end and report date makes a report feel older on arrival.
- TypeType 1 tests design on one day; Type 2 tests operation over time. Reviewers forgive age less for a Type 1.
- CoverageDoes the system described include the product and region the buyer is purchasing? An up-to-date report on the wrong system is still a gap.
- Newer evidenceA bridge letter, an abutting period already running, or a newer report on the way.
03 · Three states
The three states your coverage can be in
Each one supports a different sentence.
| State | What is true | What you can say |
|---|---|---|
| Current report | The period ended recently enough to satisfy the buyer's policy. | “Our SOC 2 Type 2 covers 1 April to 31 March; here is the report under NDA.” |
| Bridge-covered | The report is ageing; management has addressed the months since in a signed letter, and the next period is running. | “Our latest report covers the period to 31 March. A management bridge letter covers the time since, and our next period is in progress.” |
| Lapsed | The report is old enough that buyers set it aside, or periods stopped abutting. | “Our last SOC 2 covered the year to 31 March of last year. A new period began on [date].” Say no more than that. |
A lapse isn't erased by the next report. If periods stopped abutting, the stretch between them is untested, and the next report's dates will show it.
04 · Report vs certificate
How this differs from a certificate
One has a printed end date. The other has a period.
SOC 2 report
- An opinion on a past period or date
- No expiry date printed anywhere
- Age judged by the reader
- Replaced by the next report, not renewed
A certificate (for example ISO/IEC 27001)
- A statement of conformity issued by a certification body
- A printed validity period
- Kept alive by surveillance audits
- Can be suspended or withdrawn
Borrowing certificate language (“valid until”, “renewed”) for a SOC 2 report is one of the commonest wording errors.
05 · Type 1 vs Type 2
How the report type changes what buyers will accept
One report is a starting point; buyers expect the other to follow it.
Type 1
Tests design as of one date. Reviewers usually accept it as an early-stage report and expect to hear that a Type 2 period is already running. An old Type 1 with no Type 2 behind it raises more questions than it answers.
Type 2
Tests operation over a period. Reviewers count from the period end, and an annual rhythm with abutting periods keeps it current indefinitely.
06 · As it ages
What to do as your report gets older
Plan the next report before buyers start asking.
- Right after issue: confirm the next observation period started the day after the last one ended.
- A few months in: prepare a bridge letter process (owner, checks, signer) so it is ready when the first buyer asks.
- Mid-cycle: check that the next report's scope still matches what you sell: new products, regions or vendors.
- Approaching a year: agree fieldwork and reporting dates with the CPA firm; tell large customers when to expect the new report, framed as a plan, not a promise.
- After the new report: retire the old one from your trust page and data room so nobody receives the wrong file.
Sources: AICPA SSAE 18 and AT-C 205 (examination engagements); AICPA SOC 2 guide; AICPA TSP section 100 (2017 Trust Services Criteria, revised points of focus). Buyer age expectations described as common practice, not as a rule.
Report age questions
Is a report from fourteen months ago still usable?
Usable as history; weak as current evidence.
Many reviewers will ask what has happened since. A bridge letter and proof that the next period is running help; a much older report with no follow-up usually doesn't satisfy an annual review.
Should we date our report by the issue date or the period end?
State both, and lead with the period.
The period is what was tested. Quoting only the issue date makes the report look newer than its evidence, and careful reviewers notice.
Does a qualified opinion shorten a report's useful life?
Not its age, but its weight.
A modified opinion is read with the same dates. It simply invites more questions, and buyers may want to see remediation reflected in the next report sooner.
Can we keep using last year's report after a major migration?
Disclose the migration; the report no longer describes today.
The report still covers its period accurately. A bridge letter should name the change, and the next report's description will cover it as a significant change.
Keep your coverage continuous.
We plan the next period and the bridge between reports so your SOC 2 never ages into a gap.