SOC 2 timeline & roadmap
The SOC 2 roadmap, from scoping to your annual report.
A SOC 2 runs through seven phases, from scoping to the annual cycle. Preparation moves as fast as your team does; the observation period for a Type 2 is fixed once it starts. This guide covers what happens in each phase, what it produces, and the scheduling mistakes that stretch engagements.
Back to SOC 2 services01 · How long it takes
What decides how long SOC 2 takes
Three things set the pace: your starting controls, the report type, and the observation period you agree with your CPA firm.
| Report | What it adds | What sets the pace |
|---|---|---|
| Type 1 | A point-in-time check of control design | How quickly gaps are closed |
| Type 2 | Testing of operating effectiveness across a period | The observation period you agree |
| Renewal | A new report for the next period | Consecutive periods with no gap |
02 · The seven phases
The seven-phase SOC 2 roadmap
Each phase ends with named outputs, so you always know where you stand.
Preparation & scoping
Decide what the report covers and who owns what.
- What happens
- Choose the system, services and Trust Services Categories
- Assign owners and stakeholders
- Select the independent CPA firm
- Run an initial readiness check
- You get
- Scope document
- Project plan
- CPA firm engagement letter
- Ownership (RACI) matrix
- Good practice
- Choose the CPA firm early and ask about scope
- Scope to the commitments you actually make
- Name one accountable owner
- Watch for
- A boundary that excludes what customers buy
- Leaving the auditor choice to the end
Gap analysis
Compare what you have with what the criteria need.
- What happens
- Review existing controls and policies
- Map controls to the criteria in scope
- Identify gaps and weak evidence
- Rank the remediation work
- You get
- Gap analysis report
- Control mapping matrix
- Remediation roadmap
- Resource plan
- Good practice
- Map evidence, not only controls
- Rank gaps by audit risk
- Reuse controls from other frameworks
- Watch for
- Counting a control that leaves no evidence
- A plan with no owners
Control implementation
Close the gaps and make every control leave evidence.
- What happens
- Implement missing controls
- Write or update policies
- Set up logging, monitoring and MFA
- Train staff on security
- You get
- Approved policies
- Technical controls in place
- Training records
- An evidence repository
- Good practice
- Automate evidence where you can
- Test each control once it's live
- Write runbooks for manual controls
- Watch for
- Policies that don't match practice
- Controls nobody owns
Observation period (Type 2 only)
Run every control on schedule while evidence accumulates.
- What happens
- Operate controls consistently
- Collect evidence as you go
- Run quarterly access reviews
- Scan, patch and record incidents
- You get
- Operating evidence
- Access review records
- Scan and remediation reports
- Change and incident logs
- Good practice
- Start only when controls are running
- Collect from day one
- Check the calendar monthly
- Watch for
- Starting the period too early
- Gathering evidence at the end
Pre-audit readiness
Test yourself the way the CPA firm will, and fix what you find.
- What happens
- Organize all evidence
- Run an internal readiness review
- Fix what would become an exception
- Finalize the system description
- You get
- Evidence package
- System description
- Readiness review results
- Remediation evidence
- Good practice
- Leave time to fix findings
- Check populations are complete
- Brief owners on walkthroughs
- Watch for
- Skipping the readiness review
- No buffer before fieldwork
The SOC 2 examination
The CPA firm performs fieldwork and writes the report.
- What happens
- Kickoff with the auditor
- Provide evidence and populations
- Answer requests and interviews
- Review the draft report
- You get
- Evidence submissions
- Management responses
- Draft report
- Final SOC 2 report
- Good practice
- Answer requests quickly
- Keep one tracker for every request
- Respond to every exception
- Watch for
- Owners unavailable during fieldwork
- Arguing exceptions without context
After the report: maintenance
Share the report, fix exceptions, and start the next period.
- What happens
- Share the report under NDA
- Remediate any exceptions
- Keep controls running
- Prepare the next examination
- You get
- Customer-ready report
- Exception remediation plan
- Monitoring reports
- Next-period plan
- Good practice
- Run periods back to back
- Use a bridge letter for short gaps
- Review last year's exceptions first
- Watch for
- A gap between periods
- Year-two complacency
03 · Timeline mistakes
Six scheduling mistakes that stretch SOC 2
None of these is about security. All of them are about planning.
- Starting the observation period too early. Controls must be in place and running first; let them run before the period begins.
- Underestimating evidence work. Collect from the first day of the period and leave time to organize it.
- Choosing the auditor late. Bring the CPA firm in during scoping so scope and control design match their expectations.
- No buffer for remediation. Leave room between the readiness review and fieldwork to fix what it finds.
- Ignoring team capacity. Plan around holidays, launches and other projects that pull control owners away.
- Skipping the readiness review. Going straight to fieldwork is the most common way to collect avoidable exceptions.
04 · Renewal & bridge letters
Renewal, consecutive periods and bridge letters
A report never formally expires, but buyers want a recent one, so most companies run back-to-back periods.
- Consecutive periods
- Each new observation period starts the day after the last one ended, so coverage has no gap.
- Bridge letter
- A letter from management, not the CPA firm, covering the time between a report's period end and today. It adds no assurance of its own.
- Year two
- Faster than the first, because controls are running; start with last year's exceptions.
More about SOC 2 timelines
Can we speed up SOC 2?
The preparation, yes. The observation period, no.
Dedicated owners, evidence automation and a tight system boundary speed up preparation. The observation period is the evidence a Type 2 tests, so it runs its agreed length once it starts.
What happens if the audit finds exceptions?
It's not pass or fail; the auditor weighs them.
Exceptions are recorded in Section 4. The CPA firm decides whether they are significant enough to modify the opinion. Many reports with a few exceptions keep a clean opinion. See opinions and exceptions.
How often do we renew?
Usually every year.
Buyers generally expect a report that ended within about the last year, so most organizations run annual, consecutive Type 2 periods, with a bridge letter for short gaps.
Get a timeline you can commit to.
A SOC 2 readiness assessment sets your scope and gaps, then gives you a firm timeline in writing for your first report.