The second report
Your second SOC 2 is a new examination.
People call it a renewal, but nothing carries over automatically. Year two has its own engagement, its own period, its own management assertion and its own opinion. The good news: the design work is done. The work now is planning the cycle so the second report is cleaner than the first and the periods never leave a gap.
Back to SOC 2 services01 · A new engagement
What “new engagement” really means
Every formal piece is produced again.
- Engagement letter
- A new or renewed agreement with the CPA firm, setting the period, scope and categories.
- Observation period
- A new window. Nothing tested last year counts toward this one.
- System description
- Revised to describe the system as it ran during the new period.
- Management assertion
- Signed again by management for the new period.
- Opinion
- A new opinion, which can differ from last year's in either direction.
The CPA firm also reconsiders whether to accept the engagement and confirms its independence again. Any advisory work it did for you during the year matters here.
02 · Abutting periods
Back-to-back periods
The second period starts the day after the first one ends.
The commonest year-two slip is administrative: the first report is issued, everyone relaxes, and the second engagement letter is signed late. The controls keep running, but the period has to start where the agreement says. Agree the next period's dates while the first report is still in fieldwork.
03 · What repeats
What repeats and what is new
Testing repeats. Change and follow-up are new.
Repeats
- Testing of operating effectiveness over the new window
- Population requests and sampling for every recurring control
- Annual controls: risk assessment, policy review, training, vendor review
- Inquiry, observation and inspection of evidence
New in year two
- Significant changes in the period, disclosed in the description (DC9)
- Follow-up on prior exceptions and how they were fixed
- New products, regions or subservice organizations entering scope
- Controls added or retired since the last description
If year one was a short first Type 2, year two may be the first time annual controls fall inside a period at all.
04 · Prior exceptions
Last year's exceptions
The reader will look for them in the next report.
- Fixing it in month eleven. A remediation dated late in the new period leaves most of the period still running the old way.
- Fixing the symptom. Re-doing one missed access review without changing the reminder, owner or tool that let it slip.
- Rewriting the control to dodge it. Weakening the control wording so the same failure no longer counts. Readers compare descriptions year to year.
- No evidence of the fix. Remediation that happened in a meeting, with no ticket, change or document to show for it.
05 · Changing firms
Changing CPA firm for year two
Allowed, common, and worth planning for.
- Continuity of periodsThe new firm's period should still start the day after the old one ended.
- Prior reportExpect the new firm to read last year's report and ask about any exceptions.
- Testing approachSample selection, evidence format and walkthrough style may differ. Don't assume last year's evidence pack fits.
- IndependenceIf a firm helped you build controls, it may not be able to examine them.
- Report readersTell key customers about the change so a new firm name on the report isn't a surprise.
06 · The calendar
How the evidence calendar changes the second time
Year one builds the calendar. Year two runs it.
| Item | First cycle | Second cycle |
|---|---|---|
| Start of period | Starts when controls are ready | Fixed by the previous period end |
| Quarterly controls | Often first performed during the period | Already routine; the risk is complacency |
| Annual controls | May fall outside a short first period | Must land inside the window |
| Owners | Set during readiness | Check for leavers and role changes |
| Evidence storage | Built ad hoc | Reuse the same structure; fix what auditors struggled with |
| Fieldwork | Everything is new to everyone | Plan around last year's slowest requests |
07 · Pre-start review
What to review before the second period starts
One working session, before day one of the new window.
- Scope. Does the system boundary still match what customers buy?
- Categories. Have customer contracts introduced commitments that pull in Availability, Confidentiality or another category?
- Vendors. New or changed subservice organizations, and whose SOC reports you now need to review.
- Control list. Retire controls that no longer exist; add controls for new components.
- Exceptions. Every prior exception has an owner, a fix and evidence of the fix.
- CUECs. Do the complementary user entity controls still describe what customers really must do?
- Dates. Period start and end, fieldwork window and bridge letter owner, all agreed in writing.
Sources: AICPA SSAE 18; AT-C 105 and AT-C 205 (acceptance, independence, examination reporting); AICPA DC 200 (DC9, significant changes during the period); AICPA SOC 2 guide.
Second-report questions
Is the second SOC 2 cheaper or faster than the first?
Often less disruptive; still a full examination.
Design questions are mostly settled, so there is usually less back-and-forth. The CPA firm still tests the whole period, and new scope or prior exceptions can add work.
Can we switch from Type 1 to Type 2 in year two?
Yes, and most companies do.
The Type 2 period should start as soon as possible after the Type 1 date, so buyers see continuous coverage rather than a single day followed by a gap.
Can we add a Trust Services category in the second year?
Yes; the new category is tested for the first time.
The new criteria need controls that operate across the whole new period. Add them before the period starts, not partway through.
Does a clean first report guarantee a clean second one?
No.
Each period is tested on its own evidence. Second-year exceptions often come from slipped routines, not from bad design.
Plan the second cycle before the first one closes.
We run a pre-period review of scope, exceptions and dates so your next SOC 2 starts on the right day.