It is commonly three to twelve months, with three to six for a first report, and it has to start once the controls in scope are running. A control missing for part of the period becomes an exception or has to be excluded.
The SOC 2 audit timeline covers how to plan periods.
Read more
Related terms
- SOC 2 Type 2
- A SOC 2 Type 2 report gives an auditor's opinion on whether controls were suitably designed and operated effectively throughout a review period.
- Bridge letter
- A bridge letter is a statement from a service organization's management covering the gap between the end of its last SOC report period and today.
- Population and sample
- A population is every occurrence of a control during a review period; a sample is the subset of it an auditor selects and tests.