The auditor samples evidence from across the review period, commonly three to twelve months, so a Type 2 shows how controls behaved over time. It is the report most enterprise buyers ask for.
After the first report most companies move to twelve-month periods back to back, with a bridge letter covering the time between reports.
Read more
Related terms
- SOC 2 Type 1
- A SOC 2 Type 1 report gives an auditor's opinion on whether controls were suitably designed and in place at a single point in time.
- Review period
- The review period is the window of time a SOC 2 Type 2 covers, over which the auditor tests whether controls operated effectively.
- Bridge letter
- A bridge letter is a statement from a service organization's management covering the gap between the end of its last SOC report period and today.
- Exception
- An exception is a deviation an auditor finds when testing a control, such as a skipped access review or a change deployed without the required approval.