Procurement gives you a date. It is usually a quarter end, usually about ninety days out, and it was chosen by somebody who has never watched an examination run. The report cannot exist by then, and the reason has nothing to do with how hard your team works. A Type 2 opinion covers a period of time, and the period has to elapse before anyone can form an opinion about it.
That is the whole difficulty with this question. Nearly every page answering it hands you a set of week ranges with no name attached, which is fine until you have to put one of those numbers in writing to a customer. Every duration below comes from a firm that performs the examination and publishes what its own engagements take.
How Long Does a SOC 2 Audit Take?
Two clocks run at once, and confusing them is what wrecks a plan.
The first is calendar time, which is dominated by a phase nobody is working during. The second is your team's time, which is concentrated into a few short bursts at the start and the end. A plan built on the first number staffs the wrong month; a plan built on the second promises a date that cannot happen.
The answer also depends on which question you asked. "How long does the audit take" usually means fieldwork, and Schellman, a CPA firm specializing in these examinations, publishes two weeks of testing for a Type 1 and two to four weeks for a Type 2. "How long does SOC 2 take" means everything from the first scoping call to a document you can attach to an email, and the same firm puts a full sweep from readiness through Type 1 and Type 2 at twelve to fifteen months of calendar time.
Neither number is wrong. They answer different questions, and the gap between them is why vendors can advertise a six-week audit while founders wait a year. What you are buying is an accountant's opinion rather than a certificate, and an opinion about a period cannot be issued before the period ends.
SOC 2 Audit Timeline by Phase
Here is the sequence with a named publisher against every figure.
- Scoping and auditor selection. Criteria, systems and subservice organizations are fixed here, and every later duration follows from those choices
- Readiness assessment. Cherry Bekaert publishes one to two months; Schellman puts the testing inside it at one to two weeks
- Remediation. Cherry Bekaert publishes one to six months depending on control maturity, and this is the phase that varies most between companies
- The observation period, for a Type 2 only. Cherry Bekaert publishes three to twelve months. Almost no audit work happens in it and the controls have to run anyway
- Fieldwork. Schellman publishes two weeks of testing for a Type 1 and two to four weeks for a Type 2
- Report. Schellman issues a draft within two weeks of the last day of testing and a final within thirty days
- Renewal. The next window normally opens the day the last one closed, so coverage does not break
The phases overlap. Remediation runs alongside readiness and often bleeds into the first weeks of the observation period, which is the single most expensive scheduling error in the whole process, because the auditor samples from the entire window.
| Phase | Published duration | Published by |
|---|---|---|
| Readiness assessment | One to two months, with one to two weeks of testing inside it | Cherry Bekaert, Schellman |
| Remediation | One to six months, depending on maturity level | Cherry Bekaert |
| Observation period (Type 2) | Three to twelve months | Cherry Bekaert |
| Fieldwork | Two weeks (Type 1), two to four weeks (Type 2), audit window two to six weeks | Schellman, A-LIGN |
| Report issuance | Draft within two weeks of the last day of testing, final within thirty days | Schellman |
Cherry Bekaert, a licensed independent CPA firm, publishes the readiness and remediation figures; A-LIGN, whose assurance entity is a licensed CPA firm registered with the PCAOB, publishes a two to six week audit window and three weeks to report issuance, and states that a proper SOC 2 audit takes at least eight weeks to complete. Whether you buy a readiness assessment is the one decision in the table that changes the shape of everything after it, because remediation you discover during fieldwork becomes an exception in the report rather than a task on a list.
How Long Does a SOC 2 Type 1 Take?
A Type 1 is an opinion on whether controls are suitably designed as of a single date, so there is no window to wait out. That is the entire timeline advantage, and it is a real one.
Cherry Bekaert puts Type 1 fieldwork at a few weeks to one to two months. Schellman puts the testing itself at two weeks. Readiness and remediation still sit in front of it, which is why a company starting from nothing rarely holds a Type 1 in under two months and often takes four.
The trap is that a Type 1 bought to hit a date does not remove the Type 2 from your calendar. It moves it. A sophisticated buyer reads a Type 1 as a commitment that a Type 2 is coming and asks for the period end date, so you end up running two engagements inside a year and paying for both. Choose a Type 1 when the customer has agreed in writing that it satisfies them for now, and not because it is the fastest thing you can buy.
How Long Does a SOC 2 Type 2 Take?
Add Cherry Bekaert's published phases at their shortest and you get roughly seven months: one month of readiness, one month of remediation, a three month window, a month of fieldwork and three to four weeks to a report. Add them at their longest and the same arithmetic runs close to two years.
Schellman's twelve to fifteen months for a full sweep sits in the middle of that, and it matches what most first-timers actually experience. Two things push a company toward the upper end. The first is starting the observation period before the controls are genuinely running, so the window produces exceptions that need explaining or a second window. The second is scoping more trust services categories than the customer asked for, which adds criteria, evidence and testing to every phase at once and moves what the examination costs at the same time.
A-LIGN's floor is worth holding onto as a sanity check: at least eight weeks for the audit itself, on top of a window that has already closed. Anyone quoting a shorter total is quoting a different scope.
How Long Is the SOC 2 Observation Period?
This is the number that decides your date, and it is also the number most often described as a rule when it is a convention.
Convention still governs what a buyer will accept. Linford & Company, a CPA firm performing SOC engagements, notes that most reports cover a twelve month period and can be as short as six, and that to support a user auditor's risk assessment the period covered would need to overlap the user entity's audit period, typically by at least six months. If your customers are audited companies, that overlap requirement is doing more to set your window than anything you decide internally.
Three practical consequences. A three month first window is legitimate and gets you a report sooner, at the cost of a second conversation when a customer asks why it is short. Controls have to be running on day one of the window, not week three, because the auditor samples across the whole period, and multi-factor authentication switched on a month late produces exceptions for the weeks it was absent. And year two's window normally opens the day year one's closed, because a gap between periods is a gap in coverage that a customer's vendor risk team will find.
Nothing in the criteria makes a report expire. The twelve month habit comes from customers, who treat a report older than a year as stale. A bridge letter, sometimes called a gap letter, covers the stretch between your period end and today, and Linford is clear that it is issued by the service organization rather than the auditor, which is exactly why it carries less weight than the report.
What Happens During SOC 2 Fieldwork
The two to four weeks labeled "the audit" is not a block of auditor work you wait out. It is an exchange, and half the moves are yours.
A-LIGN publishes two to three business days to issue the request list, then evidence collection running throughout testing. Cherry Bekaert names client preparedness, staffing capacity and timeliness in responding to audit requests as what determines fieldwork timing. Both are describing the same thing: the auditor is rarely the bottleneck.
What shortens this phase is evidence that already exists in a retrievable, dated form. An access review with a ticket, a change with an approval recorded before it shipped, vulnerability scans run on a schedule with the output retained. What lengthens it is evidence assembled on request, because assembling it takes days and an auditor who watches you assemble it will test more of it.
What Affects Your SOC 2 Audit Timeline
Seven things move the date. Four of them are yours.
| Driver | Effect on the calendar | Yours to control |
|---|---|---|
| Trust services categories in scope | Each category beyond security adds criteria, evidence and testing to every phase | Yes, at scoping |
| Control maturity at the start | Cherry Bekaert publishes remediation at one to six months depending on maturity | Yes, over months |
| Evidence quality and retrievability | Dated, retrievable evidence compresses fieldwork; evidence gathered on request expands it | Yes |
| Your response time to requests | Named by Cherry Bekaert as a determinant of fieldwork timing | Yes |
| Headcount and number of systems | Larger populations mean larger samples and more testing hours | Partly |
| Subservice organizations | Carve-out decisions and vendor reports you have to collect before testing closes | Partly |
| Auditor availability | Slots book out, and a late engagement letter moves every date after it | No |
Two items commonly assumed to be timeline risks usually are not. A penetration test is not required by the trust services criteria, though many auditors expect one as evidence, and it can run in parallel with the observation period rather than in front of it. An incident response plan takes days to write and is only a delay if you discover in fieldwork that you never had one.
How to Hit a Customer's SOC 2 Deadline
Work backwards from the date the report is issued, never forwards from the date you start.
Can You Get a SOC 2 Faster?
Some things genuinely compress the calendar. Scoping to security alone rather than four categories removes criteria from every phase. Running remediation before the window opens rather than during it removes a second window. Reusing evidence you already produce for ISO 27001 or another framework removes duplicate collection. Answering evidence requests inside two days rather than two weeks removes most of the variance in fieldwork.
What cannot be compressed is the period itself, and a vendor promising otherwise is describing a Type 1 or a shorter window, not a faster examination.
Speed is also a quality signal in the wrong direction. In May 2026 the AICPA directed peer reviewers to examine the reasonableness of SOC 2 engagement timelines, alongside whether engagements are tailored to each client's risks and whether firms are producing identical reports, risk assessments, sample sizes and testing procedures across different clients, and whether they lean too heavily on third-party SOC platforms in place of professional judgment. The profession's own quality process now treats an unusually fast engagement as something to look into, which is worth knowing before you shop on turnaround.
Key takeaways
- Schellman, a CPA firm performing these examinations, puts a full sweep from readiness through Type 1 and Type 2 at twelve to fifteen months of calendar time. The examination itself is two to four weeks of that.
- Summing Cherry Bekaert's published phases gives roughly seven months at the fastest for a first Type 2 and close to two years at the slowest.
- There is no minimum observation period in the standard. Cherry Bekaert states the AICPA does not specify one, and that three months is simply the shortest seen in practice.
- Linford & Company notes most reports cover twelve months and that the period typically needs to overlap a customer's own audit period by at least six months, which is often what really sets your window.
- A Type 1 takes two to four months from a standing start and moves the Type 2 rather than removing it.
- Fieldwork is an exchange, not a wait. Cherry Bekaert names your responsiveness as a determinant of how long it runs, and A-LIGN puts a floor of eight weeks on a proper audit.
- Controls must be running on day one of the window. Anything switched on later produces exceptions for the weeks it was absent.
- In May 2026 the AICPA directed peer reviewers to look at the reasonableness of SOC 2 engagement timelines, so an unusually fast engagement is now a documented quality concern.
Common questions
How long does a SOC 2 audit take?
It depends which part you mean. Testing runs two weeks for a Type 1 and two to four weeks for a Type 2 in Schellman's published figures. Getting from no controls to a report in hand is a different question, and the same firm puts a full readiness, Type 1 and Type 2 sweep at twelve to fifteen months.
How long does a SOC 2 Type 1 take?
Two to four months is realistic from a standing start, since a Type 1 opinion covers a single date and needs no observation window. Cherry Bekaert publishes Type 1 fieldwork at a few weeks to one or two months, and readiness plus remediation sits in front of that.
How long does a SOC 2 Type 2 take?
Roughly seven months at the absolute fastest, more commonly twelve to fifteen, and up to two years for a company starting with little in place. The spread comes almost entirely from remediation, which Cherry Bekaert publishes at one to six months, and from the window length you choose.
What is the minimum SOC 2 observation period?
There is no minimum in the standard. Cherry Bekaert, a licensed CPA firm, states the AICPA does not specify a minimum allowable audit period and that three months is the shortest testing period typically seen in practice. Three months is therefore a market convention rather than a rule, and some buyers will push back on it.
How long does it take to get the report after fieldwork ends?
Schellman provides a draft within two weeks of the last day of testing and a final within thirty days, and A-LIGN publishes three weeks to issuance. Budget three to four weeks, and remember management has to review the draft and sign its assertion inside that period.
How long is a SOC 2 report valid?
Nothing in the criteria makes a report expire. Customers treat one older than about twelve months as stale, which is why annual renewal became standard. A bridge letter covers the stretch since your period ended, but it is issued by your own management rather than the auditor, so it carries less weight than the report itself.
Can you get a SOC 2 in 30 days?
Not a Type 2, because the period has to elapse first. A Type 1 in thirty days is conceivable only if the controls and evidence are already in place and an auditor has a slot. Be careful what you are buying: since May 2026 the AICPA has directed peer reviewers to question the reasonableness of SOC 2 engagement timelines.
Does a compliance platform make the audit faster?
It can shorten fieldwork by keeping evidence dated and retrievable, which is the phase where preparation genuinely converts into weeks. It does nothing to the observation period, which is most of the calendar. The AICPA's peer review guidance also flags firms leaning on third-party SOC platforms in place of professional judgment, so a platform is not a substitute for an auditor doing the work.
What is the standard SOC 2 audit window?
Twelve months is the steady state for companies past their first report, and Linford & Company notes most reports cover that period while some run six. First reports often use three or six months to get something in a customer's hands sooner, then extend at renewal so coverage stays continuous.
When should I engage the auditor?
Before the observation period opens, not after. An auditor engaged mid-period cannot advise on the design of controls it will later test without compromising independence, calendar slots book out well ahead, and a late engagement letter is the one delay in this process that no amount of internal effort can recover.
On this page
- How Long Does a SOC 2 Audit Take?
- SOC 2 Audit Timeline by Phase
- How Long Does a SOC 2 Type 1 Take?
- How Long Does a SOC 2 Type 2 Take?
- How Long Is the SOC 2 Observation Period?
- What Happens During SOC 2 Fieldwork
- What Affects Your SOC 2 Audit Timeline
- How to Hit a Customer's SOC 2 Deadline
- Can You Get a SOC 2 Faster?
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.