How Long Does a SOC 2 Audit Take? Timeline by Phase

A SOC 2 audit takes roughly one to three months from the start of fieldwork to the issued report. The whole project takes longer: plan about 3 to 6 months end to end for a Type 1 and 6 to 12 months or more for a first Type 2, because readiness work comes first and a Type 2 adds an observation period during which the controls have to operate. These are planning ranges, not delivery guarantees, and GRC platform guides such as Scrut’s timeline guide give the same totals.

This page owns the phase-by-phase timeline. How to choose a 3, 6, or 12-month period is in the observation-period guide. Whether and when a startup needs SOC 2 is in SOC 2 for startups. The work to finish before the clock starts is in the SOC 2 compliance checklist, and fees are in the SOC 2 audit cost guide.

How long does each SOC 2 phase take?

Four phases set the calendar: readiness, remediation, the Type 2 observation period, and the CPA firm’s fieldwork and report. The first three are mostly in the company’s hands.

Vanta and Scrut put all pre-audit preparation at 1 to 3 months, while Cherry Bekaert’s readiness and remediation ranges add up to 2 to 8. The gap is how much remediation is left, which only a readiness assessment can size. The SOC 2 readiness assessment page covers what one involves.

The CPA firm’s share, from the start of fieldwork to the issued report, is the one phase where we have data of our own.

Each firm's listed range is reduced to its midpoint. The window runs from the start of fieldwork to the report. It excludes readiness work and a Type 2 observation period. Benchmark method and sample.

The benchmark above combines testing, draft review, and issuance. It uses the fieldwork-to-report estimate each verified audit firm in our directory lists. Some estimates are confirmed by the firm and some come from public sources, so read the spread as planning data, not a quote. Vanta and Scrut split the same stretch into 2 to 5 weeks of fieldwork and 2 to 6 weeks of report creation, which adds up to 4 to 11 weeks and fits inside that spread. Scrut also notes that the report stage includes your own review of the draft and the system description, so slow answers on your side lengthen it.

Type 1: report

1–3

Type 2: 3-month period

0–3

Report, 3-month period

4–6

Type 2: 6-month period

0–6

Report, 6-month period

7–9

Type 2: 12-month period

0–12

Report, 12-month period

13–15

051015

Laid end to end, a Type 1 report arrives about 1 to 3 months after controls are ready. A Type 2 report arrives roughly 4 to 6, 7 to 9, or 13 to 15 months after controls are ready, for a 3, 6, or 12-month period. Do not add every maximum together: some firms begin interim testing during the period, while others start most testing after it closes. Ask which work happens concurrently and what has to wait.

Why do people quote such different SOC 2 timelines?

They are usually timing different projects. “The audit took six weeks” can describe the CPA firm’s testing and reporting after the company was ready. “SOC 2 took nine months” can describe the whole program from the first gap assessment through a Type 2 period and the final report.

The company clock covers scope, control design, remediation, policy approval, the system description, and evidence. The CPA clock covers engagement planning, testing, follow-up requests, exception evaluation, draft review, and issuance. The company clock is the larger source of uncertainty, because a firm cannot give a reliable report date while scope is moving or key controls are not yet operating.

Practitioner anecdotes show the same split. In a 2025 r/soc2 thread asking how long a first Type 2 took, one commenter who prepares clients said to expect just under a year to hold a report covering a 6-month period, while another put the minimum at four months for a 3-month period. These are individual experiences, not data, and the answers differ mainly in how much preparation they count.

Can you choose your own Type 2 audit period?

You propose the dates, and the CPA firm has to accept them. The AICPA sets no fixed minimum, though its SOC 2 Guide (paragraph 2.54) says an auditor may conclude that a period under two months is unlikely to yield enough evidence for an opinion. Cherry Bekaert says three months is the shortest it sees in practice, so a 3-month period is a common first choice. Whether your customers accept it is a separate question, and the observation-period guide covers that choice and its trade-offs. Once established, most organizations undergo annual examinations, per the same source; how often SOC 2 audits are done covers the cycle and SOC 2 renewal cost the budget.

What can overlap in a SOC 2 timeline?

Auditor selection, system-description drafting, and some testing can overlap. Unresolved controls and missing evidence cannot be scheduled away.

The most useful scheduling question is which milestone starts each downstream task and what evidence proves it is complete.

How do you plan backward from a customer deadline?

Start from the date the report must reach the customer, then subtract each phase in turn. The SOC 2 timeline calculator does the date arithmetic for any deadline. Before counting back, get the requirement in writing: report type, Trust Services Criteria, whether a minimum period is required, and the deadline. “We need SOC 2 by December” is incomplete until the buyer says whether a Type 1 will do.

A worked example. A customer needs a Type 2 report by 30 September 2027 and accepts a 3-month period. It assumes 8 weeks from fieldwork to report and that the firm starts fieldwork when the period closes.

If the firm needs 12 weeks instead, fieldwork must start on 8 July 2027, and every earlier date moves four weeks sooner. A company with many gaps should plan from the early end of the readiness range, and one that finds few gaps can use the later end.

Two more steps make the schedule hold. Choose the CPA firm before you commit the calendar, and confirm its kickoff, the period dates, the testing approach, and the draft-to-final turnaround. Then name an owner and an evidence source for every control, and test that you can export a complete population for each one before day one.

Which SOC 2 auditors can start within 30 days or this quarter?

A firm’s start date depends on its workload the week you ask, and no directory, ours included, holds live calendars. What we can show is how the pieces work, so you ask the right question.

The date that matters depends on the report type. Per Cherry Bekaert, Type 1 testing can begin as soon as the controls are in place, so a 30-day start is a question about the firm’s open capacity. A Type 2 has two dates: when the observation period starts, which you and the CPA firm agree, and when fieldwork happens, which per Vanta may fall during the period or after it, depending on the firm. An estimate that begins at an undefined “audit-ready” milestone is not a start date, so ask what the milestone is.

The auditor directory lists each firm’s fieldwork-to-report estimate in weeks on its profile, which is the number to compare once kickoff is settled. Ask each firm for the same four things in writing: earliest kickoff, Type 2 period dates, the fieldwork window, and the draft-to-final review time. The auditor-selection guide covers comparing the rest. If you have a target date, you can send one scoped brief and compare the replies.

What usually delays a SOC 2 report?

The common blockers are unstable scope, controls that are not operating as written, incomplete evidence populations, slow answers to auditor requests, and unavailable firm capacity. Each one breaks a dependency in the schedule instead of adding a fixed number of days.

Before kickoff, check that the system boundary is approved, including subservice organizations, that each control has operated at its written frequency, and that someone owns each auditor request and the system description. The CPA firm evaluates an exception in context, and remediation does not erase what happened earlier in a Type 2 period.

Does compliance automation shorten the timeline?

It can cut evidence-collection and handoff time when its integrations cover the in-scope systems. A platform can retain records, map evidence to controls, flag failed tests, and give the CPA firm an organized workspace.

It cannot implement a missing control, make a customer accept a shorter period, decide how an exception affects the opinion, or issue the report. Compare those boundaries before buying from the SOC 2 compliance software directory.