Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
How long does SOC 2 take from start to report?
Last verifiedThere is no single number. Four stages run in sequence: readiness and remediation, the observation period for a Type II (commonly three to twelve months), fieldwork, then report drafting. A Type I skips the observation period. Those durations are market observations, not rules, and not a promise about your engagement.
How long SOC 2 takes, last verified 10 September 2026 against the AICPA Trust Services Criteria (TSP section 100 — 2017 criteria with the 2022 revised points of focus) and the AICPA attestation standards SSAE 18, AT-C sections 105 and 205. SOC 2 is an attestation examination performed by a licensed CPA firm and delivered as an opinion — a report, not a certification. This page is not legal advice, does not determine that YOU need SOC 2, and does not issue a SOC 2 report.
This is how the stages add up, not YOUR schedule
Audience: a founder promising a report to a customer, or a compliance owner being asked for a date. This page decomposes the timeline so you can build an estimate from your own facts. It is not a schedule, not a commitment, and not a determination that YOU need SOC 2. It does not issue a SOC 2 report.
Every duration below is a market observation: what engagements are commonly seen to take. No attestation standard fixes any of them, and no statute imposes a deadline, because SOC 2 is market and contractual, not statutory: no statute requires a SOC 2 report. Your real constraints are your control maturity, your evidence quality, and your CPA firm's calendar.
Type I addresses the design of controls at a point in time; Type II addresses operating effectiveness over a review period. That single choice moves the finish line by months, which is why it is the first thing to settle. "SOC 2 certified" is a misnomer — there is no SOC 2 certificate to wait for, only a report to be issued. Only a licensed CPA firm can perform a SOC 2 examination and issue the report; compliance-automation tooling, including this product, is not the attestor. Last verified 10 September 2026. Not legal advice.
Stage by stage
Add the stages that apply to you. The ranges are labelled market observation because that is exactly what they are — not a quote, not a rule, and not a prediction about your organisation.
| Stage | Typical observed duration | What moves it | Kind of text |
|---|---|---|---|
| Scoping and system description | Days to a few weeks. | How clearly you can describe the boundary, and how many optional criteria categories a customer requires. | Attestation-standard requirement that a fair description exist; the duration is market observation. |
| Gap assessment | One to a few weeks. | Whether anyone has looked at the criteria before, and whether control owners are available. | Best practice — not required by any attestation standard. |
| Remediation | Weeks to several months, and this is the widest range on the page. | How many controls are missing rather than merely undocumented, and whether engineering capacity is allocated. | Market observation — the stage most commonly underestimated. |
| Selecting and engaging a CPA firm | Weeks, including proposals and scheduling. | Firm capacity, time of year, and how quickly you can answer their scoping questions. | Attestation-standard requirement that a practitioner be engaged; lead time is market observation. |
| Type I examination | Weeks after readiness, since there is no period to wait out. | Evidence quality on the specified date and fieldwork availability. | Attestation-standard requirement that the opinion address a point in time. |
| Type II observation period | Commonly three to twelve months; three or six is typical for a first report, twelve at renewal. | Buyer expectation and your firm's judgement. Nothing in the standards fixes a length. | Market observation — clearly labelled as observed practice, not a rule. |
| Fieldwork | Commonly a few weeks of effort across a somewhat longer calendar window. | Population completeness, responsiveness, and the number of criteria categories in scope. | Attestation-standard requirement for the procedures; duration is market observation. |
| Report drafting and issuance | Commonly a few weeks after fieldwork closes. | Draft review cycles, management responses to exceptions, and firm review processes. | Attestation-standard requirement that the firm issue the report; duration is market observation. |
Two worked examples
Illustrative, using the observed ranges above. Neither is a promise, and both assume nobody fabricates evidence to shorten a stage.
- A team with controls already running and evidence already captured, going straight to a three-month Type II: scoping and gap work in parallel with engaging a firm, then a three-month period, then fieldwork and drafting. Add the stages and the observed total lands in the range of roughly two quarters. Market observation, not a commitment.
- A team starting from nothing with a customer waiting: remediation dominates, and it is common for remediation plus a first observation period plus fieldwork and drafting to span most of a year. Market observation. This is the case where a Type I is worth considering as an interim artefact, if the buyer accepts one.
- In both cases the report is dated after the period closes, so the report never arrives on the day the period ends. Attestation-standard requirement in effect.
What actually causes slips
The stages rarely slip for interesting reasons. These are the recurring causes, all avoidable, all labelled honestly.
- Evidence that was not being captured while the period ran, discovered at fieldwork. Best practice fix: prove capture works in week one of the period.
- Populations that cannot be produced completely, forcing rework of testing already done. Attestation-standard requirement for completeness — this one is not negotiable.
- Remediation without engineering capacity allocated. Market observation: compliance work loses to roadmap work unless somebody protects the time.
- Scope that grew because an optional criteria category was added mid-stream to sound thorough. Trust Services Criteria reference — each added category adds criteria, evidence, and testing.
- A firm engaged too late, so the constraint becomes their calendar rather than your readiness. Market observation.
- Draft review and management responses treated as an afterthought, with leadership unavailable. SRM recommendation: book that time when fieldwork is booked.
Kinds of text on this page
Different sentences here carry different weight, and on this page the distinction matters most: every duration is observation, not rule.
| Kind of text | What it means | What it is not |
|---|---|---|
| Attestation-standard requirement | SSAE 18 — AT-C sections 105 and 205 — governs how the CPA firm plans, performs, and reports the examination. | Not a statute, and it binds the practitioner rather than you. It sets no deadlines for you. |
| Trust Services Criteria reference | A pointer to a criteria series (CC1–CC9 or an optional category) in TSP section 100. | Not the criterion text. The Trust Services Criteria are proprietary AICPA material; everything here is paraphrase. |
| Best practice | What experienced teams do to keep a timeline honest. | Not required by any attestation standard. Skipping it is not an exception. |
| Market observation | Every duration and range on this page — what engagements are commonly observed to take. | Not a rule, not a quote, not a guarantee, and not a prediction about YOUR engagement. |
| SRM recommendation | Something this product suggests doing. | Not a legal requirement, not an attestation requirement, and not an audit opinion. |
What to do now
Build the estimate from your own facts, then add the one number you do not control: your firm's lead time.
- Settle Type I or Type II first. Nothing else about the timeline is knowable until that is decided.
- Ask two or three licensed CPA firms for their current fieldwork lead time and report turnaround, in writing.
- Estimate remediation honestly by counting controls that are missing, not controls that are undocumented. The two cost very different amounts of time.
- Choose a period start date you can evidence from day one, and verify a week later that evidence is landing.
- Tell the customer the stages rather than a single date, and name the two stages you do not control: the period length and the firm's calendar.
- Do not compress the period by starting it before controls run. That produces exceptions, not speed.
- Book leadership time for draft review and management responses at the same moment you book fieldwork. SRM recommendation.
Checklist
A timeline-sanity list, labelled by kind of text. Not a schedule.
- Report type decided and written down? Attestation-standard requirement that the report state it.
- Observation period start and end agreed with the CPA firm? Attestation-standard requirement that the report state the period.
- Firm lead time and report turnaround captured in writing? Market observation — the constraint teams forget.
- Remediation sized by missing controls, with engineering capacity allocated? Best practice.
- Evidence capture proven working before the period opens? Best practice, and the top cause of slips.
- Criteria categories frozen, so scope does not grow mid-period? Trust Services Criteria reference.
- Customer told the stages rather than one date? SRM recommendation.
- Nobody expecting the report on the day the period closes? Attestation-standard requirement — the report follows the period.
Where this shows up in ShipReady Metrics
The bundled framework key soc2 is customer-visible, labelled against the 2017 Trust Services Criteria with the 2022 revised points of focus, with a starter control-set that is an illustrative readiness mapping to be tailored by a compliance owner.
If you already have a session: continuous evidence collection is the part of this product that touches timeline honestly. It does not shorten an observation period — that is a scoping decision between you and the CPA firm — but it does mean the period is evidenced when it closes rather than reconstructed under deadline, which is where slips actually happen. Evidence review with the met-verdict overlay lets a named human record judgement per control as you go instead of in a final scramble. Connector-sourced evidence — dependency, code-scanning, and secret-scanning ingest — accumulates with its own timestamps. ShipReady Passport and the auditor share token let a prospect see posture while the period runs, which is not a report.
Readiness in this product is not an attestation opinion, and no view in it predicts a report date. This product does not issue a SOC 2 report and does not replace a licensed CPA examination. There is no public SOC 2 demo URL.
Primary sources (last verified 10 September 2026)
Stage mechanics come from the AICPA sources below. Every duration is labelled market observation, because no authority publishes SOC 2 timelines as rules and we do not invent numbers to fill the gap.
AICPA attestation standards SSAE 18, AT-C section 105 and AT-C section 205, which establish that a Type II opinion addresses a period and that the practitioner reports after performing procedures. AICPA Trust Services Criteria, TSP section 100 — 2017 criteria with the 2022 revised points of focus, proprietary AICPA material cited by reference and paraphrased, never reproduced. AICPA SOC 2 guidance for service organisations. Observation-period lengths and lead times are attributed to common market practice, not to these sources. These are not a complete list, and none of them is legal advice.
The SOC 2 framework guide on this site is the education page under frameworks; this cluster does not reuse that slug. The SOC 2 versus ISO 27001 comparison on this site is live. A dedicated ISO 27001 docs cluster is not on this site yet — naming ISO 27001 in prose is not a link to it.