SOC 2 deadline back-calculator
A customer has named a date. This works backwards from it through readiness, the observation window and the auditor's fieldwork, and tells you which report can exist by then and which cannot.
Most SOC 2 projects start with a date somebody else chose. The question is not how fast an auditor can work. It is whether the observation window fits between today and that date. The window is the one part of a Type 2 nobody can compress or backdate.
Answer six questions and the answer appears on this page. Nothing is sent anywhere unless you ask for it at the end.
On its way
Check your inbox shortly. If you would rather talk the date through, book a time.
The model this uses
Every number below is a range that Canadian engagements commonly land in. The calculation adds the readiness estimate to the shortest useful observation window, then adds the auditor's fieldwork and reporting time, and compares the result with your date.
| Stage | Fast | Slow | What decides it |
|---|---|---|---|
| Readiness from nothing | 12 | 22 | Policies, access reviews, logging and vendor management from a standing start |
| Readiness from partial | 7 | 14 | How much of the control set survives a mapping exercise |
| Readiness from running controls | 3 | 7 | Mostly evidence discipline and writing the system description |
| Observation window | 13 | 13 | Three months is the shortest window most buyers accept |
| Fieldwork and report issue | 5 | 10 | How fast you return evidence requests, and the firm's review queue |
| Type 1 fieldwork and report | 3 | 7 | Point in time, so no window and far less sampling |
| Type 2 from a standing start, total | 30 | 45 | Roughly seven to eleven months |
Two adjustments. A consultant running readiness cuts roughly a quarter off the readiness estimate, because the bottleneck moves from knowing what to do to having time to do it. Somebody doing it around another job adds roughly a third. Neither changes the window.
Why the window cannot be shortened
A Type 2 opinion covers a stated period and says the controls operated throughout it. There is no version of that sentence an auditor can write about a period that has not happened. Three months is the shortest window most buyers treat as meaningful, and some enterprise reviewers insist on six or twelve.
A period that has already elapsed is the one real shortcut, and it is narrower than it sounds. If your controls genuinely operated for the last three months and you kept dated evidence for all of them, some firms will examine that period rather than a future one. Most will want to see the evidence before they agree, and a firm that agrees without looking is not being careful. This calculator credits retained history up to three months and flags it as conditional.
What to tell the customer when the date does not work
Say it early and say it with a date attached. A buyer who hears in week one that a Type 2 lands in November, with a Type 1 in April and an engagement letter this month, will usually accept the sequence. The same buyer told in October that the report is not coming treats it as a failure to deliver.
- Confirm in writing which report they need and which Trust Services Criteria. A quarter of these deadlines soften once the question is asked.
- Offer the Type 1 as the thing that arrives on their date, with the Type 2 period already running underneath it.
- Send the signed audit engagement letter as evidence the work is real. It is not a report and reviewers know that, and it is still worth more than a promise.
- Where the gap is short, ask whether a security questionnaire plus a penetration test summary covers the risk until the report exists.
Common questions
Can we get a SOC 2 Type 2 in six weeks?
No. A Type 2 covers an observation period of at least three months, and the auditor needs several more weeks after the period ends to test evidence and issue the report. Anybody offering a Type 2 in six weeks is describing a Type 1, a readiness report, or something that is not a SOC 2 at all.
Can the observation window start in the past?
Sometimes. If the controls really were operating and you retained dated evidence, an audit firm can examine a period that has already elapsed. It is the firm's call, it depends entirely on the evidence surviving a look, and it is not something to build a customer commitment on before an auditor has confirmed it.
Will a Type 1 satisfy a customer who asked for a Type 2?
Often, once, with a dated commitment to the Type 2 attached. It is worth asking directly rather than assuming either way, because the answer comes from the buyer's security team rather than the person you are selling to. The Type 1 or Type 2 decider works through when the two-step is worth the extra fee.
Does a compliance platform make this faster?
It shortens readiness and evidence collection, and it does nothing to the window. A platform bought today cannot produce three months of history it was not running for. That is the single most common misunderstanding about what these tools do.
Get the date priced by firms that can meet it
Send your scope and your deadline to Canadian CPA firms and find out who has capacity.
Get matched