Guide
The SOC 2 audit process, phase by phase
The SOC 2 audit process has five phases, and only the last two involve the CPA firm. So most of the timeline is preparation and operating controls, which is where you can save time.
- Preparation, not the examination
- A licensed CPA firm signs the report
- Plain-English guidance
The five phases of the SOC 2 audit process
Durations below come from typical first-time engagements.
| Phase | Type 1 | Type 2 |
|---|---|---|
| Readiness and gap analysis | 1 to 2 months. | 1 to 2 months. |
| Remediation | Usually folded in. | 2 to 6 months. |
| Watch period | None. | 3 to 6 months. |
| Fieldwork and reporting | 2 to 3 weeks. | 2 to 4 weeks. |
| Total | 1 to 3 months. | 6 to 12 months. |
What happens during fieldwork
The CPA firm requests evidence, interviews staff and tests samples. For example, it may ask for every production change in a month and pick a sample. Therefore organised evidence shortens fieldwork considerably.
SOC 2 audit process planning check
Tick what is decided.
Your result appears here as you tick, so you can see what is still open.
Where the SOC 2 audit process slows down
Delays usually come from missing evidence or scope changes. Also, waiting for a deal to close before starting is a classic mistake, because the watch period runs on the calendar.
- Evidence collected at the end instead of during
- Criteria added halfway through
- No internal owner
Choosing the CPA firm
Choose the firm early, because good firms book ahead. Also compare quotes carefully: the same scope might be quoted about $15,000 by a boutique, $35,000 by a mid-tier firm and $90,000 by a Big Four firm.
Our role in the SOC 2 audit process
We run readiness and remediation with you, then stay alongside during fieldwork. However, we never perform the examination, because we are not a CPA firm. Reference: AICPA guidance on SOC 2.
Organised evidence is the biggest time saver during fieldwork. For example, a shared folder per control, named by criteria, lets the CPA firm find what it needs without repeated requests. Also, agree a single point of contact on your side, so questions do not bounce between teams. Finally, keep a short log of requests and responses, because it shows progress and prevents duplicate work when the firm asks again.
SOC 2 audit process questions
How long is the SOC 2 audit process?
One to three months for Type 1 and six to twelve months for Type 2.
When does the CPA firm get involved?
Mainly at fieldwork, although choosing the firm early helps.
Can the SOC 2 audit process be sped up?
Readiness can, but the watch period cannot.
Who does most of the work?
Your team and your readiness consultant, before the CPA firm arrives.
Related guides
Plan your SOC 2 audit process now
Tell us your deadline. We reply with a written scope, a phase plan and a fixed preparation fee.
Scope your preparation