SOC 2 Timeline Calculator

How long does a SOC 2 audit take?

There is no single answer — it depends almost entirely on how much is already in place. This calculator turns nine answers about your controls into three dated ranges: when a Type 1 could be ready, when a Type 1 report could be in hand, and when a Type 2 could be, then compares each against your customer's deadline.

How this calculator works

Five control areas carry a remediation cost in weeks: written policies, access reviews, vendor reviews, an incident response plan, and evidence collection. Each is answered yes, partial or no. A missing policy set counts six weeks and a partial one three; access reviews four and two; vendor reviews three and two; incident response three and two; evidence collection four and two.

Those weeks are not added up. Gaps get worked in parallel, so the estimate takes the single longest gap and adds half of everything else. Systems beyond a baseline of five add 0.4 weeks each, capped at eight weeks in total. Where nobody owns the programme, the whole remediation figure is multiplied by 1.4 and two more weeks are added, because unowned readiness work starts later and runs slower.

A floor of two weeks applies even when every answer is yes, since scoping, scheduling and pulling a point-in-time evidence set take that long regardless. The high end of every range is its low end multiplied by 1.4, plus one week. A Type 1 then adds two weeks of fieldwork and two weeks of report drafting; a Type 2 adds three and three.

A Type 2 also needs an observation window, and this is where most timelines go wrong. Three calendar months are added to the early end of the Type 2 range and six to the late end. That spread is not an error bar — the two ends are two different scoping decisions, a three-month window and a six-month one. Three months is what most auditors and buyers accept in practice; it is a convention rather than a figure published by the AICPA.

The observation clock starts the day controls are operating and evidence is being collected, not the day an auditor is engaged. Nothing before that day counts toward the window.

A customer deadline moves none of the dates. It is compared with the relevant range and reported as on track when it falls on or after the end of that range, tight when it falls inside it, and likely late when it falls before the range begins. That rule is deliberately unforgiving and has no tolerance either side.

Every constant here is a stated planning assumption drawn from practice, not a figure from a standard. None comes from the AICPA's attestation standards, from the trust services criteria, or from a published survey, and all of them are printed alongside the result so the arithmetic can be checked or argued with.

A worked example

A company being asked for a Type 2 with a deadline at the end of March, a named compliance owner in place, policies and incident response part-done, and no access or vendor reviews running. Run on 10 September 2026.

Access reviews are the longest single gap at four weeks; half of the remaining ten weeks is added, giving nine, and the four systems above the baseline add another 1.6 — 10.6 weeks to Type 1 readiness. The Type 2 range then carries the observation window on top. The customer's 31 March date misses the early end of that range by four days, and four days is enough to move the verdict from tight to likely late, because the comparison has no tolerance built into it.

Common questions

Where do these week counts come from?

From the practice of the auditors who built the calculator. Not one of them is drawn from the AICPA's attestation standards or from a published survey — no such survey exists, because SOC 2 reports are distributed under NDA and there is no public corpus to measure. The assumptions are printed next to the result so you can see exactly what was applied and disagree with it.

Why is the Type 2 range so wide?

Because its two ends assume different observation windows — three months at the early end, six at the late end. It is not a margin of error, so splitting the difference is the wrong reading. Decide which window you are planning for and use that end.

Does the observation window start when I sign with an auditor?

No. It starts the day your controls are operating and you are collecting evidence for them. Nothing before that day counts, which is why signing an engagement letter early does not move a Type 2 date forward on its own.

Does my customer deadline change the estimate?

Not at all. The deadline is compared against the estimated range and nothing more. The calculator does not compress the plan, model a rush engagement, or trade cost against time when a date is close.

Can it tell me whether I would pass?

No. It estimates when a report could realistically be in hand given what you said about your controls. It is a planning estimate, not an audit opinion, not a readiness assessment, and not a commitment on any auditor's calendar.