A Customer Asked for Your SOC 2 Report and You Do Not Have One

On 14 May 2026 the AICPA's peer review team published guidance in the Journal of Accountancy warning about SOC 2 engagements with unreasonable timelines and reports that look identical from one client to the next. It followed a February 2026 article in the same journal about vendors promising SOC 2 compliance "in mere weeks." If an enterprise buyer has just asked you for a report, those articles explain why a quick, confident, honest answer matters more than a fast, doubtful one.

What's affected

Founders and first security hires at software companies in the middle of a deal. The buyer's procurement form says "SOC 2 Type 2 report: yes or no" and you have no report.

Know the facts before you reply:

• A SOC 2 report is an attestation by a CPA firm, not a certification, and use of the report is generally restricted to specified parties.
• A Type 1 describes design at a point in time. A Type 2 adds operating effectiveness over a period.
• A report takes months. A CPA firm advises first-year companies starting from scratch to plan on 6 to 12 months for a Type 2 and 2 to 4 for a Type 1.

How to check if you're exposed

Ask four questions before you answer the buyer.

1. What does the contract or questionnaire actually require: a Type 2, a Type 1, or evidence of a security program? Ask, because the form may not be the whole requirement.
2. Is the requirement before signature, or before go-live, or at the first renewal? Linford and Company suggests customers put the first delivery date in the contract, which means it is negotiable.
3. How much of the security program exists today? Policies, access controls, change review, and incident handling are what a readiness assessment checks.
4. Can you describe your controls without a report? A completed security questionnaire and a short architecture summary often move a deal forward.

What to do now

1. Reply within a day. Silence reads as evasion.
2. Say what is true. If you have no report, say you do not. If you have started, say what stage you are at.
3. Offer what you can: a completed questionnaire, your security policies under NDA, a one page architecture overview, and a date for the engagement to begin. Some CPA firms will give a letter confirming an examination is underway with an estimated completion date.
4. Ask what the buyer will accept in the meantime, and whether a Type 1 first, followed by a Type 2, would satisfy them.
5. Do not promise a report date you do not control. The auditor sets fieldwork and issuance timing.

A reply you can adapt:

Thanks for the question. We do not yet have a SOC 2 report. We have
started the process and expect to begin a readiness assessment with a
CPA firm this quarter. In the meantime I can send our completed security
questionnaire, our information security policy, and an architecture
summary under NDA. Would a Type 1 report first, followed by a Type 2,
meet your requirement for this deal? I can confirm our target dates once
the engagement letter is signed.

How to avoid this trap

• Do not buy a report that promises speed above everything. The AICPA's own peer review guidance lists unreasonable timelines as a risk indicator, and a buyer who knows that will read your report with suspicion.
• Do not say "we are SOC 2 compliant." The February 2026 article notes that "compliance" is not a term used in SOC 2 examinations. Say "we are preparing for a SOC 2 examination."
• Do not send a policy document you do not follow. Auditors test practice, not paper.
• Keep a standing, current questionnaire answer set so the next request costs an hour.

Why it matters

Buyers are not asking for a report because it is fashionable. They are asking because a report is evidence about controls that someone independent checked. The honest reply, with a plan and a date, shows the control environment you are building. An inflated reply shows the opposite.

Try it yourself

Write the four sentences of your own reply: where you stand, what you can send today, what you are asking the buyer, and your next date. Then answer one real questionnaire from your pipeline and note which questions you could not answer with evidence.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Journal of Accountancy: AICPA guides peer reviewers to address SOC 2 risks (14 May 2026)
• Journal of Accountancy: Promises of fast and easy threaten SOC credibility (1 February 2026)
• Linford and Company: What Is SOC 2? (updated 13 October 2026)
• Linford and Company: Do you need a SOC report? How to ask
• Linford and Company: How long does a SOC examination take