The SOC 2 Type 2 observation period is the span of time the auditor tests your controls, and the AICPA criteria we read set no minimum length. You agree it with your auditor. Start it only when every in-scope control is designed, running and producing evidence, because a control that fails early becomes an exception.
Per the AICPA text, a Type 2 engagement covers the suitability of design and operating effectiveness of controls throughout a specified period, gives an opinion on operating effectiveness and includes a description of the tests and results. A Type 1 report covers a point in time and has neither. We read the 2017 Trust Services Criteria with 2022 points of focus on 18 October 2026.
How long should the period be?
The criteria text does not say. Auditors and customers have habits, and some customers state what they accept. Do not assume a number from a blog post. Ask your audit firm what period they will accept for a first report and ask your key customers what they expect. A shorter first period can be followed by a longer one in later years. We are not stating specific month counts because we could not source them.
When should you start?
Start when these are true:
- Scope and system description are agreed with the auditor.
- Policies are approved and acknowledged.
- Technical controls are configured, such as multi-factor authentication, logging, backups and branch protection.
- You have run the recurring controls at least once, such as an access review.
- A place exists for evidence, and each owner knows what to save.
A readiness check or a Type 1 can help prove this. Starting early to save calendar time often backfires, because early failures stay in the period.
What is tested?
The auditor tests the controls in your system description against the criteria you scoped. The usual approach, which you should confirm with your firm:
- Inquiry and walkthroughs to understand each control.
- Inspection of configuration at a date, such as settings and policies.
- Sampling of recurring controls across the period: changes, new hires, leavers, access reviews, incident tickets, backup runs.
- Re-performance or observation for some controls.
Sample sizes and rules are the auditor's call. Evidence must come from the period, so records created afterward do not count.
What counts as an exception?
A control that did not operate as described, for example a missed quarterly access review or a change merged with no approval. Exceptions are reported in the auditor's testing results, and their effect depends on their nature. Prevent them by tool enforcement and calendars, and document remediation when something slips.
What about changes during the period?
New systems, vendors or processes should be reflected in controls from the day they start. Tell your auditor about major changes, since the description of the system may need updating.
What to do
- Ask the auditor for period length, sampling approach and evidence format in writing.
- Run a readiness review, or a Type 1, before starting.
- Set a monthly check that lists what ran and what slipped.
- Automate evidence capture for recurring controls.
- Record any exception, the cause and the fix at once.
- Log system changes so the description of the system stays accurate.
Quick check
Is there a minimum observation period in the AICPA criteria?
The criteria text we read refers to a specified period and sets no minimum. Your auditor and customers set practical expectations.
Can I start the period before controls are ready?
You can, but failures in the early weeks count against you. Most teams do better starting when controls are running.
How Safeguard helps automate this
Staying clean for the whole period is the hard part, because controls have to run on schedule month after month. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously, so drift is flagged between audits instead of at fieldwork. That frees the team to focus on other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which run automatically. The independent auditor issues the report. Book a call to see it.
Open the framework mapping demo
Sources
- AICPA, 2017 Trust Services Criteria with revised points of focus (2022): report type descriptions, read from a local copy on 18 October 2026
Last reviewed: 18 October 2026.
