SOC 2 Type 2 renewal is a new examination period, not a new project. Keep the controls running, close last year's exceptions, refresh the risk assessment and system description, decide whether scope changes, and book the auditor early. Plan the next period to start where the last one ended so there is no gap.
Why does a Type 2 repeat?
A Type 2 report covers a period and includes tests of operating effectiveness. When the period ends, the report describes the past. Customers usually want a current one, so you examine a new period. The Trust Services Criteria do not set how often. Buyers and your own contracts do, so ask what your top customers expect.
What carries over, and what must be redone?
Carries over: policies (reviewed and re approved), the control set, the evidence habits, the tooling, and the relationship with the auditor.
Must be redone: evidence for the new period, because every sampled item must come from it. Also refreshed: the risk assessment (CC3.1 to CC3.4), vendor reviews (CC9.2), access reviews at the frequency you stated, training for the period, incident exercises and recovery tests where Availability is in scope.
How do you avoid a gap between periods?
A gap, where one report ends and the next period begins weeks later, leaves a stretch that no report covers. Customers notice. Agree the next period's start date with your auditor before the current one ends, and keep controls running without pause. Bridge letters, if buyers ask, are a matter between you, your auditor and the buyer, so ask the auditor what they can provide.
What should you do with last year's exceptions?
Open the exception list from the previous report. For each one, show the root cause, the fix, the date the fix went live and evidence that the fixed control operated since. If an exception repeats, the auditor will see a pattern, which weighs more than a single event. Our guide on handling control exceptions goes through the steps.
What about scope and system changes?
CC3.4 asks you to assess changes that could significantly affect the control system. During the year you probably added tools, customers, regions or categories. List them, update the system description, and confirm each new system has the same controls. If you plan to add Confidentiality or Privacy, start collecting evidence at the start of a period, not midway. Removing a system from scope needs a reason and a date.
How to run the year
Month 1 of the new period: kick off with the auditor, confirm scope, share the changes list.
Quarterly: access review, risk register update, vendor check, exception review, and a sampled self test of two or three high volume controls.
Month before period end: a full dry run with fresh sampling, a cleanup of missing evidence and a review of the system description.
After: hold a retrospective on what the auditor asked for that you could not find quickly, and fix that in tooling.
Mistakes to avoid
- Waiting until the report ends to start the next year's evidence.
- Policies that quietly say something different from practice after a year of changes.
- Rewriting the description from scratch instead of updating it.
- Forgetting new staff, new vendors and new systems added mid year.
- Bundling renewal with a big scope expansion at the same moment.
What to do
- Get the final report and make a list of every exception and recommendation.
- Agree the next period dates and the schedule with your auditor.
- Re approve policies and record the dates.
- Update the risk assessment and the system description with a changes list.
- Set a quarterly calendar of access reviews, vendor checks and self tests.
- Add alerts for controls that depend on a recurring date.
- Run the dry run one month before the period ends.
Quick check
Do we pay the same effort in year two?
Less if controls already run and evidence is collected as you go. We do not quote costs or hours, since they depend on your scope and auditor.
Can we switch auditors for year two?
Yes. Expect extra onboarding, and ask the new firm how they treat prior period information.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so the second year starts from evidence already collected from connected systems instead of screenshots, and monitoring runs between audits to catch a control that stops working. That saves the team time for other work. Technical evidence comes from your real code and dependencies, including scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies, but it is off by default, every category starts on Manual, and you choose which run automatically. Safeguard helps prepare evidence. The auditor performs the examination. See the framework mapping demo.
Sources
- AICPA, Trust Services Criteria (2017, with 2022 points of focus): CC3.1 to CC3.4 and CC9.2, paraphrased. The text confirms Type 2 reports cover a period with tests of operating effectiveness. It does not set a renewal frequency.
Last reviewed: 18 October 2026.
