Start from the date your customer needs proof, then work backwards through the audit, the evidence window and the preparation. First confirm what the customer will accept: a signed report, a certificate, or a documented plan with controls evidence. The answer often changes the timeline more than any tool does.
Step 1: ask what the deadline really requires
Many deals say "SOC 2" or "ISO 27001" when the real need is assurance by a date. Ask the buyer:
- Will a report in progress, with a letter from the auditor, be enough for contract signature?
- Is a Type 1 acceptable, or do you need a Type 2?
- Can we answer a security questionnaire and share controls evidence now?
For wording while an audit is under way, see answering security questionnaires before your SOC 2 Type 1 arrives.
Step 2: list the fixed points
| Fixed point | Why it constrains you |
|---|---|
| Customer date | The end of your plan |
| Auditor or certification body availability | Fieldwork slots are limited, so book early |
| Observation window (SOC 2 Type 2) | Controls must operate over a period before the report |
| ISO Stage 1 and Stage 2 | Two stages, with time to fix findings between them |
| Your own holidays and releases | People are busy at known times |
You can compress preparation. You cannot compress a period during which controls must operate, and you should not compress independent testing. The Journal of Accountancy warns that unrealistic schedules can threaten quality and objectivity.
Step 3: work backwards
- Write the customer date at the right.
- Subtract the time the auditor needs to issue the report after fieldwork. Ask them for it.
- Subtract the fieldwork window.
- Subtract the observation window, if a Type 2.
- Subtract your preparation: scope, policies, system description, risk work, evidence setup.
- Compare with today. If the start date is already past, change the deliverable, not the maths.
Ask your auditor for each duration instead of guessing. Published ranges vary widely and depend on scope and readiness.
Step 4: pick the honest alternative if it does not fit
If the plan cannot meet the date, offer something true. A dated plan with the auditor's name, a completed readiness review, evidence of controls you operate today, and a clear statement that the report is in progress. Do not say you are compliant or certified before you are. See what you can promise in customer contracts.
Step 5: protect the plan
- Assign one owner for the project and one for each control area.
- Freeze large system changes that would alter scope during fieldwork.
- Collect evidence from day one, so you do not rebuild history later.
- Schedule a mock walkthrough before fieldwork starts.
Quick check
Can we shorten a SOC 2 Type 2 observation window to meet a date?
The window is set with your auditor and has to be long enough to support an opinion. Ask what they will accept and whether a Type 1 first would satisfy the buyer.
What if the customer will not move the date?
Offer controls evidence, a dated plan and a questionnaire response, and be accurate about status. Some deals will wait, some will not.
Safeguard's compliance and evidence automation can help gather evidence from the first day of your plan. The audit dates and report depend on your auditor.
Sources
- Journal of Accountancy, promises of fast and easy threaten SOC credibility
- Explainer on SOC 2 management assertions and AT-C section 205
Last reviewed: 19 October 2026.
