By Charles on Thursday, 23 January 2020
Category: SOC Reports

Q: How Often are SOC 2 Reports Required?

Q: How Often are SOC 2 Reports Required?

A: We’re often asked “how often are SOC 2 reports required” and the best way to answer this is by giving you a little background on SOC 2 reporting. Generally speaking, service organizations will undergo an annual SOC 2 audit report, usually beginning with a SOC 2 Type 1 in the initial year, then followed up by subsequent SOC 2 Type 2 reports thereafter. With that said, it’s fairly easy to assume that SOC 2 reports are required annually, which again, is the generally accepted practice.

Any SOC 2 report older than a year in terms of reporting is often known as a “stale” report, meaning the assessment of controls is historically dated, giving the report only marginal – if any – use and applicability by the intended user. Here’s an example of how this plays out in the world of SOC 2 reporting.

Here's an Example of How Often a SOC 2 Report is Required

Let’s say you are Software as a Service (SaaS) provider in need of a SOC 2 report for your growing client base. You then engage with an auditing firm to determine scope, pricing, and also the actual assessment period for the SOC 2 audit. If you’re new to the SOC 2 auditing process, you’ll probably start with a scoping & readiness assessment, followed by a SOC 2 Type 1 audit, then a SOC 2 Type 2 audit. Let’s assume the following dates: You completed your SOC 2 Type 1 on June 30, 2019, and you then moved forward with a SOC 2 Type 2 audit report for an assessment period that covered July 1, 2019 – December 31, 2019.

Your SOC 2 Type 2 report – in the eyes of intended users of the report – would feel comfortable relying on your report for both the assessed period (as listed above) and probably for up to 9 months after that period. Any longer, and they’ll want a new, fresh report. Who are the “intended” users? Auditors, clients, regulators, etc. Call and speak with CPA Christopher Nickell at 1-800-277-5415, ext. 706, or email Chris at This email address is being protected from spambots. You need JavaScript enabled to view it. today to learn more about SOC 2 reporting.

Best Practices for SOC 2 Auditing

Begin with a SOC 2 Scoping & Readiness Assessment: You’ll need to gain a strong understanding of various aspects of your SOC 2 audit as it pertains to scope. Specifically, what is the business process or business processes that are to be evaluated? What personnel will be involved in helping plan and execute the audit? What third-party providers and vendors are to be included in the scope of the audit? What gaps and deficiencies are found and how are they going to be remediated? These issues, and much more, are clearly identified when performing a SOC 2 scoping & readiness assessment.

As you can see, without performing a SOC 2 scoping & readiness assessment, you’re flying “blind” to a certain degree, which ultimately causes audit inefficiencies across the board. Talk to the experts today at NDB when it comes to SOC 2 audits.

Remediate Gaps in Operations and Security: Today’s SOC 2 reports are becoming quite technical in terms of information security and cybersecurity requirements. What this ultimately means is that a number of security tools and solutions will need to be in place, such as the following: File Integrity Monitoring (FIM), vulnerability scanning, anti-virus, and more. Many times, organizations find they are missing these tools, so sourcing, acquiring, and implementing them can take time, so keep this in mind. We can assist in helping with these issues. Call and speak with CPA Christopher Nickell at 1-800-277-5415, ext. 706, or email Chris at This email address is being protected from spambots. You need JavaScript enabled to view it. today.

Remediate Gaps in Terms of Documentation (Policies and Procedures): Documentation – specifically, information security policies and procedures – is a big part of SOC 2 compliance. You’ll need policies for a large number of InfoSec domains, such as access control, change control, configuration management, incident response, and much more. We can assist with writing your policies, or we can simply provide you with a robust set of policies and procedures that have been specifically developed for SOC 2 compliance. Call and speak with CPA Christopher Nickell at 1-800-277-5415, ext. 706, or email Chris at This email address is being protected from spambots. You need JavaScript enabled to view it. today to learn more about our policy writing services.
Also, be aware of the following: