How long does a SOC 1 examination take?
A realistic end-to-end range for a first SOC 1 Type 2: 8–14 months including the observation period. A first Type 1: 4–12 weeks. Here’s where the time goes -- and how to compress it.
A first SOC 1 Type 2 realistically takes 8 to 14 months end to end: 2–4 weeks of scoping and CPA firm selection, 2–6 weeks of readiness, 4–12 weeks of remediation, a 6–12 month observation period, then 4–8 weeks of fieldwork and reporting. A Type 1 skips the observation period: 4–12 weeks all in.
- Confirm report type & select CPA firm -- 2–4 weeks
Confirm what your customers will accept (Type 1 vs Type 2) in writing. Get 2–3 scoped quotes; the statement of work defines everything downstream. - Scoping -- 1–2 weeks
The CPA firm maps your system: services, control objectives, in-scope applications and locations, subservice organizations. Scoping errors discovered later restart testing -- get this right. - Readiness assessment (recommended for first-timers) -- 2–6 weeks
A dry run against your control objectives produces your remediation list. Skip only if you’ve passed before in the same environment. - Remediation -- 4–12 weeks
Fix the gaps: logical access reviews, change management, reconciliations, incident response, vendor controls. This is the phase most companies underestimate. - Type 2 observation period -- 6–12 months
Your controls must operate effectively throughout the period. Start it only when controls are stable -- restarting the clock is the most expensive delay in SOC 1. - Fieldwork -- 4–8 weeks
The CPA firm tests controls, reviews evidence, interviews staff, and samples transactions across the period. Clean evidence = the short end of this range. - Reporting & QA -- 2–4 weeks
The firm writes the SOC 1 report, it goes through internal QA, then you get the signed report to distribute to customers.
What causes delays
- Scope creep mid-examination. New in-scope systems found during fieldwork restart testing on those areas.
- Evidence archaeology. Controls operated but nobody kept artifacts. Reconstructing evidence takes longer than the examination itself.
- Starting the observation period too early. Unstable controls during the period produce exceptions -- or force a restart of the clock.
- Key-person bottleneck. One engineer owns all evidence and goes on vacation during fieldwork. Assign a backup.
- Subservice organization surprises. Carve-out vs inclusive decisions made late change the report’s reliance story.
Beware the too-fast promise: anyone selling a credible first SOC 1 Type 2 without an observation period is selling something that isn’t a Type 2.
Fastest realistic path
Already operating with strong, documented controls? Scoping (1 week) + 4-week Type 1 fieldwork + 2-week reporting ≈ 7–8 weeks to a signed Type 1 report. Starting from scratch toward a Type 2? Plan for 8+ months minimum.
After year one
Renewal examinations reuse your scoping and evidence habits -- most programs settle into an annual rhythm with the fieldwork window as the main active effort. See the SOC 1 readiness checklist for keeping year-two scope tight.
Timeline questions
Can I shorten the examination timeline?
Somewhat. The fieldwork window (4–12 weeks for a Type 1 or for Type 2 fieldwork) is driven by your evidence readiness -- companies with clean artifacts, assigned owners, and pre-organized evidence routinely land at the short end. Remediation, not the CPA firm, is what stretches timelines. The Type 2 observation period itself (6–12 months) can’t be compressed.
Do I need a readiness assessment first?
Not always, but first-timers usually benefit. A readiness assessment finds the failures before the examination team does, when they’re cheaper to fix. If you’ve passed before with the same control environment, you can often go straight to the examination.
What slows SOC 1 examinations down most?
Scoping surprises and evidence archaeology. Discovering in-scope systems mid-examination restarts testing on those areas; controls that operated without artifacts take longer to evidence than the examination itself. And starting the Type 2 observation period before controls are stable can force a re-start.
Start the clock
Tell us your deadline -- we’ll match you with CPA firms who can hit it.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.