SOC 2 by a date that is not possible

The observation window is calendar time. If the date is under eight weeks away, no auditor signs anything by it, and the only useful move is to say so this week rather than in month three.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

If your customer has named a date less than eight weeks away, no SOC 2 report of any kind can exist by it. A Type 1 needs roughly eight to sixteen weeks from a standing start. A Type 2 needs the shortest useful observation window, three months, plus preparation before it and four to eight weeks of fieldwork after it, so five to seven months at the very fastest and six to nine from nothing. Money does not compress the window. It is a period in which your controls have to have operated, and there is nothing to buy.

What fits in the time you have

The deadline back-calculator works backwards through fieldwork, the window and preparation, and names the report that cannot exist. The month-by-month version is the SOC 2 timeline.

What compresses and what does not

Preparation, compressible

Two to four months becomes six weeks with money and focus, at consultant rates of $15,000 to $60,000 CAD. This is the only phase where spending buys speed.

The observation window, not compressible

Three months is the shortest most auditors will opine on and most buyers will accept. A shorter window produces a report that reviewers question, so you have spent the fee and kept the objection.

Fieldwork, slightly compressible

Four to eight weeks. It shortens when your evidence is complete and your owner answers questions in a day, and it stretches when populations are incomplete. The request list is what arrives.

Auditor capacity, not yours to control

Canadian CPA firms book fieldwork weeks or months ahead, and the quarter end is the worst time to ask. Engage the auditor early even though fieldwork is late. The slot is the constraint.

How to reset the date, once

You get one clean reset. A date that moves twice ends the conversation. The buyer's approver already spent credibility on the first exception.

1. Work out the real date before you send anything. Count backwards: report delivery, four to eight weeks of fieldwork, three months of window, six to twelve weeks of preparation. Add nothing for optimism.
2. Say the current date is not achievable in the first line, and say why in one sentence about the observation window. Buyers who work in security understand this. The ones who do not will ask their security team, who will confirm it.
3. Offer the interim package in the same message rather than a later one. A completed questionnaire, a penetration test summary and a written control description close more vendor assessments than founders expect. The list is on what to offer instead.
4. Ask about their exception path directly. Most vendor risk policies have one with a named approver and an expiry date, and that is the mechanism that onboards a mid-audit vendor.
5. Put the new date in the contract with the report type and the window dates named, not in an email. A commitment with dates is what their approver can sign.

Three shortcuts that make it worse

• Backdating the window. Claiming a window in which the controls did not yet exist is the one failure mode that is not recoverable. The auditor tests evidence with dates in it, and the fix is a new window and another three months.
• A one month window. Some auditors will do it. Buyers read the period and ask why. You have paid a full fee to keep the objection you were trying to remove.
• Promising a date you have not tested. The second slip is the one that costs the account. Test the date against fieldwork capacity with the actual firm before you commit it in writing.

What to do with the weeks you do have

Whatever the date turns out to be, the work is the same. Start the long-lead items immediately, since they consume calendar rather than effort: log retention configured and retaining, single sign-on rolled out, annual security training delivered, the penetration test booked, and background screening policy written. Everything else can be done in parallel later. The order is on the preparation guide. If the constraint is money rather than time, preparing with no compliance budget covers how far you can get before spending anything.