How Long Does SOC 1 Take?

The most-asked SOC 1 question has a two-part answer: the examination itself is weeks, but a Type 2’s observation period is months -- and you can’t skip it.

The short answer

Type 1: 4–12 weeks from scoping to signed report. Type 2: 8–14 months end to end for a first-timer -- 6–12 months of observation period plus 4–8 weeks of fieldwork and reporting. Readiness: 2–6 weeks before either.

Type 1 timeline

Scoping (1–2 weeks) + fieldwork (2–4 weeks, testing design at a point in time) + reporting and QA (2–4 weeks). Well-prepared teams with documented controls land near 4–6 weeks; first-timers building documentation as they go land near 8–12.

Type 2 timeline

Scoping (1–2 weeks) + readiness (2–6 weeks) + remediation (4–12 weeks) + observation period (6–12 months) + fieldwork (4–8 weeks) + reporting (2–4 weeks). The observation period dominates -- and it must start only when controls are stable, or exceptions (or a restart) follow.

What stretches timelines

• Evidence archaeology. Controls operated without artifacts; reconstruction takes longer than the examination.
• Scope creep. In-scope systems discovered mid-examination restart testing.
• Starting the observation period too early. The most expensive SOC 1 mistake -- unstable controls, exceptions, restarts.
• Subservice organization decisions made late. Carve-out vs inclusive changes the reliance story mid-stream.
• Key-person bottlenecks. One owner, one vacation, one stalled fieldwork.

How to compress it

Do readiness before the clock starts, assign evidence owners with backups, collect artifacts continuously (not at fieldwork), and keep scope tight. Clean evidence is the difference between 4-week and 12-week fieldwork. Full phase-by-phase timeline.

Questions