17COSO PRINCIPLES

SOC 1 (SSAE 18) · Timeline & Roadmap

SOC 1 Timeline: From Scoping to CPA-Attested Report

A phase-by-phase roadmap for achieving SOC 1 attestation under SSAE 18 (AT-C Section 320). Every milestone, team commitment, and common delay mapped out so you know exactly what to expect and when.

Type I lands in 2-4 months, while Type II takes 6-12 months including a 6-9 month observation window that cannot be compressed.

Get a SOC 1 Scoping Call SOC 1 Audit Preparation

2-4 moType I timeline

6-12 moType II timeline

100+SOC 1 engagements supported

AICPA SSAE 18 (AT-C 320) · ISAE 3402 internationally · Last reviewed June 2026

Timeline Overview

How Long Does SOC 1 Take?

The total engagement duration depends on whether you pursue a Type I (point-in-time) or Type II (period-of-time) report, and on the maturity of your existing ICFR controls.

Direct answer: A SOC 1 Type I report — a CPA attestation that your ICFR controls are suitably designed as of a specific date — typically takes 2-4 months from kickoff to final report. A SOC 1 Type II report — which additionally tests that controls operated effectively across a sustained observation period — typically takes 6-12 months total. The observation window (usually 6-9 months for a first engagement, 12 months for annual renewals) is fixed and cannot be compressed because the CPA must sample evidence across the entire period.

Key Takeaways

SOC 1 Type I (control design, point-in-time) completes in 2-4 months, while Type II (design and operating effectiveness) runs 6-12 months including a 6-9 month observation window.
The preparation phase (scoping, gap assessment, control design, implementation) runs 10-12 weeks regardless of report type. This is the phase where dedicated effort compresses the timeline.
The CPA must be an independent, licensed firm — Tranquility is your consultant and implementation partner. Book the CPA 6-8 weeks ahead to avoid scheduling delays.
SOC 1 reports are expected to be current within 12 months. Plan an annual Type II renewal cycle so user entities' auditors always have a current report to rely on.

Report Type	Total Duration	What It Covers
SOC 1 Type I	2-4 months	Point-in-time evaluation of ICFR control design. No observation period required. CPA tests design suitability as of a single date.
SOC 1 Type II	6-12 months	Design and operating effectiveness over a 6-12 month observation period. CPA samples evidence throughout the window to verify controls operated consistently.
Annual Renewal	Every 12 months	User entities' auditors expect a report dated within 12 months. Plan the next observation window 10-11 months after the prior report to avoid coverage gaps.

Type I vs Type II

Two Paths to CPA Attestation

Both paths share the same preparation phases. They diverge after pre-audit testing: Type I goes directly to the CPA audit, while Type II enters a multi-month observation period first.

Type I Path — 2-4 Months Total

Wk 1-2

Scoping

Wk 3-6

Gap Assessment

Wk 7-10

Implementation

Wk 11-12

Pre-Audit

Wk 13-16

CPA Audit & Report

Type II Path — 6-12 Months Total

Wk 1-2

Scoping

Wk 3-6

Gap Assessment

Wk 7-10

Implementation

Wk 11-12

Pre-Audit

Month 4-10

Observation Period (6-9 months)

Controls must operate consistently. Evidence collected throughout. This window cannot be compressed.

Month 11-12

CPA Audit & Report

Shared preparation phasesType II observation periodCPA audit & report delivery

Phase-by-Phase Roadmap

7-Phase SOC 1 Implementation Roadmap

Each phase includes activities, deliverables, milestones, and the expected time commitment from your team. Phases 1-4 are shared between Type I and Type II. Phases 5A/5B and 6 diverge based on the report type.

Phase 1: Initial Consultation & Scoping
Week 1-22 weeks8-12 hours total01
Milestone: Signed scope document and engagement letter
Key Activities
- Identify services that materially affect client financial statements
- Define the system boundary (applications, databases, infrastructure)
- Select control objectives aligned to your specific service scope
- Determine Type I or Type II path based on client requirements
- Engage CPA firm early (book 6-8 weeks ahead to avoid scheduling conflicts)
Deliverables
- SOC 1 scope document with control objective matrix
- Service-to-financial-impact mapping
- CPA firm engagement letter
- Project RACI and communication plan
Phase 2: Gap Assessment & Control Design
Week 3-64 weeks6-10 hours per week02
Milestone: Completed gap analysis report and remediation plan
Key Activities
- Evaluate existing ICFR controls against SSAE 18 requirements
- Map current processes to each control objective
- Identify missing controls and design new ones
- Review segregation of duties across financial systems
- Assess subservice organization dependencies and carve-out vs. inclusive treatment
- Document complementary user entity controls (CUECs)
Deliverables
- Gap analysis report with severity ratings
- Control description narratives for each objective
- Remediation roadmap with owners and deadlines
- CUEC documentation for user entities
Phase 3: Implementation & Remediation
Week 7-104 weeks8-15 hours per week03
Milestone: All controls implemented and operating
Key Activities
- Implement designed controls (access reviews, approval workflows, reconciliations)
- Configure segregation of duties in financial applications
- Establish evidence collection procedures for each control
- Train staff on new control procedures and documentation requirements
- Collect initial evidence demonstrating controls are operating
- Conduct tabletop walkthroughs with process owners
Deliverables
- Implemented controls with documented procedures
- Evidence collection templates and schedules
- Staff training records
- Initial control evidence samples
Phase 4: Pre-Audit Testing
Week 11-122 weeks10-15 hours per week04
Milestone: Clean internal test results, ready for CPA engagement
Key Activities
- Execute internal testing of all in-scope controls
- Verify evidence completeness for every control objective
- Close residual gaps identified during internal testing
- Conduct management review of system description
- Prepare evidence binder organized by control objective
- Brief CPA team on scope, controls, and evidence repository
Deliverables
- Internal test results with remediation notes
- Organized evidence binder / repository
- Draft system description (Section III of the report)
- Management assertion letter
Phase 5A: CPA Audit & Report (Type I Path)
Week 13-163-4 weeks4-8 hours per week05
Milestone: CPA-attested SOC 1 Type I report delivered
Key Activities
- CPA conducts walkthroughs of control descriptions
- CPA inspects control design documentation
- CPA tests whether controls are suitably designed as of the report date
- Respond to CPA inquiries and provide additional evidence as needed
- Review and comment on draft SOC 1 Type I report
- Receive final CPA-attested report
Deliverables
- CPA-attested SOC 1 Type I report
- Management assertion letter (included in report)
- CPA opinion on control design suitability
- Post-audit remediation notes (if any)
Phase 5B: Observation Period (Type II Path)
Month 4-106-9 months3-6 hours per week (steady-state)06
Milestone: Full observation period evidence collected across all controls
Key Activities
- Operate all in-scope controls consistently throughout the observation window
- Collect and archive evidence on the agreed schedule (daily/weekly/monthly/quarterly)
- Conduct quarterly user access reviews with documented approvals
- Perform periodic reconciliations and exception reviews
- Document all incidents, exceptions, and compensating controls
- Maintain change management records for all financial system modifications
Deliverables
- Control evidence for every period within the observation window
- Quarterly access review reports
- Reconciliation and exception logs
- Change management records
- Incident response documentation
Phase 6: CPA Audit & Report (Type II)
Month 11-123-5 weeks6-10 hours per week07
Milestone: CPA-attested SOC 1 Type II report delivered
Key Activities
- CPA selects control evidence samples across the observation period
- CPA performs testing of operating effectiveness (10-25 samples per control)
- CPA interviews key personnel and conducts walkthroughs
- Respond to CPA testing inquiries and remediate any findings
- Review draft SOC 1 Type II report including test results
- Receive final CPA-attested report ready for distribution to user entities
Deliverables
- CPA-attested SOC 1 Type II report with test results
- Management assertion letter (included in report)
- CPA opinion on design and operating effectiveness
- Documented remediation of any identified exceptions

Scheduling Intelligence

What Runs in Parallel vs Sequential

Understanding which workstreams can overlap and which must complete before the next begins is the difference between a 3-month and a 5-month preparation phase.

Runs in Parallel

CPA firm engagement and gap assessment
Staff training and evidence template preparation
Subservice organization SOC report requests and internal control documentation
CUEC documentation and control implementation
Monthly evidence collection and quarterly access reviews (during observation)

Must Be Sequential

Scoping must complete before gap assessment begins
Gap assessment must complete before control design is finalized
Controls must be fully implemented before the Type II observation period starts
The full observation period must complete before the CPA can sample evidence
CPA testing must complete before the report is issued

Resource Planning

Team Time Commitment by Phase

Estimated hours per role, per phase. Tranquility handles documentation, evidence organization, and CPA coordination — these figures represent your team's remaining commitment.

Phase	Weeks	Leadership	IT / Ops	Finance	Notes
Scoping & Consultation	Week 1-2	4-6 hrs	4-6 hrs	2-4 hrs	Leadership defines scope, IT maps systems, and Finance confirms ICFR relevance
Gap Assessment	Week 3-6	2-3/wk hrs	4-6/wk hrs	3-5/wk hrs	Heaviest for IT/Finance as current controls are documented and evaluated
Implementation	Week 7-10	1-2/wk hrs	6-10/wk hrs	4-6/wk hrs	IT implements technical controls, while Finance implements process controls
Pre-Audit Testing	Week 11-12	3-5/wk hrs	4-8/wk hrs	4-6/wk hrs	All teams validate controls and prepare evidence for the CPA
Observation (Type II)	Month 4-10	1-2/wk hrs	2-3/wk hrs	2-3/wk hrs	Steady-state evidence collection and periodic reviews
CPA Audit	Final 3-5 weeks	2-4/wk hrs	3-6/wk hrs	3-5/wk hrs	Responding to CPA inquiries and providing evidence samples

Hours shown are estimates based on organizations with 50-500 employees. Larger organizations or those with multiple financial systems in scope may require additional time. For a detailed resource plan tailored to your organization, see our SOC 1 cost guide.

From the Audit Floor

Common Timeline Delays & How to Avoid Them

Based on 100+ SOC 1 engagements, these six issues account for the majority of schedule overruns. Each is preventable with early planning.

Undocumented Controls

Adds 2-4 weeks

Controls exist in practice but lack written procedures, flowcharts, or evidence trails. The CPA cannot test what is not documented, so the entire gap assessment and implementation phase must be extended.

How to avoid it: Start documenting control procedures during scoping. Assign a documentation owner per control objective and use standardized templates from day one.

Segregation of Duties Redesign

Adds 4-6 weeks

Auditors discover that the same individual can initiate and approve financial transactions. Redesigning role-based access in ERP or financial systems requires application changes, testing, and retraining.

How to avoid it: Run a segregation of duties analysis in Week 3 of the gap assessment. If conflicts exist, begin the access redesign immediately rather than waiting for the CPA to flag it.

Subservice Organization Coordination

Adds 2-8 weeks

When your service depends on a third-party provider (cloud hosting, payment processor, data center), you need their SOC report or must agree on a carve-out vs. inclusive approach. Delays in getting their cooperation or report stall your entire engagement.

How to avoid it: Identify all subservice organizations during scoping (Week 1-2). Request their SOC reports immediately and confirm the carve-out/inclusive decision before the gap assessment begins.

CPA Scheduling Conflicts

Adds 4-8 weeks

CPA firms have peak busy seasons (January-April for annual audits, September-November for year-end planning). Engaging a CPA firm late means waiting for an available slot, potentially pushing the entire engagement by two months.

How to avoid it: Book the CPA firm during Phase 1 (Week 1-2), at least 6-8 weeks before the planned audit start. Preferred CPA firms fill their SOC 1 calendar 2-3 months ahead.

Evidence Gaps During Observation

Adds 1-3 months (Type II)

A control operated correctly but evidence was not captured or archived. The CPA cannot confirm operating effectiveness without evidence, potentially requiring the observation window to be extended to collect a fresh sample.

How to avoid it: Establish automated evidence collection from the start of the observation period. Conduct monthly evidence completeness reviews rather than discovering gaps during the CPA audit.

Scope Creep From Client Auditors

Adds 2-4 weeks

User entities' auditors request additional control objectives mid-engagement after reviewing the initial scope. This forces rework of the gap assessment, new control design, and additional evidence collection.

How to avoid it: Share the draft scope with your largest user entities' auditors during Phase 1 for early feedback. Confirm in writing that the proposed control objectives cover their ICFR reliance needs.

Year-Round Cycle

Annual Renewal Timeline

After the first SOC 1 report is issued, maintaining continuous coverage requires a disciplined annual cycle. Here is the 12-month cadence we follow with our clients.

Month 1-2 post-reportDistribute SOC 1 report to user entities and their auditors
Month 3-4Conduct annual control self-assessment, and update control descriptions for any process changes
Month 5-6Remediate any findings from the prior audit, and implement control improvements
Month 7-8Mid-year evidence review to confirm collection is on track for all controls
Month 9-10Pre-audit readiness check: organize evidence binder, confirm CPA availability
Month 11-12CPA conducts annual Type II audit. New report issued, continuing 12-month coverage

Why continuous coverage matters

User entities' external auditors need a SOC 1 report dated within 12 months of their own audit period. A gap in coverage means auditors cannot place reliance on your controls for that period, potentially requiring them to perform their own testing at your site — an expensive and time-consuming process for everyone involved. Maintaining a continuous annual cycle eliminates this risk.

SOC 1 Audit Preparation

Deep dive into the preparation phase: what evidence the CPA expects, how to structure your evidence binder, and pre-audit readiness checklists.

Read guide

SOC 1 Cost Guide

Transparent breakdown of SOC 1 costs: consulting fees, CPA audit fees, and factors that affect pricing for Type I vs Type II engagements.

Read guide

SOC 1 Type I vs Type II

Detailed comparison of Type I and Type II reports: when each is appropriate, what auditors test differently, and how to choose the right path.

Read comparison

Proof

In their words.

Quotes verbatim from G2. Company names added where the client confirmed them.

Verify on G2

They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.

Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026

Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.

Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026

The team’s willingness to work with us and ease of communication.

sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026

They delivered the project with speed, accuracy, and cost-effectiveness.

Maneet P.Mid-MarketSOC 2 · August 2026

My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.

Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026

They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.

Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026

Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.

Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026

Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.

Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026

The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.

Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026

What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.

Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026

Frequently Asked Questions

Common questions about SOC 1 timelines, observation periods, CPA coordination, and annual renewals.

How long does a SOC 1 Type I report take from start to finish?

A SOC 1 Type I report typically takes 2-4 months from initial scoping to CPA-attested report delivery. This includes 2 weeks for scoping, 4 weeks for gap assessment and control design, 4 weeks for implementation and remediation, 2 weeks for pre-audit testing, and 3-4 weeks for the CPA audit itself. Organizations with mature, well-documented controls can sometimes complete it in as little as 8 weeks.

How long does a SOC 1 Type II report take?

SOC 1 Type II typically takes 6-12 months end to end. The first 10-12 weeks follow the same preparation track as Type I (scoping, gap assessment, implementation, pre-audit testing). Then, a 6-9 month observation period begins during which the CPA requires evidence that controls operated effectively throughout the window. The final CPA audit runs 3-5 weeks after the observation period closes. Total elapsed time depends primarily on the observation window length.

Can we skip Type I and go straight to Type II?

Yes, many organizations skip Type I and proceed directly to Type II. However, Type I serves a useful purpose: it validates your control design before you commit to a 6-12 month observation period. If the CPA identifies design flaws during a Type I, you can fix them before observation begins. Going straight to Type II risks discovering design issues months into the observation window, potentially requiring a restart. Organizations with strong existing controls or prior SOC experience often go directly to Type II.

What is the observation period and can it be shortened?

The observation period is the window during which your controls must operate effectively for the CPA to test. For a first SOC 1 Type II, this window typically runs 6-9 months. For annual renewals, it runs a full 12 months to maintain continuous coverage. The observation period cannot be compressed or shortened because its purpose is to demonstrate that controls operated consistently over time, not just at a single point. You can, however, overlap the observation period with the preparation for the CPA audit to minimize total elapsed time.

When should we book the CPA firm?

Book the CPA firm during Phase 1 (Week 1-2 of the engagement), at least 6-8 weeks before the planned audit start date. CPA firms that specialize in SOC reports have limited capacity, particularly during their busy seasons (January-April and September-November). Engaging late is one of the most common causes of timeline delays. We coordinate CPA selection as part of our scoping engagement and maintain relationships with pre-vetted, independent CPA firms.

How much time will our internal team need to commit?

Team commitment varies by phase. During scoping and gap assessment (Weeks 1-6), expect 6-10 hours per week across leadership, IT, and finance teams. During implementation (Weeks 7-10), IT and finance teams may spend 8-15 hours per week. During the Type II observation period, steady-state effort drops to 3-6 hours per week for evidence collection. During the CPA audit, expect 6-10 hours per week for 3-5 weeks. Tranquility handles the heavy lifting on documentation, evidence organization, and CPA coordination to minimize internal burden.

What happens if the CPA finds exceptions during the audit?

SOC 1 is not pass/fail. If controls did not operate as described, the CPA documents exceptions in the report and may issue a qualified opinion. Minor exceptions (e.g., one missed quarterly access review out of four) are common and generally acceptable to user entities' auditors. Material exceptions affecting multiple controls or entire control objectives can result in a qualified or adverse opinion, which may require remediation and, for Type II, extending the observation window. Our pre-audit testing phase is designed to catch and remediate issues before the CPA audit begins.

How does the SOC 1 timeline differ from SOC 2?

The preparation phases are similar in structure, but SOC 1 scoping is driven by ICFR relevance (which services affect client financial statements) rather than Trust Service Criteria. SOC 1 control objectives are custom to your service scope, while SOC 2 uses the standard TSC framework. The observation period mechanics are the same for both Type II reports. Organizations pursuing both SOC 1 and SOC 2 simultaneously can overlap approximately 40-60% of the preparation work where controls are shared (access management, change management, vendor oversight).

Is Tranquility the CPA that signs the SOC 1 report?

No. Tranquility Cybersecurity acts as your readiness consultant and implementation partner. SSAE 18 requires that the SOC 1 attestation be performed by an independent, licensed CPA firm. We prepare your controls, documentation, and evidence, then coordinate the audit with a pre-vetted CPA firm from our network. This two-party structure preserves the auditor independence required by AICPA professional standards and ensures your report carries the credibility that user entities' auditors expect.

How often do we need to renew the SOC 1 report?

SOC 1 reports are expected to be dated within the last 12 months. User entities' auditors need a current report to place reliance on your controls during their financial statement audit. Most organizations maintain a continuous annual Type II cycle: the new observation period begins shortly after the prior report is issued, ensuring there is no gap in coverage. We maintain your controls year-round so the annual renewal is a natural continuation rather than a scramble.

Keep Exploring

SOC 1 Timeline: From Scoping to CPA-Attested Report

How Long Does SOC 1 Take?

Key Takeaways

Two Paths to CPA Attestation

Type I Path — 2-4 Months Total

Scoping

Gap Assessment

Implementation

Pre-Audit

CPA Audit & Report

Type II Path — 6-12 Months Total

Scoping

Gap Assessment

Implementation

Pre-Audit

Observation Period (6-9 months)

CPA Audit & Report

7-Phase SOC 1 Implementation Roadmap

Phase 1: Initial Consultation & Scoping

Phase 2: Gap Assessment & Control Design

Phase 3: Implementation & Remediation

Phase 4: Pre-Audit Testing

Phase 5A: CPA Audit & Report (Type I Path)

Phase 5B: Observation Period (Type II Path)

Phase 6: CPA Audit & Report (Type II)

What Runs in Parallel vs Sequential

Runs in Parallel

Must Be Sequential

Team Time Commitment by Phase

Common Timeline Delays & How to Avoid Them

Undocumented Controls

Segregation of Duties Redesign

Subservice Organization Coordination

CPA Scheduling Conflicts

Evidence Gaps During Observation

Scope Creep From Client Auditors

Annual Renewal Timeline

Why continuous coverage matters

SOC 1 Audit Preparation

SOC 1 Cost Guide

SOC 1 Type I vs Type II

In their words.

Frequently Asked Questions

Related Reading

SOC 1 Knowledge Hub

Who Needs a SOC 1 Report?

Types of SOC Reports

SOC 1 vs SOC 2

SOC 1 Cost Guide

SOC 1 Timeline

Written By Expert Auditors

Get in touch

Send us your requirement.

Go deeper.

AT-C 320, Explained

SOC 1 Bridge Letters

SOC 1 Description Criteria

SSAE 18 vs SSAE 21

SOC 1 vs SOC 2 vs SOC 3

CUECs & CSOCs Explained