Your Second SOC 2:
What Changes in Year Two

In year two the work stops being about building controls and starts being about proving they ran. The examination is structurally identical — a fresh attestation under AT-C 105 and AT-C 205, covering a new period and standing on its own — but the effort profile inverts, the period typically lengthens from three months to twelve, the description must now disclose significant changes, and the auditor arrives already knowing where you failed last time. There is no SOC 2 renewal in the sense the word implies elsewhere. Nothing is renewed because nothing expired: a SOC 2 is an attestation, not a certification, and there is no certificate to revalidate. Year two is a second, complete examination of a second, complete period. The prior opinion does not carry forward, the prior firm’s work does not transfer, and no credit accrues for having passed once. What does carry forward is your control set, your description, your exceptions and — for better or worse — the habits your team formed in the first cycle.

Notice what the second row buys. The Report 1 exception was remediated on 20 May 2026 and the redesigned control began operating on 1 June 2026 — both inside the second period, so by the time Report 2 closes the replacement has eleven months of operating history behind it. Sequencing decides how much evidence your remediation has accumulated by the time anyone asks.

Nothing in the AICPA’s standards requires consecutive periods to touch, and nothing prohibits a gap. Abutment is market practice, and it exists because a gap is permanently uncloseable: if Report 1 ends 30 April and Report 2 starts 1 July, May and June are never examined by anyone. The only instrument that speaks to the interval is a bridge letter, which is management’s own statement and carries no auditor assurance.

The implementation guidance is unusually concrete: changes to the services provided; significant changes to IT and security personnel; significant changes to system processes, IT architecture and applications, including those used by subservice organizations; changes to legal and regulatory requirements; and organizational-structure changes that alter internal control over the system, such as a change of legal entity. Disclosure should include the date and how the system differed before and after. Where nothing significant changed, the description may say so explicitly — and saying so deliberately beats saying nothing. The Trust Services Criteria attack the same problem from the control side: CC3.4 requires the entity to identify and assess changes that could significantly impact the system of internal control, and CC8.1 governs how changes to infrastructure, data, software and procedures are authorized, tested, approved and implemented.

One part of the description gets read differently from all the rest, and it is not the architecture narrative. Complementary user entity controls — the things your description says your customers must do for the controls to work — are what a mapped customer actually diffs between consecutive reports, because every CUEC is an obligation sitting on their side of the line. Their auditors notice the delta too, since a CUEC dropped from your report may be a control they stopped performing on your say-so, and a CUEC added is one they have never performed at all. Treat the CUEC set as a versioned artifact: know what changed between Report 1 and Report 2, know from what date, and tell the affected customers before their procurement team finds it. CUECs and CSOCs covers how the two sets interact.

A new firm asks for the prior report early — usually before the engagement letter — along with your description, control matrix and an account of what has changed since. Expect control language to be re-litigated: firms differ genuinely and legitimately on how a control should be worded, which criterion it maps to, and what evidence satisfies it. Budget for a readiness pass even when nothing in your environment changed, and start early enough that any rewording lands before the period opens rather than during it. One constraint is absolute regardless of firm: the party that designs or implements your controls cannot also opine on them, which is why auditor independence rules out one provider doing both. TCSA does the readiness, evidence and coordination work and never issues the opinion. Worth raising during firm selection: SSAE No. 23, which aligns the attestation standards with the AICPA’s quality management standards, is in effect for engagements beginning on or after 15 December 2025 — so any second-year examination you scope now falls under it, and the firm you are interviewing has already had to stand up its quality management response.

The most common way a second SOC 2 goes badly has nothing to do with standards. The report arrives, the person who drove the first cycle moves to another project, and controls that ran weekly because someone was watching begin to run when someone remembers. It rarely fails in month one — the habit is still warm. It fails in month two, and quietly, because no deadline attaches to a control nobody is currently testing. Eleven months later it is unrecoverable: you cannot retrospectively perform a June access review in April, and a twelve-month period offers twelve monthly opportunities to be caught. This is why a second report sometimes carries more exceptions than the first.

Three unsophisticated things prevent it. Name a permanent owner for every control in the control set, and make the ownership survive reorganization. Put every recurring control on a calendar with a due date and a completion record, so a missing artifact is visible in the month it happens rather than at fieldwork. And run a mid-period internal check over a handful of controls, sampling the way the auditor will — a gap found in month seven can still be discussed with the auditor; the same gap in month twelve is simply an exception.

The mid-period check also finds the second-order problem: controls still running that no longer describe what you do. A team that adopted a new deployment pipeline in month four may still be operating the old change-approval control faithfully — on a system that now handles a fraction of production. That is the design drift CC3.4 exists to catch. Finding it in month five is a description update; finding it at fieldwork is a scope conversation nobody wanted.

Year-two cost is two lines moving in opposite directions, which is why the total rarely halves the way people expect. The readiness and advisory line falls: the control set, description and policies exist, so the work becomes maintenance, evidence discipline and coordination rather than design. The CPA firm’s attestation fee usually does not fall and frequently rises, because the period quadrupled — more samples, more populations, more walkthroughs, and low-frequency controls that finally have something to test. Six drivers set which way the second-year fee moves, and every one of them is a decision or a timing choice rather than a price you receive.

The last row is worth being concrete about, because “automate your evidence” is advice everybody gives and nobody scopes. The controls that repay automation are the high-frequency, system-observable ones: access provisioning and revocation, change approval gates enforced in the pipeline rather than asked for in a ticket, scan cadence, backup job success. Those are the populations that run to hundreds or thousands of items, and the ones where manual capture fails first. The controls that stay human are the annual judgement ones — the risk assessment, the penetration test, the recovery test, the vendor review — and no platform removes the work of performing them; it can only store the record afterwards. One caveat the tooling vendors leave out: platform-collected evidence still has to satisfy completeness and accuracy of information produced by the entity. An automatically captured screenshot with no visible query parameters or row count is rejected exactly the way a manual one is, and an integration that reports a control as passing without showing what it queried is weaker evidence than a well-formed export a human pulled.

TCSA quotes readiness, implementation and audit-coordination work as a fixed fee from $4,000 for early-stage startups, after scoping. The CPA firm’s attestation fee is contracted and billed separately by that firm. The SOC 2 cost guide sets out how the components build up.