SOC 2 Year Two: What Maintaining It Actually Takes
A SOC 2 Type 2 report covers a fixed observation period, usually 6 or 12 months, and says nothing about any date after it ends. Maintaining SOC 2 means running a second observation period that starts the day after the first one finishes, so your customers never see a gap in coverage. Year two normally costs less than year one because the readiness and remediation work is already done, but the audit fee itself does not fall much, and the evidence discipline gets harder, not easier.
The mistake that costs Australian companies the most is treating the first report as the finish line. A SOC 2 report is a statement about a window of time that has already passed. The moment you hand it to a customer, the clock on its usefulness is already running.
How long is a SOC 2 report valid?
A SOC 2 report is not valid for a period, because it is not a certificate. It is an auditor’s opinion about how controls operated during a stated observation period. What actually happens is that customers apply their own freshness rule, and most enterprise procurement teams will accept a report whose observation period ended within the last 12 months.
That convention is where the annual cycle comes from. Not from the AICPA, which publishes the SOC suite of services, and not from any regulator. It comes from what your customers will accept before they start asking awkward questions.
Two dates matter in every SOC 2 report and they are not the same date:
- The observation period end date. The last day the auditor tested. This is the date customers measure freshness from.
- The report issue date. Usually four to eight weeks later, once fieldwork and review are complete. This is the date you can first send it to anyone.
Because a new observation period cannot be reported on until it has finished, there is always a window where your newest report covers a period that ended months ago. Covering that window is what a SOC 2 bridge letter exists to do, and you will be asked for one every year from now on.
Why must your SOC 2 observation periods run back to back?
Your SOC 2 observation periods must run back to back because any unexamined gap between them is a period no auditor has given an opinion on, and sophisticated customers check for exactly that. If your first period ended 30 June and your second begins 1 October, three months of your operation have no assurance attached to them.
A gap is easy to create accidentally. The usual cause is waiting for the first report to be issued before deciding to commission the second, which puts the decision four to eight weeks after the period you should already be inside. The fix is to agree the second period with your auditor before the first one ends.
What an acquirer, an insurer or a large enterprise customer does with a gap varies. Some will accept it with an explanation. Some will treat it as a lapse and require a bridge letter covering the gap, which your management can sign but your auditor will not. Some will ask why, and the honest answer is that nobody planned the second year.
The simple rule: the day after your observation period ends, you are inside the next one.
What does SOC 2 year two cost compared with year one?
SOC 2 year two costs less in total than year one for most Australian companies, because the readiness assessment, policy writing, control implementation and remediation are one-off investments. The audit fee itself usually moves only a little, and sometimes rises if your scope, headcount or systems have grown.
| Cost component | Year one | Year two | Why |
|---|---|---|---|
| Readiness or gap assessment | Usually required | Rarely required | You already know where you stand |
| Policy and control build | Significant | Small | Policies exist, only changes need work |
| Remediation of gaps | Often the largest line | Minimal if nothing drifted | Fixes from year one should still be in place |
| Penetration testing | Required by most auditors | Required again annually | An annual expectation, not one-off |
| Audit fieldwork fee | Baseline | Similar or slightly higher | Same testing effort, possibly larger scope |
| Internal time on evidence | Heavy, concentrated | Steadier but year-round | 12 months of evidence instead of a sprint |
The component people underestimate is the last one. A Type 1 or a short first Type 2 can be survived with a concentrated effort near the end. A 12-month observation period cannot, because the auditor samples across the whole period and a quarter with no evidence is a quarter with an exception. If you are still deciding between report types, our guide to SOC 2 Type 1 versus Type 2 covers the trade-off.
Penetration testing stays an annual line item. Most auditors expect evidence of testing performed within the observation period, so a test from the previous year will not carry over. Our guide to penetration testing for SOC 2 explains what auditors actually ask for.
What changes between your first and second SOC 2 audit?
Between your first and second SOC 2 audit, the testing gets deeper rather than broader. Your auditor already understands your systems, so less time goes on walkthroughs and more goes on sampling evidence across a full period. Three specific things change for most Australian companies.
- Sampling across twelve months instead of a short window. If a control runs monthly, the auditor may select four or five months at random across the year. Every selected month needs its evidence, with dates, and reconstructing it afterwards is visible.
- Exceptions carry more weight. A control that failed once in a three-month first period can be explained as teething. The same failure in year two, after you have had a year to embed it, reads as a control that does not work.
- Scope creep becomes real. New products, new cloud regions, new subservice providers and new staff all arrived during the year. If your system description still describes last year’s company, that is a finding before any control is even tested.
That last point is worth a deliberate review each year. Walk your SOC 2 scope and system description against what your company now actually does, before the auditor does it for you.
What should you do each quarter to stay SOC 2 ready?
To stay SOC 2 ready, run a short quarterly routine rather than an annual scramble: confirm your recurring controls produced evidence, review access, work through any changes to scope, and clear anything outstanding. Four focused sessions a year is the difference between a clean report and an exception.
| Quarter of the observation period | Focus | What good looks like |
|---|---|---|
| First quarter | Confirm the period and the plan | Observation period agreed with your auditor, scope changes from last year written up |
| Second quarter | Evidence health check | Spot check three recurring controls. Can you produce dated evidence without asking anyone? |
| Third quarter | Access review and penetration test | Access reviews complete with sign-off, penetration test booked or done inside the period |
| Fourth quarter | Pre-audit tidy and risk assessment | Risk assessment refreshed, vendor reviews current, known gaps raised with the auditor early |
Raising a known problem with your auditor early is almost always better than hoping it is not sampled. An issue you identified, documented and corrected during the period is a very different conversation from one the auditor finds in your evidence.
Common questions about maintaining SOC 2
How often do you need a SOC 2 audit?
Most companies complete a SOC 2 Type 2 audit annually, with a 12-month observation period that starts the day after the previous one ended. Nothing in the AICPA framework mandates annual reporting. The cadence is driven by customer expectations, and most enterprise buyers want a report whose observation period ended within the last 12 months.
What happens if your SOC 2 report expires?
A SOC 2 report does not formally expire, but once its observation period is more than about 12 months old, customers generally stop accepting it. In practice that means security questionnaires come back instead, renewals stall in procurement, and deals that previously closed on the strength of the report need manual evidence again.
Can you change your SOC 2 observation period length?
Yes. Many companies run a shorter first Type 2 period, often three to six months, to get a report into customers’ hands sooner, then move to 12 months from year two. Discuss the change with your auditor before the first period ends, and make sure the new period starts immediately after the old one so there is no unexamined gap.
Do you need a new bridge letter every year?
Yes, if customers ask for coverage between your latest observation period end date and today. A bridge letter is signed by your management, not your auditor, and typically covers no more than three months. Because the gap recurs every year between period end and the next report, expect to issue one annually.
Can you change SOC 2 auditors between year one and year two?
Yes, and some companies do after a poor first experience. Expect the new auditor to spend extra time understanding your environment, and expect them to form their own view of your system description and control design rather than inheriting the previous opinion. Change before the new observation period starts, not partway through it. Our guide to choosing a SOC 2 auditor in Australia covers what to ask.
Does adding the Privacy criteria in year two mean starting over?
No, but it does mean new controls that need to operate for the full observation period before they can be tested. Adding a Trust Services Category partway through a period generally means that category is reported from the following period. Decide before the period begins. See which Trust Services Criteria apply for how to choose.
Plan year two before year one ends
The companies that find SOC 2 painful are the ones that rediscover it each year, six weeks before the auditor arrives. The ones that find it routine agreed next year’s observation period before this year’s finished, and spent four short sessions keeping evidence honest instead of one long quarter reconstructing it.
Siege Cyber helps Australian companies get through the first SOC 2 and keep the second one uneventful. Have a look at our SOC 2 services, or get in touch if your observation period is about to end and nothing has been booked.