How long a SOC 2 report stays useful

Nobody explains this at the point of purchase. You get a signed report, you send it to the buyer who asked for it, the deal closes, and eleven months later a different buyer asks the same question and gets a different answer. The report did not change. The reader’s tolerance did.

A report is not a certificate

Two words cause most of the confusion here: certified and valid. Neither one belongs to SOC 2. A CPA firm does not certify you and does not issue a license that lapses. It examines the controls you scoped and reports what it found, in a document with a date range printed on the front.¹ If you are still deciding which document you need, Type 1 versus Type 2 covers the choice your buyer is actually making for you.

Type 1

An opinion that your controls were suitably designed as of one specific date. It speaks to that date and to nothing else. It never covered a period, so it can never be stretched into one.

Type 2

An opinion that those controls operated effectively throughout a stated period, usually three to twelve months. The period is printed on the report, and it is the only thing a buyer measures age against.

The facts in the report stay true indefinitely, because they were true in the window it covers. Relevance is what decays. A report covering last January through last December says nothing about what you did in March of this year, and a serious reviewer knows that perfectly well.

The twelve month line

Polara's rule of thumb: once a Type 2 period ended more than twelve months ago, expect a reviewer to call it stale and to stop the review there.

The stricter version asks for two things at once: a report whose period ended inside the last twelve months, plus written coverage of every month between that end date and today. The second half is where founders get caught. Your period ended in March, it is now August, and five months of your operating history are blank from the buyer’s side of the table.

Bridge letters, and the case the templates skip

A bridge letter, also called a gap letter, covers the space between the end of your report period and today. You write it. Management signs it. The CPA firm does not sign it. Nothing over the gap period was examined, so there is nothing for an auditor to report on.²

The dates

The end of the examination period on one side and the date of the letter on the other. That span is the gap, and stating it plainly is half the value of the letter.

The continuity assertion

That the controls described in the report have continued to operate, and that no material changes have occurred that would affect them.

The limitation

That no independent examination was performed over the gap period, and that the letter is management’s statement rather than the auditor’s.

How long a buyer will take one is the real question. A short bridge period is commonly accepted; the longer the gap, the more likely a reviewer asks for the next report.

Why the cadence becomes annual, and why periods touch

Follow the twelve month convention to its conclusion and the schedule writes itself. Your report ages out roughly a year after its period closes. The next period therefore has to close before that happens, which means the next examination has to be underway months earlier. That is the whole reason SOC 2 settles into an annual cycle, and it is a buyer driven rhythm rather than a rule from the standard.²

It also explains why experienced teams design consecutive periods rather than convenient ones. If your first Type 2 covers January through March and your second covers July through December, there is an uncovered quarter sitting inside your own history, and a diligent reviewer reading both reports side by side will find it. Back to back periods leave nothing to explain. How long that first window has to run, and why no platform can shorten it, is the subject of the SOC 2 observation period.

Through Polara Labs, Star is $2,000 one time for onboarding, and a Type 1 report is $2,000 more if you want the Type 1 examination and report with it. Keeping evidence collected and the report current is Orbit, at $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. The full breakdown sits on what SOC 2 certification costs.

Renewal reports are inside the plan. Orbit renews at $7,800 with your annual audit included, which is the renewal stated in advance rather than an uplift that turns up on an invoice.

What to send while your next report is in progress

This is the email you will write several times a year, so it is worth having a shape for it. Four moves, in this order.

1. Send the report with its dates in the email body. Do not make a reviewer hunt through a PDF for the period. One line does it: this report covers these dates, and here is the letter covering the months since.
2. Attach the bridge letter before anyone asks. Volunteering it reads as competence. Producing it three emails later reads as improvisation, and by then the reviewer has already flagged the gap.
3. Name the next period and the examination date. A buyer who knows your next report covers through March and lands in April can write a conditional approval today instead of waiting for you.
4. Offer the interim artifacts, and label them honestly. Your policy set, your control list and a recent access review are not a report. Saying so yourself is what makes the rest of the email credible.

None of that helps if there is no next report. If a deal is already paused on this, what to do when a customer asks for a SOC 2 you do not have is the shorter path, and how long a SOC 2 actually takes gives you the dates to put in the email today. To see where the period and the as-of date sit on the page itself, look at what a finished SOC 2 report looks like.