Choose the reporting period with your auditor and the customers who need the report. The shortest possible period is not necessarily the most useful one. It needs to support the examination and answer the buyer’s question.
Keep three dates separate: when the period starts, when it ends and when the finished report will be available. A three-month period does not mean a report arrives three months after you first contact an auditor.
Start with the customer’s need
- Ask whether the customer requires Type 2 and what period of coverage they accept.
- Check any deadline for receiving the finished report.
- Confirm whether a shorter first report would meet the immediate need. Do not assume acceptance.
- Plan what report the customer will expect next.
Check what can actually be examined
The auditor needs sufficient appropriate evidence of control operation. AICPA guidance explains that a period can be too short to support that work. Do not treat a commonly advertised duration as an automatic guarantee that your engagement is ready.
Use the Type 2 readiness checks before choosing the start date. Policies and software purchases do not establish a history of completed work.
Look at controls that run less often
Show the auditor your control calendar. A shorter period may not contain an annual activity. Discuss how that activity will be addressed rather than changing its date just to create a convenient record.
For example, a proposed January-to-March period may not include a recovery exercise scheduled for September. That does not by itself settle the report outcome. It is a planning question to resolve with the auditor before committing to the period.
Allow time after the period ends
Ask the CPA firm to explain the remaining work and expected delivery date. Evidence follow-up and report review take time. Tell sales the expected delivery date rather than treating the last day of the period as a promise that the report is ready.
Plan the next period too
A shorter first report may help with an immediate deadline. Agree how later reporting will fit customer needs. If continuous coverage is needed, plan the next period so there is no unwanted gap. Keep the controls operating between examinations.
After the first report, use the post-report handover guide to keep ownership and evidence collection in place.
Sources
- AICPA SOC 2 guide, section 2.54: period length and sufficient evidence.
- Schellman: choosing a reporting period. The planning steps above are not a prescribed AICPA timetable.