What is an observation period?

How long it should be

The AICPA does not set a minimum length. A first Type II report often covers three to six months, so the company can get a report into buyers’ hands sooner. Later reports usually cover twelve months, and each one starts the day after the previous one ends, so there is no gap in coverage.

Buyers tend to give more weight to a twelve-month report, because it shows controls running through a full year, including activities that happen only once a year.

What the auditor tests during it

The auditor samples evidence from across the whole period, early months included. A control that runs daily, such as a backup job, is sampled from many dates. A control that runs quarterly, such as an access review, is checked for each quarter that falls in the window.

Annual activities must take place inside the period to be tested. If the risk assessment, the penetration test or security awareness training happened just before the window opened, the auditor may have nothing to sample.

• Start date. Set it once every control in scope is running and producing evidence.
• Annual tasks. Schedule them inside the window.
• Changes. Tell the auditor about any control that changed mid-period, so both versions can be tested.
• Evidence. Collect it as the period runs, not at the end.

Gaps and bridge letters

A Type II report covers a fixed window that has already ended, so a buyer reviewing it months later sees a gap. Companies usually provide a bridge letter, sometimes called a gap letter, to cover the time between the end of the period and the present. Management writes and signs it, not the auditor, and it states whether there have been significant changes to the controls since the report period.

Any control failures during the period appear in the report as exceptions. Missing evidence for a sample counts the same as a failure, which is why continuous evidence collection matters more than a strong finish.

Related terms

SOC 2 Type II

A SOC 2 report on whether controls operated effectively over an observation period. The report most enterprise buyers eventually ask for.

SOC 2 Type I

A SOC 2 report on whether controls are suitably designed and in place on a single date. Often the first report a company obtains.

Exception (audit)

An instance where a control did not operate as described during the audit period. A SOC 2 report lists exceptions, and readers judge how much they matter.

Evidence

Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.

Attestation report

An independent auditor’s written opinion on whether an organisation’s controls are designed, and in a Type II report operating, as described. A SOC 2 report is an attestation, not a certificate.