Short answer: A SOC 2 report has no official expiration date. In practice, most customers treat a report as current for about 12 months after the end of its examination period, and they expect you to issue a new one every year. After that, buyers start asking for a newer report or a bridge letter.
People often ask whether a SOC 2 report “expires” the way a certificate does. It does not. The AICPA does not set a validity period, and the report itself never states one. What exists is a buyer expectation, and that expectation is what decides whether your report is still useful in a sales cycle.
This article explains where the 12-month rule of thumb comes from, how it differs between Type I and Type II, how to schedule renewals so you never have a gap, and what to do if your report has already aged out.
Do SOC 2 reports expire?
Not formally. A SOC 2 report is an attestation by an independent CPA firm about a system during a stated period (Type II) or as of a stated date (Type I). That statement stays true forever as a description of the past. What changes is how relevant it is to someone deciding whether to trust you today.
Buyers handle this in their vendor risk policies. A typical rule says the report must cover a period that ended within the last 12 months, and some stricter policies shorten that. That is the origin of the “valid for one year” shorthand you will hear from vendors and consultants. It is a convention, not a standard.
How long a SOC 2 report is accepted, by type
| Report | What it covers | How buyers usually treat its age |
|---|---|---|
| Type I | Design of controls at one date | Ages quickly because it describes a single day. Buyers often accept it as a first step and expect a Type II next. |
| Type II | Design and operating effectiveness over a period | Usually accepted for about 12 months after the period ends, with a bridge letter for short gaps. |
If you are weighing which to start with, our guide to SOC 2 Type I vs Type II explains the trade-offs.
The annual cycle
Most service organizations run Type II examinations on a 12-month cycle. The first Type II is often shorter, commonly three to six months, because the company wants a report quickly. After that, it moves to 12-month periods that follow each other without a break.
A clean cycle looks like this:
- Period 1 ends on 31 December.
- Fieldwork and report issuance happen in the following weeks.
- Period 2 begins on 1 January with no gap, so controls keep running and evidence keeps accumulating.
- Period 2 ends the next 31 December and the cycle repeats.
Because periods are contiguous, a customer who asks in any month can be given the latest report plus, if needed, a short letter covering the time since it ended.
Why the date on the report matters more than the issue date
Buyers look at the period end date, not the day the report was delivered. A report issued in February for a period that ended on 31 December is already two months old in the buyer’s eyes. That is why starting the next fieldwork cycle early matters: the clock that counts is the period end, and the report only arrives weeks later.
What happens when a report lapses
If your report is older than a customer’s policy allows, there are three common outcomes:
- The customer accepts a bridge letter. For a gap of roughly three months or less, many will. Read our guide to the SOC 2 bridge letter for how to write one.
- The customer pauses the deal or renewal. Procurement teams often cannot approve a vendor with an out-of-date report, even if the controls are fine.
- The customer asks for compensating evidence. That can mean a security questionnaire, a call with your security lead, or a copy of recent test results.
The longer the lapse, the more of the second outcome you will see. A gap you can explain in one sentence is fine. A gap of a year suggests a program that is not running.
How to plan renewals so you never lapse
Work backward from the period end
Choose the period end date first. Then book your auditor early enough that fieldwork starts as soon as the period closes. Auditors fill their calendars months ahead, especially around the end of the calendar year.
Keep evidence collection continuous
The scramble before fieldwork is what delays renewals. Teams that collect evidence all year, in line with continuous compliance, finish fieldwork faster and have fewer exceptions to explain.
Align with your customers’ review dates
A handful of large customers usually drive most report requests, and they ask at about the same time each year. Choose a period end that gives you a fresh report just before those reviews.
Budget for the renewal, not just the first audit
Renewal is a recurring cost in both money and staff time. The SOC 2 audit timeline guide shows how long each phase takes, which helps you set realistic dates.
Common mistakes
- Treating the first report as one and done. The report is the start of an annual commitment.
- Letting the observation period restart. A break between periods means a stretch with no coverage.
- Waiting for the old report to expire before booking the next audit. Auditors are booked well in advance.
- Assuming a certificate-style expiry date. There is none, so the only deadline is the one your customer enforces.
- Quoting an old report in sales material. Always give the period covered, and offer the latest report when you have it.
Business implications
A lapsed report costs you more than the audit fee. It slows enterprise sales, delays renewals with existing customers, and forces your security team into repetitive questionnaires. A predictable annual cycle turns SOC 2 into a sales asset instead of a recurring fire drill. If your team needs help keeping the cycle on schedule, SOC2.in offers SOC 2 Type I and Type II audit support.
Once a new report arrives, share it carefully. Our guide on sharing SOC 2 reports with clients covers NDAs and restricted use, and the Type II audit overview explains what the renewal examination involves.
How to plan report renewals so there is never a gap
The most useful way to think about validity is as a calendar problem. A Type II report covers a past period, and customers judge how current it is by when that period ended. If your last period ended in March and a customer reviews you the following February, the report is already close to the age many buyers consider acceptable. Note that the commonly quoted twelve-month window is a customer convention, not an AICPA rule, so check what your key contracts actually say.
- Start the next period the day after the current one ends. Back-to-back periods keep your coverage continuous and avoid awkward explanations.
- Book the auditor early. Firms fill their calendars, and fieldwork plus report drafting takes weeks after the period closes.
- List customer renewal dates. Know which accounts will ask for a fresh report and when.
- Use bridge letters sparingly and honestly. They are management statements, not auditor assurance.
- Keep controls running between periods. A pause in evidence collection is the most common reason a following report shows exceptions.
Teams that treat the audit as an annual project tend to scramble. Teams that treat it as a continuous calendar rarely worry about expiry. Our guide to continuous compliance shows how to build that habit, and our Type I and Type II audit support page explains how we help coordinate timing with your auditor.
Frequently asked questions
How long is a SOC 2 report valid?
There is no official validity period. Most customers treat a report as current for about 12 months after its examination period ends and expect an annual renewal.
Does a SOC 2 report expire after one year?
Not formally. It remains a true record of its period, but many vendor risk policies will not accept one whose period ended more than 12 months ago.
Is a SOC 2 Type I report valid for a year?
Buyers rarely give it that much credit. It describes controls on one date, so it feels stale sooner, and most buyers expect a Type II to follow.
Do you need a SOC 2 audit every year?
SOC 2 does not mandate an annual audit, but customers usually expect a new report each year, so most companies run annual examinations.
What if my SOC 2 report is more than 12 months old?
Ask the customer what they will accept. A short bridge letter can help for a small gap, but an older report generally needs to be replaced.
Can I extend my SOC 2 report?
No. The report covers a fixed period. You can only add a management letter for the gap and then complete a new examination.
Conclusion
A SOC 2 report does not expire on a stamped date, but customer expectations act like one. Plan around a 12-month cycle, keep periods back to back, book your auditor early and use a short bridge letter only when you must. Do that and your report stays ready whenever a buyer asks for it.
