Audit window

In everyday SOC 2 usage, the audit window is the span a Type 2 report examines — typically three, six, or twelve months in which every control has to run on schedule and generate proof. The formal name for that span is the observation period; audit window is the phrase that does the same work in planning documents, sales threads, and renewal calendars. Its defining property is that it cannot be backfilled: miss a quarter of access reviews inside the window and no later heroics recover them, because the evidence deadline is the day the window closes.

The same phrase also gets used for a different clock — the shorter stretch, commonly a few weeks after the period ends, when the audit firm actively works the engagement: issuing the PBC list, running walkthroughs, pulling samples, and chasing follow-ups. Both usages are common, so confirm which one a speaker means before building a plan around it. The two clocks fail differently, too. A program that lapses during the covered period cannot be repaired afterward; a program that reaches fieldwork disorganized merely burns those weeks reconstructing artifacts it should have retrieved in minutes. If fieldwork is near and the record has holes, the options that actually exist are laid out in Behind on audit evidence.

Both clocks are fixed early. The period’s end date is agreed in the engagement letter, and audit firms book fieldwork weeks or months ahead — usually opening shortly after the window closes, so the report publishes while its contents are fresh. Renewals settle into a rhythm: window ends, fieldwork runs, the report issues, and the next window is already underway behind it. Slipping either date is expensive in fees, auditor goodwill, and customer coverage, which is why mature programs manage the evidence to the calendar rather than negotiating the calendar to fit the evidence. What a slip actually costs — and how to reset the date — is covered under what happens if I miss my audit window.