Three clocks stack up between kickoff and a PDF. First, controls must be implemented and running — the readiness phase, and the only one that effort can shrink. Second, the observation period itself: the span the report covers, during which every control has to operate and leave evidence behind. Third, the examination — once the window closes, the auditor tests what it produced, then drafting and quality review add a final stretch of weeks.
Concretely: a company that opens a three-month window at the start of March should treat early summer as the realistic report date — window closed at the end of May, fieldwork and drafting after. Choose a twelve-month window and the same arithmetic pushes the report past the one-year mark. A SOC 2 Type 2 attests to operation over time, and time is the one ingredient nobody can substitute.
It will not pause, backfill, or round down. Evidence has to exist for the whole span — a quarter with no access review stays a quarter with no access review, and it surfaces in testing as an exception. The two decisions you genuinely control are when the window opens and how long it runs; everything after that is operating discipline, which is precisely the part a managed program takes off your team’s plate.
When your controls are genuinely operating and you and your auditor agree to open it — not at contract signature. A focused readiness push sets the earliest credible start date.
Typically weeks: fieldwork, testing follow-ups, then drafting and the firm’s quality review. Evidence readiness is the variable — a clean, fast PBC response keeps it at the short end.
