A Type 2 report covers a defined audit window, and buyers expect the next report to pick up roughly where the last one ended. Slip the window and a gap opens between periods — reports don’t formally expire, but procurement teams discount one whose period ended long ago, and plenty of contracts require a “current” report outright.
The usual patch, a bridge letter, has hard limits: it’s your management’s statement that controls haven’t materially changed, not an auditor’s work, and reviewers accept it for a short stretch — typically a quarter — before it starts reading as a substitute for the audit you didn’t run.
Rescheduling is the part teams underestimate. Audit firms book fieldwork out weeks to months, and a slipped engagement goes to the back of the queue, not the front. And if the window slipped because evidence wasn’t ready, the new date will slip for the same reason — catch up on evidence before you commit to it.
Call the auditor first; they would far rather move a window than qualify a report, and if your evidence is continuous they can often extend the period end instead of abandoning it. Pick a new end date with buffer you can actually hold, then send affected customers — anyone mid-diligence or contractually owed a report — the bridge letter and the new timeline together. A slipped audit disclosed with a date barely registers; the version buyers punish is the one they discover on their own.
Often, yes. If evidence has been continuous, the auditor can move the period end later and cover a longer window in one report — the audit shifts rather than resets. It’s the first option to raise, and it needs their sign-off.
Tell the ones who are owed it: anyone with a report clause in their contract or an open security review. New date plus bridge letter, sent before they ask, keeps it an administrative note instead of a trust question.
