A SOC 2 Type 2 report covers whether your controls operated effectively over a period. It is the report most enterprise customers ask for. This guide walks through the process, what the auditor tests, how exceptions appear and what it costs in our engagements.
What a SOC 2 Type 2 audit is
A Type 2 report is an attestation issued by a licensed CPA firm. It is not a certification. Our reports are issued by our licensed US CPA firm partner, and our lead auditor has handled over 200 SOC 1 and SOC 2 audits.
Type 2 versus Type 1
| Type 1 | Type 2 | |
|---|---|---|
| What it covers | Control design | Whether controls operated effectively |
| Timeframe | A point in time | A period |
The steps
- Readiness — find and fix gaps before the audit. See our SOC 2 readiness assessment guide.
- Observation period — your controls operate and produce evidence.
- Evidence testing — the auditor tests that evidence.
- Report — the CPA firm issues the Type 2 report.
What the auditor tests
The auditor tests whether your controls operated over the period — for example, that access was removed when staff left, that changes were approved, and that reviews were done and documented.
What an exception is and how it appears
An exception is a case where a control did not operate as described. Exceptions are listed in the report. In our engagements, the common reasons are:
- Access not removed when staff leave.
- Missing approval evidence for changes.
- Reviews that were done but not documented.
Timeline
In our engagements, SOC 2 takes 3 to 4 months end to end.
Cost
| Item | CyberWave GRC fee |
|---|---|
| Readiness and consulting (under 50 staff) | $3,000 to $5,000 |
| Readiness and consulting (50 to 250 staff) | $5,000 to $10,000 |
| Type 2 audit | $3,000 to $5,000 |
| Penetration testing and tools | $2,000 to $3,000 |
Our SOC 2 audit cost guide explains these figures further.
Next step
See our SOC 2 consulting page, or book a 30-minute call to plan your Type 2 audit.