How long should the observation period be, and what do we send customers in the gap?

Start

We need a Type 2 period and a plan for the gap after it

The period is the stretch of time the CPA firm tests. The gap is the time between its last day and the day a customer holds the report. Decide the length first, then what customers receive meanwhile. Nothing here is an AICPA rule: the lengths and limits are market practice or house defaults, and your CPA firm and customers decide.

• Then: Have the controls run, with records, for about 3 months?

Decision

Have the controls run, with records, for about 3 months?

A control must run before it can be observed. The pack's default is that controls have operated, with records, for at least 3 months before a first Type 2 period starts. Count from the day each control began to run and left records, not from the day it was written down.

• Yes: Pick the longest of 3, 6 or 12 months that fits your date
• No, or not known: Get ready first, or take a Type 1 report first

Outcome

Get ready first, or take a Type 1 report first

If controls are not yet running at all, start neither report: run the readiness self-assessment, close the blocking items and come back. If they run but for under about 3 months, expect exceptions early in a short first period, or take a Type 1 report first and begin the Type 2 period when the controls have run. Tell customers where you are in plain words.

Step

Pick the longest of 3, 6 or 12 months that fits your date

Count back from the date the customer needs the report. The period plus the time the CPA firm needs to issue the report must end before it. The pack allows 2 months to issue as a house default, so ask your firm. With no date set the pack's method uses 12 months, and if none fits it uses 3 and says that it does not fit.

• Then: Does a customer state a longer minimum in writing?

Decision

Does a customer state a longer minimum in writing?

The AICPA's SOC 2 guide sets no minimum period, though it says under two months is unlikely to give enough evidence, so a customer's own requirement is the one to find. A customer's stated minimum overrides the period that would otherwise fit your date. Ask each customer that has asked for the report and keep the answer in writing. If you have not asked, the answer is not known: ask first.

• Yes: Use the customer's minimum and note any that differ
• No, none stated: Does the period plus time to issue end before the customer's date?
• Not known: Ask each customer whether it states a minimum

Step

Ask each customer whether it states a minimum

Ask each customer that has asked for the report whether it states a minimum period, and keep the answer in writing. A customer's stated minimum overrides the period that would otherwise fit your date, so find it before you choose.

• Then: Does a customer state a longer minimum in writing? (back to an earlier step)

Step

Use the customer's minimum and note any that differ

Where a customer states a minimum longer than the period that fits, the pack's method uses the minimum and then checks whether it still fits your date. If two customers ask for different things, decide for the one report you will commission and record what each asked, so the sponsor can see which request it does not serve.

• Then: Does the period plus time to issue end before the customer's date?

Decision

Does the period plus time to issue end before the customer's date?

The report is not in the customer's hands on the last day of the period. The CPA firm needs time to issue it, and firms differ, so ask yours. If the period you need does not fit the date, say so before you commit rather than after.

• Yes: Agree the period dates in writing with the CPA firm
• No, or not known: Tell the customer early and offer a Type 1 report

Step

Tell the customer early and offer a Type 1 report

When the period and the time to issue do not fit the date, the pack asks you to talk to the customer about a Type 1 report before you commit. If you already hold a report, a bridge letter can cover the interval after its period. The customer decides what it accepts. A period shorter than the firm can test properly is one of the pack's warning signs about a firm.

• Then: Agree the period dates in writing with the CPA firm

Step

Agree the period dates in writing with the CPA firm

Put the start and end dates in the engagement letter, or in an email the firm has confirmed, before the period starts. Do not change them during the period without the firm. The pack's house default is to have readiness complete and the dates agreed 14 days before the period starts.

• Then: Plan the next period to start the day after this one ends

Step

Plan the next period to start the day after this one ends

Start the next period on the day after the last one ends so that no day is uncovered. Have its engagement letter in hand by the day the next period starts. If the CPA firm will continue, ask how consecutive periods are scheduled.

• Then: Has the period ended?

Decision

Has the period ended?

The answer decides which of the pack's four words applies: Period still running, Bridge letter suitable, Beyond a bridge letter, or Next report issued. The rule looks only at dates. While the period runs there is no interval to describe, so there is nothing for a letter to say.

• Yes: Has the CPA firm issued the report?
• No, still running: Say when the period ends and when the report is expected

Outcome

Say when the period ends and when the report is expected

Do not send a bridge letter while the period runs. Give the end date and the expected date of the report as an expectation, in your approved words. The expected date depends on the period and on the CPA firm. Log any date you give a customer as a commitment.

Decision

Has the CPA firm issued the report?

A bridge letter refers to a report, so there must be one. Before the report exists there is nothing to bridge from. The pack's house default expects the report about 2 months after the period ends, and firms differ.

• Yes: Did the period end about 3 months ago or less?
• No: Say where the report stands and send no letter yet

Outcome

Say where the report stands and send no letter yet

Tell the customer in plain words that the report is not yet issued and when you expect it. Offer what you can send meanwhile: the security overview, the standard security commitments schedule and a completed questionnaire. Log the date you give as a commitment.

Decision

Did the period end about 3 months ago or less?

About three months after the period ends is the limit advisory sources usually give for a bridge letter. That is market practice, not a rule, and some customers state their own limit. Ask your larger customers what they accept.

• Yes: Can management say from its records how the controls have run since?
• No, or not known: Has the next report been issued?

Decision

Can management say from its records how the controls have run since?

The letter states what management knows about the interval from its own monitoring: the checkpoints, the exceptions calendar, the incident log, the change records and the access reviews. If you cannot read them for the interval, you do not yet have a basis. A letter that says less is better than one that says what nobody checked.

• Yes: Release a bridge letter with the report
• No, or not known: Send the report with a plain note and no letter

Outcome

Release a bridge letter with the report

Name the report exactly, state the interval, the changes, the incidents and any open exception, and say that the CPA firm did not examine the interval or issue the letter. An executive who speaks for management signs it, Legal reads it and the examination owner releases it. Say what management knows, never that the controls are effective. Send it only under a confidentiality agreement.

Outcome

Send the report with a plain note and no letter

Send the report you hold, named exactly, and say when the next one is expected. Do not write a letter that says more than your records support. Hold the management checkpoints in the next period, so that the next interval has a basis.

Decision

Has the next report been issued?

Past about three months a letter no longer bridges the gap. If the next report exists, it takes the place of the letter. If it does not, the customer decides what it relies on, and you tell it plainly when the report is expected.

• Yes: Send the next report and stop sending letters
• No, or not known: Give the expected date, log it, and do not stretch a letter

Outcome

Send the next report and stop sending letters

The next report takes the place of the letter. Name it exactly by type, categories, system and period, and send it under the confidentiality terms. Stop sending letters for the old period.

Outcome

Give the expected date, log it, and do not stretch a letter

Tell the customer plainly when the next report is expected and send the report you hold with its period named exactly. Do not stretch a letter past its window. Log the date as a commitment with an owner. A letter for a gap of nine months is a listed mistake.