Observation Period & Exceptions Calendar
Dates the observation period, the evidence points inside it, any exceptions found and the management responses, and the dates for bridge letters.
Available soon
- Format
- Excel
- Size
- 93 KB
- Length
- 14 sheets
- Version
- 1.0
- Updated
What's inside
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this workbook is. It is the Observation Period & Exceptions Calendar of the SOC 2 Report Readiness pack. It carries out rules SR-16 to SR-20 of the pack guide: agree the period dates in writing, record every exception with its management response, record significant changes and incidents, and use a bridge letter only for a limited gap. It records dates and facts. What is reported is for the CPA firm to decide. |
| 2 | On the Settings sheet enter the first day of the observation period, its length in months and the as-at date. Three, six and twelve months are market practice. The AICPA's SOC 2 guide sets no minimum, and says a period under two months is unlikely to give enough evidence; six months is what advisers often expect, which the guide does not state, and three months is the shortest in common use. The CPA firm agrees the dates with you, and a customer may state a minimum. The workbook never reads the clock, so change the as-at date when you update it. |
| 3 | Read the six defaults on the Settings sheet. Each is a house default or market practice, not a rule. Change one only for a reason, such as a date a customer or the CPA firm gives you, and note the reason. The Differs column shows what you changed. |
| 4 | On the Milestones sheet the fourteen milestones MS-01 to MS-14 are dated from the start date and the length. Each has a role and the rule it carries out. Write the name of the person, and enter the day each is done. The position says Done, Overdue or Coming up. |
| 5 | Hold each management checkpoint (MS-04 to MS-07) using the prompts on the Checkpoints sheet. Enter the day it was held and who held it. The sheet also shows how many times each frequency of control falls in your period, and warns of a control that may not fall in it. |
| 6 | Use the Exceptions sheet from the first day of the period. For each exception enter an ID, the control, the date found, one of five kinds (EK-1 to EK-5), the five response fields and a status. The full response form is in Bridge Letter & Management Response Templates (P32-A10). Never delete an exception or change its date found (SR-17). The check column names what is missing. The flag column marks an exception still Open longer than the checkpoint interval. |
| 7 | Use the Changes and Incidents sheet for significant changes (DC-9) and incidents (DC-4). It is a record. Notification decisions follow the incident documents of the earlier packs, unchanged, and this workbook states no time. Say whether a commitment to customers was affected, and the date you told the CPA firm. |
| 8 | When the period ends, use the Bridge Letters sheet: one row for each report and customer that needs cover for the interval after the period. The status is one of four words: Period still running, Bridge letter suitable (within the bridge letter limit; send a letter only once the report is issued, and before then say where the report stands), Beyond a bridge letter: send the next report and Next report issued. A bridge letter is management's statement. The CPA firm does not issue it and gives no assurance over it. |
| 9 | Read the Summary sheet. It counts exceptions by kind and status, changes and incidents, milestones by position and letters by status, and runs eight checks: Clear, Action needed or Nothing to check. These are counts of work left, not a score and not a view on the opinion, which is the CPA firm's. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps an organisation get ready for a SOC 2 examination by a licensed CPA firm. It is not legal advice and not advice on an audit or attestation engagement. A SOC 2 report is the CPA firm's opinion on management's description of a system and on its controls. It is an attestation, not a certificate. This document does not say that you will receive any particular opinion, that any control meets a criterion, or that holding ISO/IEC 27001 or any other report equals or replaces a SOC 2 report. What the criteria require of you, how exceptions are described in the report and whether they affect the opinion are for the CPA firm to decide. Which customers accept which report is for them.
A calendar is a plan. Doing the work on its date does not show that a control works. What is tested, how many occurrences are sampled and how an exception is reported are decisions of the CPA firm.
Dates follow the month-end rule on the Definitions sheet. A period that starts on the 31st ends a day before the last day of a shorter month.
A bridge letter is market practice. No AICPA definition or rule was found.
EXAMPLE: Acme Corp (EXAMPLE), a US software-as-a-service provider with about 400 staff, selling to businesses that ask for a SOC 2 report. Its Type 2 period runs 1 Jan 2027 to 30 Jun 2027 (6 months), read as at 1 Aug 2027. Its position is not tidy on purpose: the mid-period review with the CPA firm (MS-07) is past and not marked done, exception EX-03 has been Open since 3 May 2027 and is flagged, EX-04 is Open but recent, and the second customer has no bridge letter yet. Three of the eight checks therefore read Action needed. EXAMPLE rows describe Acme Corp and are invented. Delete them before you rely on the counts.
Adapting this template:
• Small organisation: one person may be examination owner, owner of most controls and the person at every checkpoint. Keep the checkpoints, and keep them short: ten minutes with the Exceptions sheet open. A checkpoint nobody holds is the usual way an exception stays open for months.
• Customer-driven or regulated organisation: if a customer, a regulator or a contract sets the period, the report date or the age at which a report is too old, change the matching setting and note where the date came from. Counsel confirms whether a date binds you. This workbook holds no notification time.
• Organisation that uses outsourced providers: a provider's report has its own period and exceptions. Log what it reports as a change or a note, not as your exception, unless your own control failed.
• Replace the [[placeholders]] with your own values. Keep the formulas. Delete the EXAMPLE rows before you rely on the counts.
This workbook is your own record. Keep a copy that can be reached when the main systems are down.
Settings
Settings
The period, the as-at date and six defaults. Yellow cells are yours; the others calculate. The workbook never reads the clock: change the as-at date when you update it.
| Period start date (day 1) | 1 Jan 2027 | EXAMPLE: Acme starts on 1 Jan 2027. Enter your own date, agreed in writing with the CPA firm (SR-16). | ||
| Period length in months | 6 | Three, six and twelve months are market practice. The AICPA's SOC 2 guide sets no minimum and says a period under two months is unlikely to give enough evidence. A customer may state its own. | ||
| Length check (calc) | A common length (market practice) | |||
| Period end (calc) | 30 Jun 2027 | The start date plus the months, less one day (see the month-end rule on the Definitions sheet). | ||
| Next period starts (calc) | 1 Jul 2027 | The day after this period ends, so that no day is uncovered (SR-16). | ||
| Next period length in months (blank: same as this one) | Blank repeats the length. | |||
| Next period ends (calc) | 31 Dec 2027 | |||
| As-at date | 1 Aug 2027 | EXAMPLE: 1 Aug 2027. The day you are reading the workbook as of. Positions, flags and bridge letter statuses are worked out as at this date. | ||
| Period dates usable (calc) | Yes | Yes when the start date is a date and the length is a whole number of months from 1. | ||
| All settings usable (calc) | Yes | Yes when the period dates are usable and all six defaults below are numbers. |
Defaults you may change
| Setting | Value | Default | Differs (calc) | Basis, and why it matters |
|---|---|---|---|---|
| Readiness lead (days before the period starts) | 14 | 14 | Default | House default. By this day the readiness work is complete and the dates are agreed in writing (MS-01, MS-02). |
| Assertion and description final (days after the period ends) | 21 | 21 | Default | House default. Management's assertion and the description are signed (MS-10). The CPA firm may set its own date. |
| Report expected (months after the period ends) | 2 | 2 | Default | House default. Firms differ. Ask yours how long it takes after the last day of the period (MS-11). |
| Open exception flag after (months) | 1 | 1 | Default | House default. How long an open exception may wait before it is flagged. The checkpoint dates do not use it: they fall at one quarter, one half and three quarters of the period. |
| Bridge letter limit (months after the period ends) | 3 | 3 | Default | Market practice. About how long customers accept a bridge letter. Customers decide, and some state their own limit (MS-13). |
| Report age at which many customers ask for the next one (months) | 12 | 12 | Default | Market practice. About how old a report's last day may be before many customers ask for a newer report (MS-14). Customers decide. |
Guidance
The period is the stretch of time the CPA firm tests, first day to last day, inclusive. Agree it with the firm in the engagement letter before it starts, and do not move it in the period without the firm. Where a later month lacks the day, the last day of that month is used: a three-month period starting on 31 January ends on 29 Apr 2027, one day before 30 April.
Tailoring
Keep the defaults unless a customer or the CPA firm gives you a different date. A market practice default, such as the bridge letter limit, is one because customers decide: ask your largest customers what they accept.
Milestones
Milestones
MS-01 to MS-14, dated from the period start and length on the Settings sheet. Each has the rule it carries out, a role and a named person. Enter the day each is done. The position says Done, Overdue or Coming up as at the as-at date.
The fourteen milestones
| ID | Milestone | Rule | Role | Named person | Date (calc) | Done on | Position (calc) | What to do | Notes |
|---|---|---|---|---|---|---|---|---|---|
| MS-01 | Readiness assessment complete, blocking items closed | SR-13 | Examination owner | [[name]] | 18 Dec 2026 | 17 Dec 2026 | Done | Finish the readiness assessment and close every blocking item. Take the start decision. If the work is not done, move the start date and tell the CPA firm. | |
| MS-02 | Dates and scope agreed in writing with the CPA firm | SR-16 | Examination owner | [[name]] | 18 Dec 2026 | 18 Dec 2026 | Done | Sign the engagement letter with the dates, report type, categories and system. | |
| MS-03 | Observation period starts | SR-16 | Examination owner | [[name]] | 1 Jan 2027 | 1 Jan 2027 | Done | First day of the period. Controls run as written. Do not switch one on or off for the examination. | |
| MS-04 | Management checkpoint 1: exceptions, changes, incidents and evidence so far | SR-17 | Examination owner | [[name]] | 1 Mar 2027 | 1 Mar 2027 | Done | Management looks at the Exceptions and Changes and Incidents sheets and at the evidence so far. Use the prompts on the Checkpoints sheet. | |
| MS-05 | Management checkpoint 2: exceptions, changes, incidents and evidence so far | SR-17 | Examination owner | [[name]] | 1 Apr 2027 | 1 Apr 2027 | Done | Second checkpoint. Look for a control that left no record since the last one. | |
| MS-06 | Management checkpoint 3: exceptions, changes, incidents and evidence so far | SR-17 | Examination owner | [[name]] | 1 Jun 2027 | 1 Jun 2027 | Done | Third checkpoint. Confirm who owns each open exception and when its response is due. Where this falls on the same day as another checkpoint or review, hold one meeting. | |
| MS-07 | Mid-period review of exceptions with the CPA firm (at the second checkpoint) | SR-17 | Examination owner | [[name]] | 1 Apr 2027 | Overdue | Meet the CPA firm about the exceptions so far. The firm decides how each is described in the report; management gives its response. Where this falls on the same day as another checkpoint or review, hold one meeting. | EXAMPLE: not held yet. Move the date with the CPA firm or hold it. | |
| MS-08 | Observation period ends | SR-16 | Examination owner | [[name]] | 30 Jun 2027 | 30 Jun 2027 | Done | Last day of the period. An exception found later about a day inside it is still recorded. | |
| MS-09 | Next observation period starts (the day after) | SR-16 | Examination owner | [[name]] | 1 Jul 2027 | 1 Jul 2027 | Done | The next period starts so that no day is uncovered. Its engagement letter should be in hand. | |
| MS-10 | Management's assertion and description final | SR-02 | Executive sponsor | [[name]] | 21 Jul 2027 | 20 Jul 2027 | Done | Management's assertion and description of the system are final and signed. The description is management's own. | |
| MS-11 | Report expected from the CPA firm | SR-01 | Examination owner | [[name]] | 30 Aug 2027 | Coming up | When the CPA firm is expected to issue the report. This is an estimate: replace it with the firm's date. | ||
| MS-12 | Bridge letter window opens: the gap is counted from this day; send a letter only once the report is issued (MS-11) | SR-20 | Customer-facing lead | [[name]] | 1 Jul 2027 | 15 Jul 2027 | Done | From this day a bridge letter can be drafted for a named customer. Legal reads it. It is sent only after the report is issued (MS-11) and when the examination owner releases it; before then, say where the report stands (A10, part 4). | |
| MS-13 | Bridge letter ceases to be suitable (about 3 months, market practice) | SR-20 | Customer-facing lead | [[name]] | 30 Sep 2027 | Coming up | After about this day many customers no longer accept a bridge letter. If the report is late, tell them early and plainly. | ||
| MS-14 | Report ages out with many customers (about 12 months, market practice) | SR-20 | Examination owner | [[name]] | 30 Jun 2028 | Coming up | About a year after the period ends many customers treat the report as old. Have the next report in hand before this day. |
MS-04 to MS-06 fall at one quarter, one half and three quarters of the period, rounded to the nearest month (a 12-month period has them at months 3, 6 and 9, a 6-month period at months 2, 3 and 5) and never later than the start of the last month. MS-07, the review with the CPA firm, is held with the second checkpoint. Where a customer or the CPA firm gives you a date, say so in the Notes.
Guidance
Each milestone carries out one rule of the pack guide. MS-01 and MS-02 sit before the period because it should not start with a blocking item below In place (SR-13) and the dates are agreed in writing first (SR-16). MS-10 is a house default of 21 days after the period ends. MS-11 is an estimate. MS-13 and MS-14 are market practice: customers decide how old a letter or report may be.
Worked example (EXAMPLE)
Acme starts on 1 Jan 2027 for 6 months, so the period ends on 30 Jun 2027 and the next starts on 1 Jul 2027. Readiness is complete 14 days before, on 18 Dec 2026. A bridge letter is suitable until 30 Sep 2027, and the report is expected about 30 Aug 2027.
Checkpoints
Checkpoints
The management checkpoints of the period, eleven prompts to read at each one, and how many times each frequency of control falls in your period. A checkpoint is management looking at its own record before the auditor does.
The checkpoints
| ID | Checkpoint | Date (calc) | Held on | Held by | Position (calc) | Notes |
|---|---|---|---|---|---|---|
| MS-04 | Management checkpoint 1: exceptions, changes, incidents and evidence so far | 1 Mar 2027 | 1 Feb 2027 | Examination owner (EXAMPLE) | Done | EXAMPLE: no new exceptions. One change logged (CI-01). |
| MS-05 | Management checkpoint 2: exceptions, changes, incidents and evidence so far | 1 Apr 2027 | 1 Mar 2027 | Examination owner (EXAMPLE) | Done | EXAMPLE: EX-01 fixed and retest planned. |
| MS-06 | Management checkpoint 3: exceptions, changes, incidents and evidence so far | 1 Jun 2027 | 1 Apr 2027 | Examination owner (EXAMPLE) | Done | EXAMPLE: access review redesigned; see CI-02. |
| MS-07 | Mid-period review of exceptions with the CPA firm (at the second checkpoint) | 1 Apr 2027 | Overdue |
The dates come from the Milestones sheet. Where two fall on one day, hold one meeting.
Prompts for each checkpoint
| ID | Prompt | Rule |
|---|---|---|
| CP-01 | List every exception found since the last checkpoint. Is each on the Exceptions sheet with its kind, date found and an owner? | SR-17 |
| CP-02 | Is any open exception flagged as past the checkpoint interval? Agree a response, or a date for one, and enter it. | SR-17 |
| CP-03 | For each fixed exception: has the fix operated long enough to be retested? A fix is not closed until a retest passes. | SR-14, SR-17 |
| CP-04 | Has the system or a control changed: a new service, provider, redesigned control or owner? Record it with the date and the before and after, and tell the CPA firm. | SR-18 |
| CP-05 | Has there been an incident? Record it and tell the CPA firm which ones affected a commitment. Decisions about notifying anyone follow the incident packs, unchanged. | SR-19 |
| CP-06 | Pick two controls and ask for the record each should have left since the last checkpoint. Fetch it from the system without asking the owner to rebuild it. | SR-09, SR-12 |
| CP-07 | Has anyone who owns a control left or moved? Name the new owner and brief them. | SR-09 |
| CP-08 | Has a provider that runs part of the system reported a new exception or change? Read its report again and decide whether your description or assumed controls change. | SR-06 |
| CP-09 | Has a customer commitment or contract changed in a way that touches the system or the categories? If so, re-scope and tell the CPA firm. | SR-08 |
| CP-10 | Do the dates still hold? Confirm fieldwork and report dates with the CPA firm. | SR-16 |
| CP-11 | Is the next period on the calendar, with its engagement letter? | SR-16 |
Records that sit with other documents: the deficiency tracker (P20-A08 Control Deficiency & Remediation Tracker) holds a gap to a retest; the incident plan (P09-A03 Incident Response Plan) holds the decisions about who is told of an incident.
How many times a control falls in the period
| Frequency | What it means for the evidence | Times a year | In the period (calc) | What to do (calc) |
|---|---|---|---|---|
| event | Each time it happens | Count the events, or keep the configuration and logs | ||
| continuous | Continuously | Count the events, or keep the configuration and logs | ||
| daily | Daily | 365 | 182 | At least one falls in the period |
| weekly | Weekly | 52 | 26 | At least one falls in the period |
| monthly | Monthly | 12 | 6 | At least one falls in the period |
| quarterly | Quarterly | 4 | 2 | At least one falls in the period |
| halfyearly | Twice a year | 2 | 1 | At least one falls in the period |
| annual | Once a year | 1 | 0 | May not fall in the period: schedule one inside it |
The count is whole occurrences, rounded down. The CPA firm decides which it samples and how many; keep every occurrence.
Guidance
A control that happens once a year may not fall in a short period. Where the count is 0, schedule one occurrence inside the period and keep its record. A control that runs each time something happens has as many occurrences as there are events; if there are none, ask the CPA firm how it will treat that.
Exceptions
One row for each exception: a sampled occurrence in which a control did not operate as described. Record it when found; never remove it (SR-17). The form for a full management response is in Bridge Letter & Management Response Templates (P32-A10).
Kinds: EK-1 Control not performed; EK-2 Performed late; EK-3 Performed without evidence; EK-4 Performed by the wrong person; EK-5 Control changed in the period. The CPA firm decides how an exception is reported. Management gives its response.
| Row | ID | Control | Date found | Kind | Kind in words (calc) | Response: Cause | Response: What management did or will do | Response: Owner | Response: Date | Response: Effect on customers, if any | Status | Date closed | Check (calc) | Flag (calc) | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | EX-01 | EV-07 Periodic access reviews of in-scope systems | 10 Feb 2027 | EK-2 | Performed late | The quarterly review of production database access was done nine days after the date the control states. The reviewer was on leave and no deputy was named. | Named a deputy for every review and put each review date on the shared calendar. The next review ran on time and was retested. | Head of Information Security (EXAMPLE) | 17 Feb 2027 | None known. The review found no access that should have been removed. | Fixed and retested | 15 Apr 2027 | OK | ||
| EXAMPLE | EX-02 | EV-06 Leaver access removal records | 22 Mar 2027 | EK-3 | Performed without evidence | A leaver's access was removed on the day, but the ticket was closed without the record of the removal. | Made the removal record a required field of the leaver ticket. The HR lead will read the leaver tickets at each checkpoint. | HR lead (EXAMPLE) | 29 Mar 2027 | None for customers. The leaver had no access to customer data. | Management response agreed | OK | |||
| EXAMPLE | EX-03 | EV-09 Change records with review, test and approval | 3 May 2027 | EK-4 | Performed by the wrong person | Open | OK | Open past the checkpoint interval | |||||||
| EXAMPLE | EX-04 | EV-13 Backup success and a restore test | 15 Jul 2027 | EK-1 | Control not performed | The half-year restore test was planned for June and was not run. The owner was handling an incident. | Open | OK | |||||||
| EXAMPLE | EX-05 | EV-07 Periodic access reviews of in-scope systems | 12 Apr 2027 | EK-5 | Control changed in the period | After EX-01 the access review was redesigned from quarterly to monthly. The redesign is a significant change. | Recorded the change as CI-02 and told the CPA firm. The first monthly review ran in May. | Head of Information Security (EXAMPLE) | 14 Apr 2027 | None for customers. The control is stricter than before. | Accepted and described | 10 Jul 2027 | OK |
Changes and Incidents
One row for each significant change to the system or its controls (DC-9) and each incident of the period (DC-4). This is a record. It decides nothing about who is told: notification decisions follow the incident documents of the earlier packs, unchanged.
Tell the CPA firm of every significant change, and of each incident that affected a commitment (SR-18, SR-19). Do not freeze the business to protect the period. A change to a control may also be an exception of kind EK-5: enter the exception ID in the column headed Exception ID.
| Row | ID | Type | Date | What changed, or what happened | System or control affected | Before and after (a change), or the extent and how it was resolved (an incident) | Did it affect a commitment to customers? | Date the CPA firm was told | Record: change ticket or incident record | Exception ID, if it is an EK-5 | Owner | Check (calc) | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | CI-01 | Change (DC-9) | 1 Feb 2027 | Customer data hosting moved from one region to two regions of the same provider. | Hosting and backups | Before: one region, with backups kept in the same provider account. After: two regions, with the backup copied to the second. Access and encryption controls are unchanged. | Yes | 3 Feb 2027 | Change ticket CHG-1042 (EXAMPLE) | Head of Engineering (EXAMPLE) | OK | ||
| EXAMPLE | CI-02 | Change (DC-9) | 12 Apr 2027 | The review of access to in-scope systems changed from quarterly to monthly. | EV-07 Periodic access reviews of in-scope systems | Before: a quarterly review by the Head of Information Security. After: a monthly review with a named deputy. | No | 14 Apr 2027 | Change ticket CHG-1107 (EXAMPLE) | EX-05 | Head of Information Security (EXAMPLE) | OK | |
| EXAMPLE | CI-03 | Incident (DC-4) | 19 May 2027 | A configuration error made the invoice export unavailable for some customers for part of one afternoon. The web application and API stayed up. | Invoice export | Rolled back the configuration the same afternoon and added a check to the release steps. The monthly availability commitment was not missed. | No | Incident record INC-0519 (EXAMPLE) | Head of Engineering (EXAMPLE) | OK | |||
| EXAMPLE | CI-04 | Incident (DC-4) | 8 Jun 2027 | The hosting provider had an outage that made the web application unavailable for part of one morning. | Web application and API | Service returned when the provider restored its region. The monthly availability commitment for June was missed. Customers were told through the status page. | Yes | 10 Jun 2027 | Incident record INC-0608 (EXAMPLE) | Head of Engineering (EXAMPLE) | OK |
Bridge Letters
One row for each report and customer that needs cover for the interval after a report period ends. A bridge letter is management's statement. The CPA firm does not issue it, performs no procedures on the interval and gives no assurance over it. Market practice, not an AICPA document.
Status as at the as-at date on the Settings sheet: Period still running; Bridge letter suitable (within the bridge letter limit; send a letter only once the report is issued, MS-11); Beyond a bridge letter: send the next report; Next report issued. Share the letter by the sharing tier of the evidence library (P26-A05 Evidence & Attestation Library Index) and name the report exactly.
| Row | The report: type, categories and period | Customer the letter is for | Last day of the report period | Date the next report was issued | Status (calc) | Gap in days (calc) | Suitable until (calc) | Date the letter was issued | Who signed | Check (calc) | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | SOC 2 Type 2 report, Security, Availability and Confidentiality, 1 January to 30 June 2027 (EXAMPLE) | Customer A (EXAMPLE) | 30 Jun 2027 | Bridge letter suitable | 32 | 30 Sep 2027 | No letter issued yet | EXAMPLE: told on 15 July where the report stands, in the approved words (MS-12 opens the window). No letter is sent until the report is issued (MS-11). | |||
| EXAMPLE | SOC 2 Type 2 report, Security, Availability and Confidentiality, 1 January to 30 June 2027 (EXAMPLE) | Customer B (EXAMPLE) | 30 Jun 2027 | Bridge letter suitable | 32 | 30 Sep 2027 | No letter issued yet | EXAMPLE: asked for the report on 1 August 2027. The report is expected on 30 August 2027. |
Summary
Summary
Counts and words only. Exceptions by kind and status, changes and incidents, milestones by position, bridge letters by status, and eight checks. A count is work left or work done. It is not a score and it is not a view on the CPA firm's opinion.
Exceptions by kind and status
| Kind | Open | Management response agreed | Fixed and retested | Accepted and described | Total (calc) |
|---|---|---|---|---|---|
| EK-1 Control not performed | 1 | 0 | 0 | 0 | 1 |
| EK-2 Performed late | 0 | 0 | 1 | 0 | 1 |
| EK-3 Performed without evidence | 0 | 1 | 0 | 0 | 1 |
| EK-4 Performed by the wrong person | 1 | 0 | 0 | 0 | 1 |
| EK-5 Control changed in the period | 0 | 0 | 0 | 1 | 1 |
| Total | 2 | 1 | 1 | 1 | 5 |
Other counts
| Measure | Count (calc) |
|---|---|
| Exceptions logged | 5 |
| Exceptions still Open | 2 |
| Open exceptions past the checkpoint interval | 1 |
| Exceptions whose own check is not OK | 0 |
| Significant changes logged (DC-9) | 2 |
| Incidents logged (DC-4) | 2 |
| Incidents that affected a commitment | 1 |
| Rows where it is not yet known whether a commitment was affected | 0 |
| Rows where the CPA firm has been told (a date is entered) | 3 |
| Milestones Done | 10 |
| Milestones Overdue | 1 |
| Milestones Coming up | 3 |
| Bridge letters: Period still running | 0 |
| Bridge letters: Bridge letter suitable | 2 |
| Bridge letters: Beyond a bridge letter: send the next report | 0 |
| Bridge letters: Next report issued | 0 |
| Bridge letters issued (a date is entered) | 0 |
Eight checks
| Check | Result | Of | Status (calc) |
|---|---|---|---|
| CK-01 The period start date and length are entered, and the length is a whole number of months. | 1 | 1 | Clear |
| CK-02 The six settings on the Settings sheet are numbers. | 6 | 6 | Clear |
| CK-03 The as-at date is entered. | 1 | 1 | Clear |
| CK-04 No milestone is overdue: each milestone with a date is either done or still to come. | 13 | 14 | Action needed |
| CK-05 Every row of the Exceptions sheet passes its own check. | 5 | 5 | Clear |
| CK-06 No open exception has waited longer than the checkpoint interval. | 1 | 2 | Action needed |
| CK-07 Every row of the Changes and Incidents sheet passes its own check. | 4 | 4 | Clear |
| CK-08 Every row of the Bridge Letters sheet passes its own check. | 0 | 2 | Action needed |
| Checks needing action | 3 | 8 | checks |
A count of work left. A calendar with none still needs the examination owner's review.
Guidance
Read the matrix across the rows: an exception still Open is the first thing to settle. Read it down the columns: many exceptions of one kind point to one cause, such as a deputy who was never named. Do not reach zero by deleting rows; removing an exception from the evidence is against SR-17.
Lists
| ListKind | ListKindName | ListStatus | ListType | ListCommit | ListMonths |
|---|---|---|---|---|---|
| EK-1 | Control not performed | Open | Change (DC-9) | Yes | 3 |
| EK-2 | Performed late | Management response agreed | Incident (DC-4) | No | 6 |
| EK-3 | Performed without evidence | Fixed and retested | Not yet known | 12 | |
| EK-4 | Performed by the wrong person | Accepted and described | |||
| EK-5 | Control changed in the period |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Observation period | The period a Type 2 report covers, from its first day to its last, both inside it. A six-month period starting on 1 January ends on 30 June. Three, six and twelve months are market practice, not an AICPA rule. |
| Month-end rule | The same day of a later month, or the last day of that month where it has no such day. A period of 3 months starting on 31 Jan 2027 ends on 29 Apr 2027: 31 Jan 2027 plus 3 months is 30 Apr 2027, and the period ends one day before. |
| As-at date | The day the workbook is read as of. It never reads the clock. |
| Position | Done: the day it was done is entered. Overdue: its date is before the as-at date and no day is entered. Coming up: its date is on or after the as-at date. |
| Management checkpoint | A look by management at its own exceptions, changes, incidents and evidence during the period: three checkpoints (MS-04 to MS-06) at one quarter, one half and three quarters of the period, and one review with the CPA firm held with the second (MS-07). The checkpoint interval, which is 1 month by house default, is how long an exception may stay Open before it is flagged. |
| Exception | A test result in which a control did not operate as described for a sampled occurrence. The CPA firm decides how it is reported. Management records the cause and its response. |
| EK-1 Control not performed | No occurrence at all in the sampled item. |
| EK-2 Performed late | Performed, but after the time the control states. |
| EK-3 Performed without evidence | Performed, but no record that the auditor could inspect. |
| EK-4 Performed by the wrong person | Performed by someone other than the owner or approver the control states. |
| EK-5 Control changed in the period | The control was redesigned. Also a significant change to record (DC-9). |
| Open | Recorded. No management response is agreed yet. |
| Management response agreed | The five response fields are written and the owner has accepted them. The fix may not have operated yet. |
| Fixed and retested | The fix is in place, has operated for a while and a retest has passed (P20-A08 Control Deficiency & Remediation Tracker, CA-14). |
| Accepted and described | Management leaves the control as it is, or the event cannot recur, and the description of the system says so. Record it as a risk decision (P05). |
| Response fields | Cause; What management did or will do; Owner; Date; Effect on customers, if any. Together they make a management response. The full form is in Bridge Letter & Management Response Templates (P32-A10). |
| Significant change (DC-9) | A change to the system or its controls that matters to the commitments, with its date and how it differed before and after. This pack's label for the ninth description topic; the CPA firm confirms the wording. |
| Identified incident (DC-4) | A security incident or control failure that caused a significant failure to meet a commitment in the period. This pack's label for the fourth description topic; the CPA firm confirms the wording. |
| Bridge letter | A letter from your management that covers the interval after a report period ends. The CPA firm does not issue it, performs no procedures on the interval and gives no assurance over it. Market practice, not an AICPA document. |
| Period still running | The as-at date is on or before the last day of the report period. |
| Bridge letter suitable | The as-at date is after the period and within the bridge letter limit (3 months by default, market practice). |
| Beyond a bridge letter: send the next report | The as-at date is past the limit and the next report has not been issued. Customers will usually ask for the report. |
| Next report issued | The next report was issued on or before the as-at date. The gap ended that day. |
| Gap in days | Days from the last day of the period to the as-at date, or to the date the next report was issued. 0 while the period still runs. |
| CPA firm | The licensed firm of certified public accountants that examines management's description and controls and issues the report. Also “the auditor”. |
| House default, market practice | A starting value this pack sets, and what advisory sources and customers commonly accept. Neither is an AICPA rule; your CPA firm and customers decide. |
| SR-nn, MS-nn, CP-nn, CK-nn, EK-n | SR-nn are rules of the pack guide, MS-nn milestones, CP-nn checkpoint prompts, CK-nn checks and EK-n kinds of exception. P20 CA-14 is a rule of an earlier pack. |
| EXAMPLE | A worked example: Acme Corp (EXAMPLE). Every name and value is made up. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 10.2 — Nonconformity and corrective action | Exceptions sheet: the cause and the response recorded for each exception, and the retest that closes it |
| NIST CSF 2.0 | ID.IM-03 — “Improvements are identified from execution of operational processes, procedures, and activities” | Checkpoints and Exceptions sheets: improvements identified from running the controls through the period |
| AICPA, SOC 2 | The AICPA's SOC 2 guide (October 2022, read on 20 October 2026 in the free PDF on the AICPA site) sets no minimum observation period for a Type 2 report. It says (paragraph 2.54) that for a period of less than two months a service auditor may conclude that sufficient evidence is unlikely, and that for nine months it is likely, and it leaves the decision to the CPA firm. Three, six and twelve months are what advisory sources call common, and customers set their own expectations. This is market practice, and the pack prints it as market practice, not as a rule of the AICPA. The CPA firm agrees the period in the engagement letter | Settings and Milestones sheets: the period dated from a start date and a length, with the lengths named as market practice |
| AICPA, SOC 2 | A bridge letter (or gap letter) is a letter from the service organisation's management that covers the interval after a report period ends. Advisory sources agree that the CPA firm performs no procedures on that interval and gives no assurance over it, and that about three months is the usual limit. The AICPA's SOC 2 guide (October 2022, read on 20 October 2026) does not use the term: it says (paragraphs 3.78 and 3.79) that a gap can fall between the periods of two Type 2 reports and that management may describe a significant change in the gap under ‘Other Information Provided by the Service Organization’. No AICPA definition or rule was found for a bridge letter. It is market practice, and customers decide whether they accept one | Bridge Letters sheet: the status, gap in days, date issued and signatory of each letter, with the limit named as market practice |
| AICPA, SOC 2 | AICPA Trust Services Criteria (TSP section 100), introduction: a Type 2 SOC 2 report gives an opinion on the suitability of design and operating effectiveness of controls throughout a specified period and describes the tests and results; a Type 1 report addresses the same subject matter without an opinion on operating effectiveness or a description of tests, and is as of a specified date. The Journal of Accountancy (2016, an AICPA publication) gives the same split for SOC 1 and says SOC 2 reports come in both types. Neither source states a minimum period | Settings sheet: a Type 2 report covers a period, which the workbook dates |
| AICPA, SOC 2 | SOC 2 CC4.2, Monitoring Activities | Exceptions and Checkpoints sheets: where deficiencies found are recorded, owned and followed up |
| AICPA, SOC 2 | SOC 2 CC7.4, System Operations | Changes and Incidents sheet: where the incidents of the period are recorded (decisions about response and notification are in the incident documents) |
Editions referenced: AICPA Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022), by number and series title only; the AICPA description criteria (DC section 200, 2018, with revised implementation guidance, 2022), by topic only; ISO/IEC 27001:2022 and NIST CSF 2.0, by number and title; the Journal of Accountancy and the AICPA & CIMA pages named in the references; as published and read on 18 October 2026
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that holding an ISO/IEC 27001 certificate equals, replaces or shortens a SOC 2 examination.
A reference says what its source describes and which CISO Times document helps with that work. It does not say that a document from this pack meets a criterion, and it does not say that an organisation will receive an unqualified opinion.
Criteria are cited by number and series title only. The statements of the criteria are in the Library. Citing a criterion does not say that any document, control or practice meets it.
This pack does not say which document, record or practice meets a criterion. Each reference says what its source describes and which CISO Times document helps with that work. Using a document does not by itself show that a criterion is met.
The Trust Services Criteria and the description criteria are published by the AICPA for CPAs who examine a service organisation. Nothing in law makes a SOC 2 report mandatory. A customer's contract, a procurement policy or an investor can ask for one, and the organisation chooses whether to commission an examination. The report is a CPA firm's opinion about the organisation's description and its controls. It is an attestation, not a certificate, and nobody is “SOC 2 certified” or “SOC 2 compliant” by holding one.