SOC 2 renewal cost and cycle: running Type 2 each year

What a SOC 2 renewal involves and what it costs each year

When a customer or bank asks for your current SOC 2 Type 2 report, the budget owner needs two answers: what renewal costs each year and how long it takes. The organization owns its controls, an independent CPA firm issues the report, and the recurring cost comes from four places: the audit fee, internal staff time spent on evidence and walkthroughs, the tools that generate evidence, and any implementation partner you bring in to prepare systems and records. The audit fee is the only line the auditor sets. The Justice Department, in its October 2024 rule (89 FR 86116), summarized annual audit costs for CCPA, GDPR and SOC 2 compliance as ranging from $3,000 to $150,000 depending on audit type and firm size. That range is broad, so treat it as a starting point and ask each firm for a fee built from a written scope.

The answer differs by organization because the drivers differ. A security-only report on a small platform with one cloud account and few changes costs less to renew than a report covering availability, confidentiality and privacy across several products, multiple regions and a dozen subservice organizations. Ask your auditor how many trust services categories, system components, significant changes and third parties fall inside the period, and ask how many control instances they will sample. Evidence maturity matters as much as scope. If access reviews, change tickets and vulnerability reports are already produced automatically and stored in one place, the internal hours each year fall. If they are assembled by hand before each fieldwork window, expect the staff cost to be the largest recurring line.

Before you request quotes, confirm the scope in writing, the expected fieldwork dates, which evidence the firm will request and what the engagement letter says about follow-up periods. DeployOpen prepares systems, controls and evidence for the examination on a fixed scope agreed in writing, but it does not issue SOC 2 reports, attestations or opinions. Only the independent CPA firm does that, so budget for the auditor's fee separately from any preparation work.

How the annual SOC 2 renewal cycle runs, phase by phase

The renewal sequence keeps each Type 2 observation period starting where the last one ended, so every year's report links cleanly to the one before it. Each phase produces a named output that the auditor can test.

Close the prior observation period
Confirm the prior period's end date, freeze its evidence set and log every exception, deviation or late control execution found during the period. Management, usually the compliance lead with control owners, reviews the open items and records how each was remediated. The output is a closed evidence folder and an exception log that the auditor can reference when they compare this year with last year. The step is done when no evidence for the closed period is still being added or changed.
Refresh the system description and risk assessment
Review the system description against what the platform actually looks like now, covering services, components, subservice organizations, significant changes and incidents from the prior period. Update the risk assessment for new threats, changed systems and vendor changes, and note which changes were assessed under CC3.4. The outputs are a revised system description, a dated risk register and a change log for the new period. Confirm the expected content with the auditor before drafting, since the system description is evaluated against the 2018 description criteria.
Update the control matrix and assign owners
Map each criterion in scope to the controls that meet it, the evidence each control produces and the person accountable for running it. Remove controls that no longer exist, add controls for new systems and confirm that the complementary user entity controls and subservice organization carve-outs still match the design. The output is a current control matrix signed off by management. It is done when every in-scope criterion points to at least one owned, evidenced control.
Run controls and collect evidence through the new period
Control owners perform the controls on their normal schedule and store the proof of performance as it occurs, such as access review sign-offs, change approvals, backup restore records and training completions. The compliance lead checks periodically that each control ran and that evidence is complete, and logs deficiencies as they arise. The output is a continuous evidence library covering the whole new period. Waiting until the end of the period to collect evidence is the most common reason renewals run late.
Hand samples to the auditor for fieldwork
The auditor selects samples from the period and requests the matching evidence through a request list, which the preparer answers with the source records and a short description of each. Auditors test operating effectiveness across the period, so the sample set reflects control activity from start to finish. The output is a completed set of request responses and a list of open questions with owners and dates agreed in advance. Confirm the fieldwork schedule and deliverable timing against the auditor's engagement letter, since the agreed timetable governs.
Obtain management's representations and the signed report
Management signs a written assertion about the system description and the effectiveness of controls, and a representation letter confirming the information it gave the auditor was complete and accurate. The auditor issues the Type 2 report only after these are in place and any exceptions have been discussed. The output is the signed report, which the organization then shares with customers under its own distribution terms. Check that the report period, the system description and the exception list match what the team recorded during the period.
Issue bridge letters where needed
If customers or regulated buyers need assurance about the gap between the end of the report period and today, management prepares a bridge letter describing whether controls and significant changes remained consistent since the period ended. The letter is management's statement, not the auditor's report, and its scope should be agreed with the auditor. The output is a dated bridge letter with the period it covers. Keep a copy with the report so that reviewers can see the continuity.
Start the next period without a gap
Begin the new observation period on the day after the prior one ends, so that no day falls outside a tested period. Carry forward open remediation items, confirm that controls changed during the cycle are recorded with their effective dates and brief the control owners on the next cycle's evidence expectations. The output is an opened period with a start date that matches the closed period's end. Confirm the period boundaries with the auditor in writing before the new period begins.

Who is paid for what in a SOC 2 renewal

This table compares each recurring cost in a yearly SOC 2 Type 2 cycle by who is paid, whether it recurs, and what moves it up or down. Use it to see where the CPA firm, your own staff, tooling vendors and any implementation partner each fit, then compare written quotes line by line. The main takeaway is that the examination fee is only one part of the annual spend.

Cost component	Who is paid	One-time or recurring, and what drives it
CPA firm examination fee	The CPA firm issuing the Type 2 report	Recurring each cycle. Driven by the number of criteria in scope, the observation period length, the number of samples tested and the number of subservice organizations. The Justice Department's October 2024 rule summarized annual SOC 2 and similar audit costs as ranging from $3,000 to $150,000 depending on audit type and firm size (89 FR 86116).
Management and staff time for evidence and control operation	Your own employees (internal cost, not an invoice)	Recurring across the full period. Driven by how many controls are manual, how often access reviews and vendor reviews run, and whether evidence is captured when the control operates or rebuilt at audit time.
Tooling and GRC subscriptions	Software vendors, including identity, ticketing, logging and GRC platforms	Recurring annual or per-seat licenses. Driven by headcount, number of integrated systems and whether you self-host open-source components, which shifts cost to hosting and maintenance.
Implementation partner support for evidence and system changes	An outside firm, under a written scope if engaged	Recurring if retained, one-time for a defined project. Driven by how many system changes occur in the period, how much evidence is automated and whether the partner maintains controls or only prepares them. Confirm that the partner does not issue or sign the report.
Bridge letter preparation	Your team, and the CPA firm if it reviews or issues the letter	Recurring at each period boundary. Driven by how many customers and auditors require coverage beyond the report end date and how quickly management can attest to controls since period end.
Re-scoping a category or adding a subservice organization	The CPA firm for added testing, and your team or a partner for the new control work	Recurring once the change takes effect. Driven by the criteria added, the number of new vendors or carve-out controls to review and whether the change falls in the current period or the next.

How bridge letters close the gap between back-to-back reports

A Type 2 report covers a stated period, and nothing in the report itself speaks to the days that follow its end. A customer reviewing a report later may therefore see a gap between the period end and today, and a bridge letter is the usual way to address it. A bridge letter is management's written update covering the time between the period end and the letter date. It is generally an addendum that sits alongside the report, not a substitute for it, and it does not carry the auditor's opinion on operating effectiveness for the bridged days.

Large providers show how this works in practice. AWS issues its SOC 2 reports twice a year for 12-month periods ending March 31 and September 30, so each report is always reasonably current when read. Azure uses a rolling 12-month audit period, issues new reports semi-annually for periods ending March 31 and September 30, and supplements them with bridge letters issued in the first week of each quarter, all available from the Service Trust Portal. Your own renewal plan should decide the same things: which period ends you will report on, when the next report will land, and who will issue the bridge letter that covers the months in between. This example is illustrative of the pattern, not a template to copy.

Before you issue or accept a bridge letter, ask your auditor what it may and may not say, and whether its wording needs their review. Confirm the letter date, the period it covers, and whether any exceptions or significant changes since period end must be disclosed in it. The AICPA's SOC 2 Report Walkthrough lists bridge letters as a key topic for both report users and service auditors, which makes it a useful reference for your team and for any customer who asks how the gap is handled.

What makes the renewal cost more or less each year

Renewal cost follows the size and stability of what the auditor must examine. Each driver below changes the testing population, the evidence to collect, or the description to write, so decisions made during the period show up in the next fee and effort.

Trust services categories in scope

Every category added beyond security brings its own criteria, points of focus and testing population. Adding availability, confidentiality, processing integrity or privacy after a security-only report usually means new controls and new evidence, not just a longer report. Freeze the category list at the start of each period and ask the auditor in writing whether any change this year would expand fieldwork. Record the reason for any scope change before the period begins, so the fee conversation is based on a fixed baseline.

Number and size of system changes

Auditors test a sample of changes in the period, and a high volume of changes, or a few large ones such as a new region or database engine, widens the population and the explanations required. Keep a standing change log that links each change to its ticket, approval and test result. Ask the team to flag significant changes as they happen so the system description can be updated while the details are still fresh.

Subservice organizations and carve-out treatment

Each subservice organization, such as a cloud host or payment processor, is either carved out with its own SOC report reviewed, or included in testing. Carve-out keeps testing narrower but requires current vendor reports, bridge letters where periods do not align, and complementary subservice controls mapped to your own. Inventory every vendor each year, confirm report coverage dates against your period, and collect the vendor reports before fieldwork begins.

Locations and systems sampled

The number of locations, production environments and in-scope systems determines how many items the auditor samples for access reviews, change tickets and incident records. Adding a region or product line expands every sample that touches it. Keep a current system inventory with owners and environment tags, and decide each year whether a new environment belongs in scope. Ask the auditor how sample sizes are set for your population before the period starts.

Evidence maturity

Teams that rebuild evidence from screenshots and chat threads each audit spend the fieldwork period searching for records. Automated, retained evidence reduces that effort: access reviews exported on a schedule, logs held in a central store, and training and onboarding records kept in one system. Set retention rules for each evidence type and assign an owner who checks completeness monthly. Ask the auditor which evidence they accept directly from system output.

Stability of the control environment

A stable team, stable control owners and stable policies produce fewer exceptions and fewer re-performed walkthroughs. Turnover in the people who run access reviews or incident response often causes gaps that surface as exceptions. Name a control owner for each control, record handover steps when someone leaves, and review policies once a year against the actual process. Exceptions raised in one period are the most common reason the next period needs extra testing.

Updating the system description for changes during the period

Management owns the system description, and it must be refreshed before every renewal so that it matches the system the auditor actually tests. Under the AICPA's 2018 description criteria, DC 200, with revised implementation guidance issued in 2022, the description has to cover the services provided, the principal service commitments, the system components, the applicable trust services criteria and related controls, the subservice organizations and their complementary controls, and the criteria that do not apply. A description written around last year's architecture will produce questions from the CPA firm and from every customer who reads the report, because the controls being tested will not line up with the system being described.

Three description criteria are most often stale at renewal. DC9 requires disclosure of significant changes during the period, so any migration, new product, new region or major vendor change must appear in the description with its timing. DC4 requires disclosure of significant system incidents, which should be pulled from the same incident records that feed CC7. DC8 covers subservice organizations, so a cloud provider, data processor or monitoring tool that was added or replaced must be reflected, along with the complementary subservice organization controls that customers should rely on. Confirm each item against your own infrastructure inventory rather than against memory of the prior year.

Keep a change register that the team updates when a change is approved, not at the end of the period. Each entry should record the date, the system component or service affected, the reason, the CC8 approval reference, the CC3.4 assessment of its effect on internal control, and the description section it touches. At each period end, the register becomes the checklist for the description draft, and management confirms the result in its written assertion. Ask your CPA firm early which level of detail it expects for changes, because the firm evaluates the description but does not write it for you.

Who owns each part of the renewal and who only supports it

Management owns the system and its controls. The organization decides which services and commitments are in scope, writes the system description, performs and documents the risk assessment, and signs the written representations the service auditor relies on. Management is also accountable for whether the evidence it hands over is complete and accurate, because the examination is an assertion-based engagement under AT-C section 205 and the auditor cannot substitute its own judgment for management's knowledge of the environment.

System description updates: Management revises the description each year for changes in infrastructure, subservice organizations, incidents and significant changes during the period, as the description criteria require.
Risk assessment ownership: Management owns the risk assessment under CC3, including reviewing whether risks and objectives have shifted since the last period.
Representation letter: Officers sign the management representation letter and must be able to support each statement in it.
Control operation and evidence accuracy: Control owners run the controls every period and keep the evidence complete, so the auditor's samples reflect what actually happened.
Deficiency handling: Management evaluates exceptions, decides on remediation and reports the outcome to the auditor.

Before engaging anyone, confirm that a named owner exists for each of these items and that the owner has time to review them.

What peer reviewers compare when this year's report is set against last year's

Peer reviewers and report users read each new SOC 2 report beside the one before it, looking for changes that do not have a documented reason. The cards below cover the places where a renewal most often looks copied, unexplained or overstated, and what the organization should be able to show for each.

Identical risk assessments year over year

An AICPA peer review alert issued in May 2026 treats identical risk assessments as a risk indicator. A renewal that repeats last year's risk register word for word suggests the risk assessment under CC3 was not performed for this period. Show a risk assessment dated within the period that reflects the year's events, such as new vendors, incidents, reorganizations or platform moves, and record what changed in the risk ratings and why.

Unchanged sample sizes and procedures

Testing procedures and sample sizes that match the prior year exactly raise the same peer review concern as identical risk assessments. The auditor's sample size should follow from the population, the control's frequency and the risk, so a population that grew or shrank should produce a different sample. Ask the CPA firm to explain the sample size for each control, and keep the population reports that support those counts.

Exceptions without root causes

When the number or type of exceptions moves between years, readers ask why. A new exception on a control that passed last year, or a repeat exception left open, needs a root cause and a corrective action with dates. Keep the ticket history, the remediation evidence and the retest result for each exception, so the new report shows what failed, what was fixed and whether the fix held.

System description that lags the period

The system description must disclose significant changes during the period under DC 200, and a description that matches last year's word for word will not show them. Compare the system components, subservice organizations and incidents against the infrastructure inventory and change log for the period. Any new service, moved data store or replaced vendor should appear in the description with its effective date.

Control owners changed without handover

When a control owner leaves or moves, the control still has to operate and be evidenced from the first day of the new owner. Reviewers look for a documented handover, updated control matrix entries and access review sign-offs from the new owner. A gap between the last action by the old owner and the first action by the new one is a common source of exceptions in a Type 2 period.

Promises of a fast, easy renewal

The February 2026 Journal of Accountancy piece on fast and easy SOC promises warns that such claims threaten the credibility of the examination. A renewal cannot be shortened by reusing last year's evidence, and no tool replaces the operating history a Type 2 opinion covers. Before signing with any consultant or platform, ask what the period must contain, which evidence the auditor will sample, and what the organization must do itself.

Questions buyers ask about running SOC 2 renewals

How much more effort is a SOC 2 renewal compared with the first report?

A renewal is usually less work than the first report, but only if the controls kept operating and left evidence throughout the period. The first report carries the cost of building the control set, writing policies and fixing gaps found during readiness. A renewal shifts effort toward proving that controls ran consistently across the new period, reviewing what changed in the system, and explaining any exceptions from the prior year. The main drivers are how much the platform, team and vendors changed, how well evidence was collected as it happened, and how many exceptions need explaining. Ask any auditor to scope the renewal in writing, including which changes they will test.

Is a gap between SOC 2 reports acceptable, and what is a bridge letter?

Customers and their regulators generally expect back-to-back coverage, so a gap between the end of one period and the start of the next is a common reason for questions. A bridge letter is a management-issued letter that covers the time between the end of the report period and a later date, stating whether known changes or exceptions affect the controls. The AICPA's SOC 2 Report Walkthrough lists bridge letters as a key topic for report users. Bridge letters are not a substitute for a current report, and their content and who receives them should be agreed with your auditor and your customers in advance.

Does a SOC 2 report from AWS or Azure cover our own controls?

No. A cloud provider's SOC 2 report covers the provider's own infrastructure and controls, and it is one input to your report, not a replacement for it. Under the shared responsibility model, your team still owns controls such as user access, configuration, logging, change management and data handling inside the services you run. AWS issues its SOC 2 and SOC 3 reports twice a year for 12-month periods ending March 31 and September 30, and Azure uses a rolling 12-month period with bridge letters supplied through the Service Trust Portal. Your auditor will typically test the provider report as a subservice organization and then examine the controls you own.

What does the renewal need from our internal staff?

The renewal needs named control owners who can show that their controls ran during the period, not only that the controls exist on paper. Typical tasks include producing access review records, joiner and leaver tickets, change approvals, vulnerability and patch records, backup restore tests, incident records and security training completions. Engineering, IT, HR and the executive team each own parts of the evidence. Assign a single internal coordinator who keeps the population lists and evidence requests organized, because auditors sample from populations and gaps in those lists are hard to explain late in fieldwork. Confirm the time commitment with your auditor before the period starts.

Can we run the SOC 2 renewal ourselves without outside help?

Yes, an organization can run its own renewal, because the organization owns its controls and management's assertion. The work becomes difficult when the same people operate the controls and also collect and organize the evidence, or when nobody tracks changes and exceptions during the period. Many teams handle the renewal internally once the first report is complete and the control matrix is stable. The independent CPA firm performs the examination and issues the report, and it must remain independent of the organization's preparation work. Confirm with your auditor which preparation tasks they can rely on and which they must perform themselves.

When should we bring in an implementation partner, and what does it do?

Bring in a partner when internal staff cannot keep controls and evidence running alongside their regular work, or when the platform changes faster than the team can document it. DeployOpen plans, implements, hardens, backs up, documents and supports self-hosted open-source platforms in your own infrastructure, and prepares systems, controls and evidence for compliance assessments. DeployOpen does not issue audit reports, attestations or certifications, and does not act as your CPA firm. Most engagements are fixed-scope, with scope and deliverables agreed in writing before work starts, and ongoing support is available as a retainer. Ask for the written scope before committing, since it defines who does what.

Can we change our CPA firm without a gap in coverage?

A change of auditor can be made without a coverage gap if it is timed around the report period and the new firm agrees to the examination scope before fieldwork begins. Confirm the new firm's license and peer review status, and ask how it will treat evidence and testing already completed by the previous firm. Most coverage problems come from switching mid-period or leaving a gap between the old firm's last report and the new firm's first. Review the timing guidance in the dedicated guide on changing SOC 2 auditors before you sign an engagement letter.

How long does a SOC 2 report stay current for customers?

No single rule sets how long a SOC 2 report stays current, so customers and their regulators decide what they accept. Most customers ask for the most recent report covering a period ending within the last year, plus a bridge letter for the time since. The report itself covers the examination period stated in it, not the date it was issued. The AICPA's guidance on reading SOC 2 reports covers how to judge exceptions and scope, and banks in U.S. third-party risk guidance are expected to request audit reports at a frequency set in their contracts. Write the report frequency into your customer contracts so that expectations are clear before the next period ends.

How DeployOpen prepares each year's SOC 2 evidence

DeployOpen prepares the systems, controls and evidence that a SOC 2 Type 2 cycle depends on, so the organization can carry each period into the next without gaps. DeployOpen does not issue reports or opinions; the independent CPA firm does.

How we scope

Engagements are fixed-scope, with the systems, periods and deliverables agreed in writing before work starts.
The written scope names which platforms, environments and controls feed the next period's evidence and who owns each one.
Scope also lists what is out of DeployOpen's role, including the report itself, which only the independent auditor issues.

How we build

Self-hosted open-source platforms are configured to generate logs, access records and change history inside your own infrastructure.
Evidence collection is set up so that recurring records, such as access reviews and vulnerability scans, are captured as the period runs.
Controls are tested internally against the control matrix before the auditor's fieldwork, so gaps surface while there is still time to fix them.

How we hand over

Runbooks document each recurring control, its owner, its frequency and the evidence it produces for the auditor.
An evidence index maps each period's records to the criteria they support, so the auditor's requests can be answered from one place.
Documentation of the system description is updated for changes made during the period, for management to review and assert.

How we support

Ongoing support and upgrades can be arranged as a retainer, covering control operation and evidence collection between audits.
Retainer scope, response expectations and the fees are agreed in writing, and a quote follows from the scope.
Ask your CPA firm and DeployOpen to confirm, in writing, which evidence each of them will rely on before the period starts.

SOC 2 renewal: running the annual Type 2 cycle