SOC 2 Type 1 vs Type 2: cost, timeline, and when to skip Type 1.
Audit fee and timeline side-by-side
For a 25 to 50 employee SaaS at mid-tier CPA, Security and Confidentiality in scope, the headline numbers below are typical. The audit fee gap is real but moderate; the calendar gap is the harder constraint.
| Metric | Type 1 | Type 2 (6 month observation) | Type 2 (12 month observation) |
|---|---|---|---|
| Audit firm fee | £12,000 – £25,000 | £18,000 – £40,000 | £22,000 – £50,000 |
| Observation window | Point in time | 6 months | 12 months |
| End-to-end calendar | 3 to 6 months | 9 to 12 months | 15 to 18 months |
| Year-1 all-in budget (with readiness, tooling) | £20,000 – £45,000 | £30,000 – £70,000 | £35,000 – £85,000 |
The audit fee on Type 2 typically runs 30 to 50 percent above Type 1 for the same scope. The all-in budget gap is smaller than the audit-fee gap because the readiness and tooling lines are broadly the same on either path.
The skip-Type-1 question
Standard advice on the SERP says "skip Type 1 if you can". The cost math behind that advice is rarely shown. The real decision is shaped by three pressures: customer pressure, runway, and sunk-cost risk.
Customer pressure is the main driver. If a named enterprise customer will accept Type 1 today and Type 2 in nine months, shipping Type 1 first protects the deal and the Type 1 fee is justified. If the customer wants Type 2 at contract signature, Type 1 is wasted spend. The middle case, where the customer is ambiguous, usually resolves toward skipping Type 1, because most enterprise buyers move toward Type 2 expectations within two quarters.
Runway matters because Type 2 takes 9 to 12 months end-to-end. For an early-stage company with a 12-month runway, signing a Type 2 engagement is a runway commitment. Type 1 in 90 days, then Type 2 starting the day Type 1 ships, is the shorter cash-out path even though it costs more in total.
Sunk-cost risk is the reason "Type 1 then Type 2 in 18 months" is the worst path. The Type 1 report goes stale, the customer who needed Type 1 has either signed and renewed or moved on, and the Type 1 fee delivered no lasting value. If Type 2 will start within 12 months of Type 1, run them sequentially with the Type 2 observation window starting the day Type 1 ships. If Type 2 is more than 12 months away, skip Type 1.
Decision matrix
| Situation | Recommended path | Why |
|---|---|---|
| First enterprise customer needs SOC 2 in 60 days | Type 1 then Type 2 | Type 1 ships in 8 to 12 weeks, Type 2 observation begins immediately, customer keeps the deal warm. |
| 12-month runway, no immediate customer pressure | Type 2 directly | Lower total cost, single audit cycle, full Type 2 report at the end of year 1. |
| Already have controls, want fast credibility for a fundraise | Type 1 only (revisit Type 2 post-round) | Cheapest defensible signal. Risk of wasted Type 1 fee if Type 2 starts within 12 months. |
| Renewal cycle, existing Type 2 holder | Type 2 only (annual) | No reason to revisit Type 1 after a Type 2 has been issued. |
What changes between Type 1 and Type 2 audit work
Type 1 audit work is concentrated in two weeks of fieldwork at a single point in time. The auditor reviews control design, walks through control operation on the date specified, and issues a report attesting that the controls are suitably designed. There is no observation period. There is no sample testing across a population. There is no "at the end of the window" revisit.
Type 2 audit work spans the observation window. The auditor samples evidence across the period (access reviews, change tickets, vendor reviews, training records), tests that the controls operated as designed, and revisits walkthroughs at the close. That is what the additional fee buys, not just "more time".
Pick a path: 24-month projected total
The three buttons below correspond to the three scenarios above. Each one returns the realistic 24-month all-in cost for that path, including audit, readiness, tooling, and internal time at standard fully-loaded rates.
Type 1 fee is largely sunk cost. Type 2 readiness re-uses Type 1 evidence base. Cash-flow shape: front-loaded.
Cross-reference
Readiness work is heavier on the Type 2 path because the observation window requires evidence to be live across the period; the readiness cost page sets out where the heavier readiness investment lands. Audit firm tier matters more on Type 2 than on Type 1 because the sample-testing and observation-window mechanics scale with the firm's methodology, set out on the audit firm fees page. The full month-by-month spend curve on either path is on the timeline page. The full scenario calculator with platform-vs-spreadsheet toggle is on the calculator.