Side by side
| Type I | Type II | |
|---|---|---|
| Question answered | Are the controls designed properly? | Are they designed properly and did they work? |
| Timeframe | One date ("as of") | A period, usually 3–12 months |
| Testing | Inquiry, inspection, walkthroughs | Adds sampling across the whole period |
| Time to report | Weeks after you're ready | The window, plus fieldwork and reporting |
| Buyer weight | Shows intent, often accepted as interim | The report most enterprises require |
When a Type I makes sense
A Type I is useful when a deal is waiting and you need something credible soon. It shows your controls exist and are designed properly, and it forces the work of writing your system description and organizing evidence. Many buyers accept a Type I plus a committed Type II date.
The downside is cost. You pay for two audits in your first year. If no deal is pending, going straight to a Type II with a short first window can be the better choice.
Choosing an observation window
A first Type II often uses a three-month window to get a report out sooner. After that, most companies move to a twelve-month window that rolls year over year, so there's no gap in coverage.
A window can start once controls are operating. Every control has to run, with evidence, for the whole window. A control that starts halfway through can lead to an exception or a scope limitation.
How sampling works
For a Type II, the auditor picks samples from the period. For example, a handful of new hires to confirm they completed security training, a set of terminated employees to confirm access was removed on time, and some production changes to confirm they were reviewed. Sample sizes depend on how often the control runs. Quarterly controls get every occurrence checked, so a single missed access review is a finding.
Bridge letters
Customers often ask for coverage after your report period ends. A bridge letter (or gap letter) is a statement from your management, not the auditor, that no material changes happened between the end of the period and today. It covers the gap until the next report is issued.
A practical default for a startup with a deal waiting: Type I as soon as controls are designed, then a three-month Type II window starting right after, then annual twelve-month windows.