SOC 2 Type I evaluates whether controls are designed appropriately at a single point in time. SOC 2 Type II — the report most enterprise buyers actually want to see — evaluates whether those controls operated effectively throughout an observation period, typically 6-12 months. The distinction matters enormously for access reviews specifically, because a company that runs one thorough access review the week before the audit and calls it done has satisfied a Type I mental model applied to a Type II requirement, and it will not hold up under sampling.
What "Continuous" Actually Means for Access Reviews
An auditor testing access review controls for a Type II period doesn't ask "show me your access review" — they ask for evidence of access reviews conducted at the frequency your own policy commits to, across the entire observation period. A company whose policy states quarterly reviews needs to show four completed reviews spanning the period, each with the same rigor, not one comprehensive review and three that were skipped or rushed.
This is where the gap between policy and practice shows up most starkly. Writing "we conduct quarterly access reviews" into a policy document costs nothing. Actually running four reviews on schedule, with consistent scope and documented remediation for every flagged item, requires either dedicated headcount willing to do the same manual spreadsheet exercise four times a year without fail, or automation that runs the review on schedule regardless of whether anyone remembers to trigger it.
Scheduling the Review as Infrastructure, Not a Calendar Reminder
# scheduled_review_trigger.py — EventBridge-triggered, runs quarterly regardless of human availability
import boto3
from datetime import datetime
def trigger_quarterly_review(event, context):
review_id = f"access-review-{datetime.utcnow().strftime('%Y-Q%q')}"
systems_to_review = ["okta", "aws-iam", "github", "internal-admin-panel", "data-warehouse"]
review_record = {
"review_id": review_id,
"triggered_at": datetime.utcnow().isoformat(),
"scope": systems_to_review,
"status": "in_progress",
}
# Pull current entitlements from each system, generate reviewer assignments,
# and open the review campaign — this record becomes the evidence anchor
# for this quarter's Type II sample regardless of who's on vacation this week
return review_record
The value of the EventBridge trigger isn't the automation itself — it's that the review campaign opening no longer depends on a specific person remembering to start it. A review that happens because someone put it on their calendar is a single point of failure for an entire quarter's Type II evidence; a review that happens because a scheduled trigger opened it is not.
Consistency Across the Period Matters More Than Perfection in Any Single Review
An auditor comparing four quarters of access review evidence is looking for consistency: the same scope (or a documented, justified scope change), the same reviewer roles, the same remediation SLA applied, the same evidence format. A first-quarter review that's thorough and well-documented followed by a fourth-quarter review that's rushed and incomplete — done under audit-prep pressure — is a worse Type II outcome than four moderately consistent reviews, because it demonstrates the control wasn't operating effectively for the full period, which is exactly what Type II is testing.
# review_consistency_check.py — flags gaps before the auditor does
def check_period_coverage(reviews: list[dict], period_start: str, period_end: str, expected_frequency_days: int = 90):
reviews_sorted = sorted(reviews, key=lambda r: r["triggered_at"])
gaps = []
for i in range(1, len(reviews_sorted)):
delta_days = (
datetime.fromisoformat(reviews_sorted[i]["triggered_at"])
- datetime.fromisoformat(reviews_sorted[i - 1]["triggered_at"])
).days
if delta_days > expected_frequency_days * 1.25: # 25% grace before flagging
gaps.append({"between": (reviews_sorted[i-1]["review_id"], reviews_sorted[i]["review_id"]), "gap_days": delta_days})
return gaps
Running this internally before the audit — not discovering the gap when the auditor's sample lands on the exact quarter that slipped — is the difference between a self-identified, remediated process gap (which auditors generally accept as a minor finding with a documented fix) and a surprise finding that undermines confidence in the whole control.
Frequently Asked Questions
What observation period length is typical for a first SOC 2 Type II audit?
Six months is common for a first Type II report, since it's faster to achieve than a full 12-month period while still demonstrating operating effectiveness over time. Subsequent annual reports typically move to a full 12-month observation period.
Can a company switch from quarterly to monthly access reviews mid-period?
Yes, and increasing frequency mid-period is generally viewed favorably — it demonstrates improving control maturity. The evidence needs to clearly document the change (why, when, and the new cadence going forward) rather than leaving an auditor to infer why the pattern shifted.
What happens if one quarter's review was skipped entirely?
This is a real gap, not a technicality — it should be disclosed proactively to your auditor along with a remediation plan (why it was missed, what changed to prevent recurrence, and evidence the gap has since been closed). Auditors generally treat a disclosed, remediated gap far more favorably than one they discover themselves during sampling.
Does automation replace the human reviewer in an access review?
No — automation handles entitlement ingest, scheduling, and evidence packaging; a human still needs to make the actual appropriateness judgment for each access grant, since that requires business context (does this person's current role justify this access) that automation can't fully infer on its own.
How far in advance should we prepare Type II evidence before the audit starts?
Evidence should be generated continuously throughout the observation period as reviews actually happen — not reconstructed retroactively once the audit is scheduled. If the evidence doesn't already exist in a retrievable, dated format by the time the auditor asks for it, that itself signals the control wasn't operating as claimed throughout the period.
Rutagon builds scheduled, automated access review infrastructure that generates consistent Type II evidence across the full observation period — not a scramble the week before the audit.
See what an Access & Credential Governance Diagnostic finds in your environment → rutagon.com/contact | 907-841-8407 | contact@rutagon.com
Related reading: Quarterly Access Review Process That Audits Pass · SOC 2 Access Review Failures Auditors Actually Flag · Security Automation Capability
External reference: AICPA — SOC 2 Type I vs Type II Reports