Your Type 1 audit examined the suitability of your control design as of a single specified date: whether your described system covered the criteria in scope, and whether those controls would achieve the objectives you committed to.

If a Type 2 is a film, a Type 1 is the photograph.

Auditors sample what changed during the observation period, not your entire company or its full history.

A monitor supports a control; it is not the control. A healthy monitor demonstrates that a configuration held. That is sometimes most of what is needed, and sometimes one input alongside a record of human action.

An unhealthy monitor is not automatically a failed control, since an integration may have lost authorization or a resource may have been decommissioned. What the auditor looks for is a record that you investigated it.

Risk profile matters more than size. Two things drive it: what would be affected if something failed, and how likely that is. Both shift as you grow, independently of headcount.

When the items above move materially, the control set is worth revisiting.

Many of the underlying disciplines are shared: access control, change management, risk assessment, vendor oversight, and more. Where two standards ask for the same thing, evidence can often be mapped across both rather than produced twice.
​
There will also be new systems and data subjects that come into scope for review. Thoropass team members can walk you through what that gap looks like to help make the best decision.

A missed deadline does not move the audit by the length of the delay. Because the assigned window is fixed and other engagements sit around it, a short slip can require rescheduling and push your report considerably further out.

Evidence falls into categories, and each becomes eligible at a different point in the period.

Each request carries an evidence eligibility date, the earliest point you can begin attaching evidence to it. Submitting late compresses the time available for review.
​

A population request is not a single artifact. It has two parts: the query or criteria used to generate it, and the results that query returned.

Two constraints shape the timing of these requests:

These are observations drawn from working across many compliance programs, offered as perspective rather than as the only way to approach something. The decision stays with you.

While the period is open, you can still act on the answer and correspond directly with the auditor in the comments section of the audit module request.

What your auditor will not do is tell you what to build. An assurance provider cannot design the thing it later evaluates. A conclusion is only worth something to the client or prospect reading your audit report if it was reached independently.

This role is managed by your organization — an internal team member, a virtual CISO, or an external partner. However it is structured, the items below are relevant to whoever holds it.

Documentation and evidence may live in Thoropass or in your own knowledge base and systems, and neither is wrong. What stays with you is how the program matures, and where you choose to host and route evidence and monitors.

They are separate engagements producing separate reports. Because evidence that a control operated has to originate inside the period being tested, completing a Type 1 does not reduce the evidence your Type 2 will require. The two are sequential rather than cumulative.

Six months is a common starting point for a first Type 2, because it contains two full cycles of any quarterly action your policies commit you to.
​

Twelve months is the steady state most organizations settle into. It lines up with annual vendor reviews and gives broader coverage, with each quarterly action measured four times across the year.

It covers a broader span, and every time-sensitive control action inside it has to occur and be evidenced across that full span.

If your policy sets a quarterly risk committee, a rolling twelve month period means four dated occurrences with auditable evidence linked for review, rather than two across six months.

Buyers reviewing vendors look at whether coverage is continuous. A bridge letter can be used to address the interval between one period ending and the next beginning. It is written and signed by your management rather than your auditor, so it carries your credibility rather than theirs. Contiguous periods remain the stronger position.

It may be described as a deviation in the report, often alongside your explanation of cause and remediation. One you identified and addressed reads very differently than one your auditor discovered. Whether any affect the opinion is a judgment about severity and pervasiveness.

Yes, as a governed change with review, approval, a recorded date, and a rationale. Expect the period to be tested against whichever policy was in force at each point in time.

No rule requires it, but buyer expectations effectively do. Most customers want a report covering a period that ended within the last twelve months. It is a customer commitment rather than a compliance requirement.

It is a useful signal, and not the same thing as assurance. A dashboard reflects what has been captured and configured. It cannot tell you whether your scope still matches your environment, or whether an interval you committed to is sustainable.