Point-in-time evidence shows the state of a control on a single date. Period-of-time evidence shows that a control operated across a span, such as the full audit period.
The difference matters because the two SOC 2 report types test different things. A Type 1 looks at design as of a date. A Type 2 looks at operation over a period.
In simple terms:
- Point in time asks: is the control in place today?
- Period of time asks: did the control work the whole time?
Why the Difference Matters
- A single screenshot can show a setting is on today, but not that it was on last quarter
- Type 2 testing relies on records across the period, so gaps in history are a problem
- Collecting evidence late can make period coverage hard to rebuild
Comparison
| Aspect | Point-in-time evidence | Period-of-time evidence |
|---|---|---|
| Question answered | Is it configured now? | Did it operate throughout? |
| Typical report | Type 1 | Type 2 |
| Example | Screenshot of a policy setting | Monthly user access review records |
| Risk | Misses what happened earlier | Gaps if records were not kept |
Examples
| Control | Point-in-time | Period-of-time |
|---|---|---|
| Multi-factor authentication | Current enforcement setting | Logs or periodic checks across the period |
| Change management | Branch protection setting today | Pull request approvals for sampled changes |
| Access reviews | The review procedure | Completed reviews for each cycle |
How Auditors Typically Use Each
For a Type 2, auditors often build a population for the audit period, pick an audit sample, and test each item. A current-state screenshot alone usually does not cover that. Missing period evidence can be recorded as a control deviation. The exact approach depends on your auditor and control descriptions.
Common Mistakes
- Relying on one screenshot for a control tested over a period
- Starting evidence collection only when fieldwork begins
- Letting logs expire before the audit period ends
- Not dating or attributing evidence
How AuditFlo.co Helps
AuditFlo.co helps teams retain continuous evidence collection and audit-period history from connected systems, which can make period-of-time evidence easier to assemble. AuditFlo.co does not issue SOC 2 reports, does not certify compliance, and does not replace auditors.
To see the workflow for your stack, request a demo.
Key Takeaway
Point-in-time evidence proves a control exists on a date. Period-of-time evidence proves it kept working. Plan to keep records continuously if you are headed for a Type 2.