In short
- Spend the first two weeks on scope, not controls
- Capture evidence as each control goes live, indexed to its criterion
- Run an internal dry run with someone who did not implement the controls
- Freeze scope — late additions are the most common cause of a missed date
Ninety days is achievable for a Type II observation period, but only if the first two weeks go on scope rather than controls. Most slipped timelines trace back to a boundary that kept expanding.
Weeks one and two: scope and gap
Decide which trust services criteria apply and which systems are in scope. Everything outside that boundary is out, in writing. Then run the gap assessment against the real criteria rather than a generic checklist.
Weeks three to eight: controls and evidence
Implement in order of assessment risk. The critical discipline is capturing evidence at the moment each control goes live — screenshots, configuration exports, approval records — indexed against the criterion it satisfies.
Evidence produced during delivery costs almost nothing. Evidence reconstructed afterwards costs weeks, and is usually the thing that slips the date.
Weeks nine to twelve: the dry run
- Internal audit against the real criteria, run by someone who did not implement the controls
- Close the findings from that dry run
- Confirm the observation window start with your auditor in writing
- Freeze scope — late additions are the most common cause of a missed date
The three things that slip
In practice: an unclear system boundary, a control owner who was never told they owned it, and evidence that exists but cannot be located. All three are process problems rather than technical ones, and all three are avoidable in week one.
