It says whether the system or its controls have changed materially and whether management knows of any significant control failure since the period ended. The auditor does not review it, and it is no substitute for a report.
The guide to bridge letters includes a template.
Read more
Related terms
- SOC 2 Type 2
- A SOC 2 Type 2 report gives an auditor's opinion on whether controls were suitably designed and operated effectively throughout a review period.
- Review period
- The review period is the window of time a SOC 2 Type 2 covers, over which the auditor tests whether controls operated effectively.