A SOC 2 bridge letter, also called a gap letter, is a short statement signed by your management, not your auditor, that covers the time between the end of your most recent SOC 2 report period and the present. It says whether the system or its controls have changed materially since the period ended and whether management knows of any significant control failure. Customers accept it as a stopgap while the next report is being prepared, typically for a gap of a few months. It carries no auditor opinion, so it cannot stand in for a report.
Every SOC 2 Type 2 report looks backwards. It covers a review period that ended before the report was issued, and a customer reading it in the middle of the year is looking at evidence that may be several months old. A bridge letter is how a vendor speaks for the months in between.
Why bridge letters exist
An auditor issues the report some weeks after the review period ends, and the next period has usually already started by then. Customers run vendor reviews whenever their own calendar says so, so there is almost always a gap between the end of the period in your latest report and the day someone reads it. Vendor risk teams fill that gap by asking for a bridge letter.
What a bridge letter says
There is no prescribed format, but customers expect the same handful of statements:
- The period it covers, from the day after your last report period ended to a stated end date.
- The report it follows: the audit firm, the report type, the review period and the Trust Services Criteria categories in scope.
- Whether there have been material changes to the system or its controls since then, and if so, what they were.
- Whether management is aware of any significant failure of those controls during the bridge period, and if so, what was done about it.
- When the next report is expected and what period it will cover.
- The name, title and signature of an officer of the company, and the date.
- A plain statement that the letter is management's representation and has not been examined by an auditor.
How long a gap a bridge letter can cover
The AICPA does not set a limit, because the letter is not part of the attestation. The customer decides what it will accept. In practice most vendor risk teams are comfortable with a gap of a few months and start asking harder questions as it grows; a letter that stretches close to a year usually means the next report is late or the programme has lapsed.
The practical fix is scheduling. When each review period starts the day after the previous one ends, the gap is only ever the time it takes the auditor to issue the report. The SOC 2 audit timeline covers how to plan periods that way.
A bridge letter template
Adapt this to your report and have it signed by an officer who can stand behind the statements, typically the CEO, CTO or head of security. Keep the alternatives in square brackets honest: if something changed or failed, say so and say what you did about it.
[Company letterhead][Date]To: [Customer name], or To whom it may concernRe: SOC 2 bridge letter for [system name][Company] engaged [audit firm] to examine the controls relevant to[Security and any other Trust Services Criteria categories in scope]for [system name]. The resulting SOC 2 Type 2 report covers the period[start date] to [end date].This letter covers the period from [day after end date] to[bridge end date] (the bridge period). To the best of management'sknowledge:1. There have been no material changes to the system or to the controls described in the report during the bridge period. [Or: The following changes were made: ...]2. Management is not aware of any significant failure of those controls during the bridge period. [Or: describe the failure and its remediation.]3. [Company] expects its next SOC 2 Type 2 report, covering [next period], to be issued by [expected date].This letter is a representation by management. It has not beenexamined by [audit firm] or by any other independent auditor, and itis not a substitute for a SOC 2 report.[Name][Title][Company]What to check when you receive one
If you are the customer, a bridge letter is worth a few minutes of reading rather than a tick in a box:
- The bridge period should start the day after the report period ended. A gap between the two is a period nobody speaks for.
- The report it references should be the one you have, with the same system name and criteria in scope.
- Changes it lists, such as a new hosting region or a new subservice organization, may affect your own risk assessment.
- A control failure it discloses should come with a remediation; ask about it if it does not.
- An expected issue date for the next report tells you when to diary the follow-up.
Keeping the gap short
A bridge letter is easy to write when nothing has drifted and the next report is on schedule. The work that makes that true is the same work the report tests: controls running continuously, evidence collected as it happens rather than assembled before fieldwork, and review periods booked back to back with your auditor.