SOC 2 Bridge Letter Explained in Under 5 Minutes

A SOC 2 bridge letter, also called a gap letter, is a statement issued and signed by a service organization’s management about the period after its most recent SOC 2 report period ends. It describes material changes to the system or controls, or states that management is unaware of such changes. It supplements the report; it does not extend the CPA firm’s opinion or provide a new independent examination.

Larson & Company’s guidance makes the distinction explicit: management prepares the letter, and the independent service auditor provides no assurance on it.

When a buyer might request a bridge letter

A buyer may need information through a date later than the end of your report period, such as its fiscal year-end or a vendor review date. A bridge letter gives the buyer management’s account of what happened during that gap while it reviews the underlying report. Our SOC 2 audit report guide explains how to read that report’s opinion, period, and exceptions.

Keep these dates separate:

For example, a report covering October 1, 2025 through June 30, 2026 might be issued in August. A letter addressing July 1 through September 30 describes the period after June 30, not merely the days after the August issuance date. Management should sign after the period it describes has ended, rather than promise that no changes will occur in the future.

A Type 2 report describes a historical period. Buyers set their own requirements for how recent a report must be and what additional information they will accept. Schellman’s report-validity guidance describes 12 months as a rule of thumb and says AICPA does not specify a report-validity period. Annual audit planning is useful, but a blanket claim that every SOC 2 report “expires after 12 months” confuses report coverage with a buyer’s freshness policy. Our SOC 2 audit renewal playbook covers how to start each new period so coverage stays continuous, and how often SOC 2 audits are done covers the annual cycle.

See what a SOC 2 Type 2 report contains for the structure of the underlying report. The AICPA’s illustrative report overview identifies management’s assertion, the system description, the service auditor’s report, and the tests of controls and results as distinct components.

How long can a bridge letter cover?

Three months is a common convention, not a universal AICPA deadline. Linford & Company’s CPA guidance says the acceptable length depends on the report user and that bridge letters typically cover no more than three months. It also explains that AICPA SOC guidance does not specify bridge-letter requirements.

Ask the recipient what gap it will accept before drafting. A longer period may lead it to request more evidence or a newer report. Reissuing a letter with a new date does not make the underlying report more recent or add independently tested coverage.

What to include in the letter

Use company letterhead and enough detail for the recipient to connect the letter to the correct report:

• The service organization’s name and the system or service addressed.
• The referenced report’s type, examination period, and issuing CPA firm.
• The letter’s date and exact start and end dates for the gap.
• Management’s statement about material changes to the system and controls, including relevant incidents or deficiencies and their effects where applicable.
• The signer’s name, title, signature, and a contact for follow-up questions.
• A statement that the letter supplements the referenced report and provides no independent auditor assurance for the gap.

Identify the scope accurately. A letter should not imply that additional services, systems, or Trust Services Criteria have been examined when they were outside the report. If a hosting provider or other subservice organization changes, explain the effect on the described system rather than silently expanding the scope.

Sample letter to adapt

This is management’s letter, not the auditor’s. Replace each bracketed item, keep the dates consistent with the report, and have an authorized officer sign it after the gap has ended. The dates below follow the worked example above.

[Company letterhead]

[Letter date, on or after September 30, 2026]

To: [Recipient name or “To whom it may concern”]

Re: Bridge letter for [Service organization name], [system or service name]

This letter is issued by management of [Service organization name]. It refers to our SOC 2 Type 2 report on [system or service name], covering October 1, 2025 through June 30, 2026, issued by [CPA firm name] in August 2026.

This letter covers July 1, 2026 through September 30, 2026. During that period there were no material changes to the system or to the controls described in the report, and management is not aware of any failures of those controls.

This letter is a statement by management. It supplements the report, is not an attestation, and has not been examined or audited by [CPA firm name]. It does not extend the report’s period or opinion.

[Signer name], [Title]

[Signature] [Date signed]

Contact for questions: [email or phone]

If there have been material changes

Describe the change, when it happened, which controls it affected, and how management responded. Do not use a “no material changes” template when management knows about a material change. A disclosed change does not automatically make the letter unusable; the recipient needs enough information to assess its effect.

In the sample, replace the second paragraph with wording like this:

During this period the following material change occurred: [describe the change]. It took effect on [date]. It affected [controls or control activities] in this way: [describe the effect, such as a control operating differently or not being performed for a period]. Management responded by [remediation steps], completed on [date] or expected by [date]. Except as described here, management is not aware of other material changes to the system or controls, or of failures of controls, during the period.

Before signing, review the supporting records with the people responsible for the controls. Incident logs, change records, and control reviews can inform management’s statement, but that internal review does not become a CPA examination.

Who signs it?

Management of the service organization signs the bridge letter. Choose an authorized leader who can take responsibility for the statement and obtain information from the relevant control owners.

Your auditor may help you understand the report’s scope or discuss the next examination. That does not make the auditor the issuer of the bridge letter. Do not present an engagement confirmation, template review, or informal concurrence as independent assurance over untested dates.

How a buyer should review it

Read the letter alongside the full SOC 2 report. Check that the service you use is in scope, the gap dates are complete, and management has addressed material changes. Review the report’s exceptions, subservice-organization treatment, and complementary user entity controls (the controls the report expects your organization to perform). The letter does not resolve those responsibilities or erase past exceptions. Whether to accept it is the buyer’s call, set by its risk assessment and contract.

If the letter is insufficient, tell the vendor what is missing: a newer report, clarification of a change, evidence for a specific control, or information through a later date. Where independent assurance is required, discuss an appropriate examination with the vendor and its CPA firm. A management letter alone cannot supply it. Our SOC 2 Type 2 audit cost guide covers what a new examination involves.

Keeping letters accurate as requests grow

Keep an approved template, the supporting review records, and a distribution log. Check dates, scope, and changes before each issue. Agree with recipients on any confidentiality or sharing restrictions; do not assume a universal rule requires every letter to name one individual recipient. Our guide on whether customers can see your SOC 2 report covers NDA-gated sharing.

Software can help organize evidence and document sharing, but management still owns the accuracy of the statement. Our compliance software directory can help you compare tools for that work.