Glossary · SOC and attestation
A bridge letter is management speaking for itself between two reports.
A letter from a service organization's management stating that nothing material has changed in its controls since the last SOC report's period ended.
Back to the glossary01 · In plain words
In plain words
A letter from a service organization's management stating that nothing material has changed in its controls since the last SOC report's period ended.
A SOC report covers a fixed window that ends on a set date. Your customers' year often ends later. A bridge letter, also called a gap letter, is your own management writing to say that the system and its controls have not changed in any material way during those uncovered months.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
A customer's auditor or security team wants coverage up to their own year end or review date. Without a bridge letter they face a gap and may ask for extra procedures, questionnaires or calls. The letter fills that gap cheaply, but only with management's word. No CPA firm tests it and it carries no opinion, so its value rests on being accurate and honest. A letter that hides a known control failure or a system migration can cause far more trouble than the gap it was meant to close.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Year-end requests from customers
- Finance teams and their auditors ask for one when your report period stops before their fiscal year end.
- Vendor review portals
- Security teams upload it beside your last SOC 2 when they renew a supplier review.
- Your controls calendar
- Worth planning for, since the letter should be signed only after checking what changed.
- The next report's description
- Changes mentioned in a bridge letter should appear, and be tested, in the following period.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a loan servicer whose period ends six months before a client's year end
A loan-servicing firm's SOC 1 Type 2 covers a period ending 30 June. A lending client closes its books on 31 December, and the client's auditor asks what happened in between. The servicer's compliance lead checks change tickets, incident records and staff moves for July to December, finds a new reconciliation tool introduced in October, and says so in the letter with a short description. Management signs it. The auditor decides what extra work, if any, the change calls for.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Attestation
- An attestation carries a CPA firm's independent opinion. A bridge letter carries only management's statement, with no testing and no opinion.
- Type 1 report
- A Type 1 is a CPA examination of design at a date. Some companies are asked for one to cover a gap, but it is a new engagement, not a letter.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Before signing, review change logs, incidents and leavers for the bridge period, not just the policy folder.
- Name any material change plainly; a buyer can work with a disclosed change but not with a hidden one.
- Align your report period with your largest customers' year ends when you next plan an engagement.
- GuideSOC 2 bridge lettersWhat a bridge letter says, who signs it, and its limits.
- GuideSOC 1 bridge lettersCovering the gap after a period ends, for a client's auditor.
- GuideHow long a SOC 2 report stays usefulThe age buyers accept, and what to do when yours ages out.
Sources: AICPA guide on SOC 1 reporting and SOC suite descriptions; AICPA guide on SOC 2 reporting; AU-C section 402 on user auditors' use of service organization reports.
Questions about Bridge letter
Who signs a bridge letter?
The service organization's management.
The letter comes from your management, usually an officer who can speak for the control environment. The CPA firm that issued the report does not sign it and does not attest to it.
How long a gap can a bridge letter cover?
Commonly a few months.
No rule fixes the length. Commonly, readers accept a letter that covers a few months after the period end. Beyond that, many will ask for a new report, because a long stretch backed only by management's word gives them little comfort.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.