SOC 2 bridge letters, written so they hold up.

A Type 2 opinion speaks to a defined observation period, say an illustrative 1 April to 31 March. The CPA firm then needs time to finish testing, write the report and issue it. By the time a buyer opens the PDF, the period may have ended weeks or months ago, and nothing in the report speaks to those weeks.

If your periods abut, the gap is always closed in the end: the next report covers it. The letter is a stopgap for today's buyer, not a patch for the record.

Author

Your organization. Usually drafted by whoever runs compliance or security.

Signer

An officer who can speak for the company, such as the CEO, CTO, CISO or head of compliance.

CPA firm

Not a party. It has performed no procedures on the gap and expresses no opinion on it.

Reader

The same customers and prospects entitled to the report, under the same confidentiality terms.

Bridge letters are a market practice, not a document the attestation standards define. That is why the signer, not an auditor, carries the full weight of every sentence.

• The report it bridges. Report type (Type 1 or Type 2), the system covered, the categories in scope, the period or as-of date, and the issuing firm.
• The gap, with dates. From the day after the period end to a stated date, normally the letter date.
• Changes to the system or controls. Either “no significant changes” or a plain list: new infrastructure, a new subservice organization, a retired control, a re-organization.
• Known failures and incidents. Any control that did not operate as described, and any incident that affected the system's commitments, with what was done about it.
• The caveat. That the letter is management's statement and has not been examined by the CPA firm.

1. 1Length of the gapA letter over a short gap is routinely accepted. As the gap grows, reviewers start asking for the next report instead.
2. 2Material changeA new hosting provider, a rebuilt product or a merger means the tested system and today's system differ. The letter can disclose that; it can't cover it.
3. 3An incidentA significant incident in the gap moves the conversation from the letter to the incident: what happened, what changed, what the next report will show.
4. 4Next period statusA letter that names an abutting period already running, with an expected report window, reads very differently from one with no next step.

1. Header: company name, date, addressed to “customers and prospective customers” with access to the report.
2. Purpose: one sentence on why the letter exists: to address the period after the report.
3. The report: type, system name, categories, period, issuing CPA firm, date of the report.
4. The gap: the exact dates this letter speaks to.
5. Changes: “no significant changes” or a short list with dates.
6. Exceptions and incidents: none known, or a factual summary with remediation status.
7. Next period: whether the next observation period has started and when it began.
8. Caveat: management's statement; not examined by the service auditor; read with the report.
9. Signature: name, title, date.

• Change records. Review change tickets and architecture changes since the period end.
• Vendors. Any subservice organization added, removed or swapped.
• Incidents. The incident log and any customer notifications sent in the gap.
• Control owners. Ask each owner in writing whether their control ran as described.
• Open exceptions. Status of every exception the report disclosed.
• People. Departures or new hires in roles the description names.
• Next period. Confirm the start date of the current observation period with the CPA firm.

Sources: AICPA SSAE 18 and the attestation standards AT-C 105 and AT-C 205; AICPA SOC 2 guide (Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy); AICPA DC 200 description criteria. Bridge-letter practice described from our own engagement reasoning.