SOC 1
Bridging your SOC 1 period to a client's year-end.
Your SOC 1 period ends on one date. Your clients close their books on many others. When a client's auditor reaches year-end and finds months your report does not cover, they ask for a bridge letter: a short statement from you about what happened in between.
Back to SOC 2 services01 · The year-end gap
Why the request arrives at year-end
The auditor needs evidence for the client's whole fiscal year, not your period.
| Client (illustrative) | Client fiscal year-end | Your SOC 1 period | Uncovered months |
|---|---|---|---|
| Client A | 30 September | 1 October to 30 September | None |
| Client B | 31 December | 1 October to 30 September | October to December |
| Client C | 31 March | 1 October to 30 September | October to March |
Client A needs nothing more. Client B's auditor wants comfort for three months. Client C has half a year uncovered, and a letter will carry less weight; their auditor may lean on your next report or on more testing at the client. The general mechanics of a bridge letter are on the SOC 2 bridge letter guide; this page is about the financial reporting angle.
02 · What it states
What a SOC 1 bridge letter states
Enough for a client's auditor to judge whether the report still describes the controls they rely on.
- Which report
- The SOC 1 type, the system, the period and the CPA firm that examined it.
- Which months
- From the day after the period end to a stated date, ideally at or after the client's year-end.
- Changes to controls
- Whether the controls relevant to the control objectives changed, and how, in that time.
- Known failures
- Any control that did not operate as described, especially those under objectives touching calculation, cut-off or reconciliation.
- Subservice changes
- A new bank, host or other vendor relevant to the service.
- The caveat
- That the statement is management's own and has not been examined.
03 · Who signs
Who signs, and why that matters
An officer of the service organization, speaking for management.
The letter comes from the service organization, usually signed by an officer responsible for the service or for its controls. The CPA firm that issued the SOC 1 does not sign it and has done no work on the months it covers. A client's auditor weighs it as a representation from you, along with anything they test at the client.
Bridge letters are a market practice rather than a document the attestation standards define, so their weight comes entirely from the signer's accuracy.
04 · Limits
What the letter cannot do for the client's audit
It narrows the auditor's uncertainty. It is not evidence of operating effectiveness.
It helps
- Tell the auditor whether anything relevant changed before year-end
- Flag a control failure the auditor should know about
- Show when the next period's report will cover the months
It does not
- Carry an audit opinion or any CPA testing
- Extend the tested period
- Replace the client's own controls over the gap months
- Cover a gap so long that the report no longer describes the service
A client's auditor may also perform procedures at the client for the gap, such as testing the client's review of your reports. The letter supports that work; it does not remove it.
05 · Wording to avoid
Wording to avoid in a SOC 1 letter
Every sentence will be read by a client's auditor.
| Avoid | The problem | Write instead |
|---|---|---|
| “Controls continued to be effective through your year-end.” | Sounds like an opinion only a CPA firm could give. | “We are not aware of changes to, or failures of, the controls described in the report during the months stated.” |
| “No changes.” | Too bare to rely on; was anything checked? | State what management reviewed to reach the statement. |
| “Covers all clients' fiscal years.” | A single letter date cannot do this. | Give the dates covered and issue later letters as needed. |
| “Approved by our auditors.” | The CPA firm has no role in the letter. | “This letter has not been examined by our service auditor.” |
06 · Outline
An illustrative outline
Six short paragraphs, in this order.
- Addressee and purpose. To clients and their auditors, about the months after a named SOC 1 period.
- The report. Type, system, period, issuing CPA firm and opinion date.
- The months covered. Start and end dates of the gap the letter speaks to.
- Changes. Changes to the system, controls or relevant vendors, or a statement that management is not aware of any significant ones.
- Failures. Any control failure or incident affecting the control objectives, and what was done.
- Caveat and signature. Management's statement, not examined by the CPA firm; officer's name, title and date.
Sources: AICPA SSAE No. 18, AT-C section 320; AICPA SOC 1 guide; AICPA AU-C section 402 and PCAOB AS 2601 for the user auditor's need for evidence over the client's period. Dates, clients and wording are illustrative.
Questions about SOC 1 bridge letters
Can we set our SOC 1 period to avoid bridge letters?
You can reduce them, rarely remove them.
Many providers choose a period ending near the year-end most clients share, often 31 December for US clients or 31 March for many Indian ones. Clients with other year-ends will still ask.
How long a gap can a SOC 1 bridge letter cover?
No rule; shorter gaps carry more weight.
No standard sets a limit. A client's auditor judges how much the letter can bear. A gap of a few months is commonly accepted; a long gap pushes the auditor toward other evidence.
Do we issue one letter or one per client?
Commonly one letter, re-dated as needed.
A single letter for a period is usual, reissued with a later date for clients with later year-ends. Avoid tailoring statements client by client unless something affected one client only.
What if something did go wrong in the gap?
Say so, with what you did.
Disclosing a failure in the letter lets the client's auditor plan around it. Leaving it out exposes the signer and damages the next report's credibility.
Line up your period with your clients' year-ends.
We help you choose a SOC 1 period that suits your clients and draft bridge letters that stay accurate.