A bridge letter is a written statement from a service organization's management that covers the gap between the end of its most recent SOC report period and a later date, usually stating whether there have been material changes to the system or its controls during that gap.
Bridge letters are also called gap letters. Customers ask for them when the latest SOC 2 report ends months before their own fiscal year end, vendor review, or contract renewal, and the next report is not yet available.
In simple terms, a bridge letter answers:
- Which SOC report does this letter extend, and what period did that report cover?
- What dates does the gap cover?
- Has anything material changed in the system or its controls since the report period ended?
Why Bridge Letters Matter
A SOC 2 Type 2 report describes how controls operated during a specific audit period. Once that period ends, the report says nothing about what happened afterward.
Customers who rely on a vendor's report for their own compliance programs, financial audits, or third-party risk management reviews need some comfort about the months that fall outside the report. A bridge letter is the common way to provide that comfort until the next report is issued.
Bridge letters matter because:
- Customer security and procurement teams often request one during annual vendor reviews.
- A missing or vague letter can slow down a renewal or a new deal.
- The letter is a statement your management signs, so it needs to be accurate.
Who Issues a Bridge Letter
The service organization's management issues and signs the bridge letter. The CPA firm that performed the SOC 2 examination does not issue it, and the letter is not an audit opinion.
That distinction matters. A bridge letter carries management's word, not independent assurance. Customers who need assurance over a later period still need the next SOC report.
What a Bridge Letter Usually Includes
There is no single required template, but bridge letters commonly include:
- The name of the service organization and the system covered
- A reference to the most recent SOC report, its type, and the period it covered
- The start and end dates of the gap period
- A statement about whether there have been material changes to the system, its controls, or its subservice organizations during the gap
- Any known material changes, incidents, or control failures, or a statement that management is not aware of any
- The expected timing of the next SOC report
- A signature from an appropriate officer, with date
Bridge Letter vs Related Terms
| Term | Who issues it | What it provides |
|---|---|---|
| SOC 2 Type 2 report | Independent CPA firm | Opinion on control design and operating effectiveness over a period |
| SOC 2 Type 1 report | Independent CPA firm | Opinion on control design at a point in time |
| Bridge letter | Service organization management | Management statement about the gap after the report period |
| System description | Service organization management | Description of the system included in the SOC report |
How Long Can the Gap Be?
SOC 2 does not set a maximum gap. Customers decide what they will accept. Many expect the gap to be a few months, and a long gap often leads to questions about when the next report will arrive. If your reporting cycle leaves a long gap, it may be worth discussing the report period with your auditor so it aligns better with customer needs.
Common Mistakes
- Signing a "no material changes" statement without checking for incidents, system changes, or new subservice organizations
- Leaving out the period of the report being bridged
- Issuing a bridge letter that covers a period longer than customers will accept instead of planning the next report
- Treating the bridge letter as a substitute for a report the customer actually needs
- Having no internal record that supports what the letter says
Evidence That Supports a Bridge Letter
Before management signs, teams often review:
- Incident records and incident management tickets since the report period ended
- Significant production or architecture changes
- Changes to key vendors and subservice organizations
- Open exceptions and remediation items
- Whether key controls continued to run, such as user access reviews and monitoring
How AuditFlo.co Helps
AuditFlo.co helps teams retain continuous evidence collection and audit-period history for operational artifacts when those records are stored or linked through connected systems and workflows your team already uses, such as GitHub and Jira.
When management prepares a bridge letter, that history can make it easier to check what changed after the report period ended. AuditFlo.co does not issue bridge letters, does not issue SOC 2 reports, does not certify compliance, and does not replace auditors.
To see the workflow for your stack, request a demo.
Key Takeaway
A bridge letter is a management-signed statement that covers the gap between the end of a SOC report period and a later date. It is not an audit opinion. Keep it accurate by checking incidents, changes, and control operation before signing, and plan your next report so the gap stays short.