What Is a SOC 2 Bridge Letter, and When You Need One
A bridge letter is the document that covers the months your SOC 2 report does not. It is written by your own management, signed by nobody independent, and worth exactly as much as the sentence in it that says nothing material changed.
The request arrives from a customer's vendor risk team in the third week of March. They need current coverage through their fiscal year end. Your report is genuine and the opinion is clean, and your examined period closed on December 31. Three months of calendar sit between what the auditor tested and what the customer is asking about, and no amount of rereading the report will close them. What the customer wants is a bridge letter. What most companies send back is a downloaded template with the dates changed, signed by whoever happened to be free that afternoon, which is a shame, because the one sentence in it that matters is a representation your customer will rely on.
What Is a SOC 2 Bridge Letter?
A bridge letter is a letter on your letterhead, addressed to a customer, that names the period your last SOC 2 report covered, names the window the letter itself covers, and says either that no material changes have occurred to the system and its controls since the period ended or exactly what did change. It is usually one page. Some run to three paragraphs.
Everything difficult about it follows from what it is not. It is not an attestation. Nobody examined anything, nobody sampled evidence, and no opinion is being expressed. Your SOC 2 report is an accountant's opinion about a stated period, issued after a CPA firm tested controls across that period and wrote down what it found. A bridge letter is your management team's own account of the months since. The two documents look similar sitting in a data room and they carry completely different weight.
It is also not an extension. A Type 2 report covers the dates printed on it and those dates never move. A bridge letter sits alongside the report and speaks to a window the report is silent about, which means a reader who accepts one is choosing to rely on your word for that window rather than on an examination.
The gap letter name is the more honest of the two. There is a gap, the letter describes it, and describing a gap is not the same as filling it. Companies that write bridge letters routinely, and mature service organizations write several a year, tend to treat them as what they are: a formal disclosure, drafted with the same care as a contract clause, because a customer who later discovers that something material did change will go back and read what you signed.
Why SOC 2 Bridge Letters Exist
Two situations produce almost every bridge letter, and they call for different letters.
The first is calendar misalignment, and it is nobody's fault. Your observation period runs January through December because that is when you started. Your customer's fiscal year ends March 31, and its own auditors and its vendor risk policy both work to that date. Even with a report issued on schedule, three months of your customer's fiscal year fall outside your examined period, every year, forever, unless one of you moves.
The second is a late renewal, and it usually is somebody's fault. The next period was supposed to start where the last one ended, fieldwork slipped, and a report that should have been issued in February is now expected in June. Customers can tell the difference between the two situations from the dates alone, so do not write the same letter for both.
- The observation period opens. Everything the auditor tests happens from this date forward
- Period end. The opinion covers nothing after this date, whatever the report is dated
- The next observation period opens, if renewal was scheduled back to back
- The report is issued, weeks after the period it describes has closed
- The customer fiscal year end, which is the date its own reviewers and auditors work to
- The customer asks for coverage of January through March. Management writes the bridge letter
The report issue date confuses people here, so it is worth being blunt about it. A report dated February 20 does not cover January and February. It covers the period stated in the opinion, which ended on December 31, and it was simply written up six to ten weeks after the period ended. The date on the cover is when the accountant finished writing, not when the accountant stopped looking.
What Goes in a SOC 2 Bridge Letter
Five elements do the work. Every one of them has a failure mode that shows up when a reviewer reads the letter properly.
| Element | What it does | What goes wrong without it |
|---|---|---|
| The prior report's period, with both dates | Anchors the letter to a specific examination | A reviewer cannot tell which report you mean, or whether it is the one they hold |
| The window this letter covers, with both dates | States exactly what you are speaking to | An open-ended letter reads as covering today and forever, and gets rejected |
| The CPA firm that performed the examination | Lets the reviewer match the letter to the opinion | The letter cannot be tied to anything independent |
| A statement on material change, either way | The only sentence carrying any weight | Nothing has actually been asserted |
| A statement that this is not a report and not an opinion | Sets the reader's expectation honestly | The letter gets filed as though it were assurance |
The fourth line is the letter. Everything else is addressing. If nothing material changed, say so plainly and name the system you are talking about, because "no material changes" without a defined scope is a sentence a lawyer will read twice. If something did change, describe it: a new subservice organization, a migration to a different cloud region, an acquisition that brought a second identity provider into scope, a security incident, a change of auditor. Reviewers do not treat disclosed change as failure. They treat undisclosed change discovered later as a reason to stop trusting the vendor, which is a different order of problem.
Do not attach evidence. A bridge letter that arrives with screenshots is answering a security questionnaire instead, and mixing the two invites questions the letter was never meant to settle.
Who Writes and Signs a SOC 2 Bridge Letter?
Management writes it and an officer of the service organization signs it. Not the auditor. This is the point every first-time compliance owner tries to argue with, usually by asking the CPA firm to sign it as a favor.
The reasoning is not a firm policy that a friendly partner might waive. An examination opinion has to rest on procedures actually performed, and no procedures were performed after the period closed. A CPA firm that signed a statement about January through March would be asserting something it had no basis to assert, in a document its own peer reviewers will eventually read.
There is one thing the auditor legitimately does in this territory, and it is worth knowing about because it explains where the practice came from. Under AS 2601, a service auditor is required to ask management about events arising after the period and to obtain management's written representation about them. The auditor is not attesting to those events. The auditor is collecting management's word about them. A bridge letter is that same transaction, performed for a customer instead of an auditor, which is why the format feels so much like a representation letter.
Signature level matters more than most companies think. A letter signed by a compliance analyst reads as administrative. A letter signed by the CEO, CTO or head of security reads as a representation by somebody who would know, and that is what the recipient is trying to obtain.
How Long Can a SOC 2 Bridge Letter Cover?
The convention is three months, and it is worth understanding that it is a convention rather than a rule. No standard sets it. The AICPA has published no bridge letter template and no maximum coverage window, and the three month figure circulates because vendor risk teams broadly settled on it, not because anybody promulgated it.
What actually decides the answer is the policy of the company reading the letter. A regulated buyer with a written third-party risk program has a figure in that program and applies it whatever the convention says. A mid-market software buyer may never have set one and will take the letter at face value. A customer with an examination cycle of its own wants the window closed before its own year end, and will not care what is conventional anywhere else.
Two things make a long window harder to defend regardless of policy. The first is that the further you get from the period end, the less the last examination says about how you operate now, which is the same logic the audit standards apply when they weigh the time elapsed since a test was performed. The second is that a long gap usually means a late renewal, and a late renewal is itself the thing the reviewer is now worried about. A bridge letter covering nine months is not a longer bridge. It is a notification that the report is stale, written on letterhead.
What a SOC 2 Bridge Letter Looks Like
A usable one runs about five short paragraphs and follows a fixed shape.
It opens by identifying the service organization and the system, in the same words the report's system description uses. It names the CPA firm and the examined period with both dates. It states the window the letter covers, ending on a specific date rather than on "the present". It gives the material change statement, either the clean version or a numbered description of what changed and what was done about it. It closes by saying that the letter is management's own statement, that it is not an examination and carries no auditor's opinion, and that it does not replace the report. Then it is signed, with a name, a title and a date.
Reuse your own previous letter rather than a downloaded one, because a template written for somebody else's system description will describe somebody else's scope.
Should You Accept a Bridge Letter From a Vendor?
If you are the one receiving these, the decision is smaller than it looks and there are only three outcomes.
Accept it when the gap is short, the letter names both the prior period and its own window, the material change statement is unambiguous, an officer signed it, and the next report has a date attached. That is a vendor running a continuous program and telling you where it is in the cycle.
Accept it with a condition when the letter is fine but the next report is undated. Ask for the period end date of the current examination in writing and diary it. Most vendors answer this in a day, and the ones that cannot are telling you something.
Refuse it when the letter is doing work it cannot do: covering more than a couple of quarters, arriving instead of a report that was promised, using vague language about not being aware of any changes without saying what was checked, or arriving unsigned. Refusing does not have to be dramatic. The useful move is to ask for the letter plus the specific thing the letter is standing in for, which is usually evidence that access reviews, change management and monitoring kept running through the gap.
Be proportionate about it. A vendor with access to your production data and your customer records deserves the strict version of this test. A vendor that hosts your recruiting pipeline does not need the same scrutiny, and a vendor risk policy that treats both identically is one everybody will start routing around. The pressure to get this right is not imaginary: the 2026 Data Breach Investigations Report, Verizon's nineteenth edition, published in May 2026, found breaches involving a third party now account for 48 percent of all breaches, with third-party supply chain breaches up 60 percent.
How to Avoid Needing a Bridge Letter
Bridge letters are a symptom of a calendar, so the fix is a calendar.
Key takeaways
- A SOC 2 bridge letter, or gap letter, is management's written statement covering the stretch between the end of the last examined period and a stated date. It is unaudited.
- No AICPA standard defines it, prescribes its contents or caps its length. The three month convention is a market habit, not a rule, and the requester's own policy is what actually decides.
- The CPA firm does not sign it, because an opinion covering a window in which no procedures were performed would have nothing behind it.
- Five elements belong in one: the prior period dates, the letter's own coverage window, the CPA firm's name, the material change statement, and a plain disclaimer.
- The material change statement is the only sentence with weight. Verify it against a standing list before an officer signs.
- Receiving one is a three way decision: accept, accept with a dated commitment for the next report, or refuse and ask for what the letter is standing in for.
- The permanent fix is calendar work. A period end matched to your customers, back to back renewals and an early draft remove most of the need.
Common questions
What is a SOC 2 bridge letter?
A one page statement from a service organization's management, addressed to a customer, that names the period covered by its most recent SOC 2 report and asserts whether anything material about the system or its controls has changed since that period closed. It carries no auditor's opinion.
What is the difference between a bridge letter and a gap letter?
Nothing. They are two names for the same document, and both are used interchangeably by vendors, auditors and procurement teams. Gap letter is the more descriptive of the two, since the letter identifies an unexamined stretch of time rather than covering it.
Who signs a SOC 2 bridge letter?
An officer of the service organization, typically the CEO, CTO or head of security. A signature at that level is what the recipient is asking for, because the person signing is representing that they would know if something material had changed.
How long can a SOC 2 bridge letter cover?
Three months is the usual ceiling in practice, though nothing published sets it. What binds you is the policy of the company reading the letter, and a regulated buyer with a written third-party risk program has a figure in it already. Anything much longer signals a late renewal rather than a calendar mismatch, and reviewers read it that way.
Is a bridge letter required?
No. Nothing in the AICPA's attestation standards requires a service organization to produce one or requires a customer to accept one. It exists because contracts and vendor risk policies ask for current coverage and periods rarely line up with fiscal years.
Does a bridge letter extend a SOC 2 report?
It does not. The period printed in the opinion is fixed, and a letter alongside it changes nothing about what was tested. A reader accepting a bridge letter is substituting management's assertion for an examination for that window, which is a choice they are making, not an extension you are granting.
Can my auditor write the bridge letter for me?
A CPA firm will not sign one. Some firms will review a draft for language that overstates what the report says, which is a useful service and worth asking about, but the signature and the responsibility stay with the service organization.
Do I have to accept a vendor's bridge letter?
No, and your own policy should say when you will. Short gap, clear dates, an unambiguous change statement, an officer's signature and a committed date for the next report is the profile worth accepting. Missing any of those is a reasonable basis for asking for more.
What should a bridge letter say if something did change?
Describe the change and what was done about it, in numbered items. A new subservice organization, a hosting migration, a change of auditor, an acquisition that widened scope, or a reportable incident all belong in the letter. Disclosed change is normal; change a customer finds out about later is what damages the relationship.
Is there an AICPA bridge letter template?
There is not. The AICPA publishes the criteria a SOC 2 examination measures against, the 2017 Trust Services Criteria with revised points of focus issued in 2022, and its overview of SOC engagements names the three report types, but no bridge letter form exists in either. Templates in circulation are vendor conventions.
Does a SOC 2 Type 1 report need a bridge letter?
A Type 1 covers design at a single date, so the concept fits badly: there is no period to bridge from, only a date that recedes. Customers holding a Type 1 usually ask for the Type 2 timeline instead, and reading the report properly means checking the exceptions in section 4 and the scope rather than chasing a gap letter.
On this page
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.