SOC 2 bridge letter: covering the gap your report does not

A SOC 2 bridge letter — also called a gap letter — is a short statement a service organisation issues to cover the period between the end of its report’s examination period and the date a customer is asking about. If your Type 2 report covers a year ending in September and a customer performs its vendor review in January, the bridge letter addresses those intervening months.

The critical point, and the one most often misunderstood on both sides, is who writes it. The bridge letter comes from the service organisation’s management, not from the audit firm. It is an assertion, not an attestation: nobody has examined the period it covers. A customer treating it as equivalent to audited coverage is mistaken, and a vendor implying it is has overstated its position.

What a SOC 2 bridge letter says

• Identification of the report it bridges from — the examination period, the auditor and the report type.
• The gap period being covered, from the report period end to a stated date.
• A statement that no material changes have been made to the system, the controls or the control environment during that period.
• Disclosure of any changes that have occurred — an acquisition, a major infrastructure migration, a significant incident, a change in subservice providers.
• A statement that management is not aware of any control failures during the gap period.
• Signature by an authorised officer, with the date.

Three months is the working limit

Common practice caps a bridge letter at around three months, and customers with mature vendor review processes enforce that. Beyond it the assertion is covering too much unexamined time to be worth much, and the honest answer to a request for a longer bridge is that the next report is due. Vendors who find themselves routinely bridging five or six months have a scheduling problem: the examination period ends too far from when customers actually ask.

Do not assert no material changes if there were material changes. The letter is signed by an officer and relied on by customers, and a migration or acquisition disclosed later — after a customer relied on the assertion — is a considerably worse conversation than disclosing it in the letter and explaining what was done about it.

Schedule the report period around your sales cycle

The recurring fix is structural rather than textual. If most enterprise vendor reviews land in the first quarter, an examination period ending in December produces reports that need no bridging at exactly the moment they are requested. Moving a period end date is a conversation with the auditor and a one-off inconvenience; issuing bridge letters for months every year is a permanent one.

Keeping the letters consistent

Because they are issued repeatedly to different customers with different as-of dates, the failure mode is inconsistency — two letters asserting different things about the same period. Ettex Docs holds the template with version history so each issued letter derives from one source, Ettex Records keeps a copy per customer with the date and the gap period stated, and the report itself sits alongside the material covered in soc 2 readiness assessment.

Plainly: this is documents and records, not assurance. The letter carries no auditor opinion, and where a customer needs assured coverage of the gap period, the answer is a report covering it rather than a longer letter.