SOC 2 · Guide
SOC 2 bridge letter: what it covers, when customers ask, and a worked example
SOC 2 bridge letter: what it covers, when customers ask, and a worked example
Key takeaways
A SOC 2 bridge letter is a short letter from a service organisation's management that covers the months between the end of its last SOC report period and a date a customer needs. It states whether the system or controls have changed materially and carries no auditor assurance. GRCMANA recommends keeping the gap it covers to about a quarter.
- Type 2 report period
- Under ISA (UK) 402, a type 2 report gives the service auditor's opinion on whether controls operated effectively throughout a specified period, so later months are untested.
- Remaining period
- ISA (UK) 402 says a customer's auditor may need more evidence about significant control changes outside the type 2 report period, weighing factors including the remaining period's length.
- SOC 1 bridge letter
- A bridge letter for a SOC 1 report, which the AICPA describes as covering controls likely to be relevant to user entities' internal control over financial reporting.
- Reviewer's checklist
- The AICPA's SOC 2 report review checklist asks whether a Type 2 report is recent enough to be useful and, if not, whether a bridge letter covers the timing difference.
Your customer's vendor review has reached the SOC 2 line. Your report period ended three months ago, the next report is not due until next year, and procurement has asked for a SOC 2 bridge letter before the renewal can be signed. Nobody on your team has written one before.
This guide is for founders, COOs and security leads at UK B2B tech firms that already hold a SOC 2 or SOC 1 report. It explains why the request exists, who signs the letter, what goes in it and how to disclose a change honestly, with an illustrative example letter. For the basics of SOC 2 itself, start with our SOC 2 hub.
What is a SOC 2 bridge letter?
A SOC 2 bridge letter, also called a gap letter, is a short letter from your own management to a customer. It covers the months between the end of your last SOC report period and a date the customer needs. It states whether the system or its controls have changed materially, and it carries no auditor assurance.
The name describes the job. Your SOC 2 Type 2 report covers a fixed period that has already ended. Your customer needs comfort about a later date: their renewal, their review or their financial year-end. The letter bridges the two.
A bridge letter does not extend your report. It sits beside it, and the customer reads the two together.
Who issues and signs a SOC 2 bridge letter?
Your own management writes and signs a SOC 2 bridge letter, usually a director or officer accountable for the service in scope. The CPA firm that issued your report does not sign it, because the firm's opinion covers only the period it examined. The letter is your firm's statement about the months since.
The reason sits in what a SOC report is. Under ISA (UK) 402, the UK auditing standard for auditors whose clients use service organisations, a type 2 report gives the service auditor's opinion on whether controls operated effectively throughout a specified period. Nothing after that period has been tested.
So the auditor has nothing to put in a bridge letter. Any statement about the gap months comes from the people who ran the controls during them: your management.
That also sets the letter's weight. A customer reads a bridge letter as a representation, the way they would read any written statement from a supplier. It is useful evidence, and it is your firm's word, not an independent opinion.
A bridge letter is only as strong as the monitoring behind it.
Why do customers ask for a bridge letter?
Customers ask for a bridge letter because their own review needs evidence about a period your report does not cover. For SOC 1, the customer's financial statement auditor must judge whether your report's period suits their audit. For SOC 2, procurement and third-party risk teams want to know nothing material has changed since the period ended.
The financial audit route is the most formal. ISA (UK) 402 paragraph 17(a) requires the customer's auditor, called the user auditor, to evaluate whether your report is for a period appropriate to their purposes. Paragraphs A33 to A35 go further:
- A33 says the user auditor may need additional evidence about significant changes to your controls outside the report period.
- A34 gives examples of how they get it, such as extending tests over the remaining period or testing the customer's own monitoring.
- A35 says that if your testing period falls completely outside the customer's financial reporting period, the user auditor cannot rely on those tests without other procedures.
In the US, the equivalent standard is AU-C section 402. The AICPA has also issued an interpretation of AU-C section 402 on the considerations when a user auditor uses a SOC 2 report in a financial statement audit.
The SOC 2 route is commercial. The AICPA's SOC 2 report review checklist asks reviewers whether a Type 2 report is recent enough to be useful and, if it is not, whether a bridge letter covers the timing difference. A reviewer working from it asks for one whenever your report is not recent enough. If the customer runs ISO 27001, the same review is the evidence behind its supplier controls under ISO 27001 Annex A 5.19. Reading the rest of the report is covered in our guide to the SOC 2 report.
How is a SOC 1 bridge letter different from a SOC 2 bridge letter?
A SOC 1 bridge letter serves the customer's financial statement auditor and usually runs to the customer's financial year-end. A SOC 2 bridge letter serves procurement, vendor risk and contract renewal, and runs to whatever date the reviewer needs. The structure is almost the same; the reader, the trigger and the date differ.
The AICPA describes SOC 1 as an examination of controls likely to be relevant to user entities' internal control over financial reporting. That is why SOC 1 bridge letters follow the customer's audit calendar. Our SOC 1 page covers the report itself.
| Compared on | SOC 1 bridge letter | SOC 2 bridge letter |
|---|---|---|
| Who reads it | The customer's financial statement auditor and finance team | The customer's security, procurement or third-party risk team |
| What triggers it | The customer's financial year-end falls after your report period ends | A renewal, a new contract, a vendor review or a security questionnaire |
| Date it runs to | The customer's year-end | The date the reviewer asks for, often the review date |
| Focus of the statement | Changes to controls relevant to financial reporting | Changes to the system and controls behind your service commitments |
| What it rests on | Your SOC 1 Type 2 report | Your SOC 2 Type 2 report |
Many firms hold both reports for the same service. One letter can cover both, provided it names each report and its period.
What should a SOC 2 bridge letter include?
A SOC 2 bridge letter should name the report it bridges, the report period and the CPA firm that issued it. It then states the bridge period, whether there have been material changes or known deficiencies or incidents, when the next report is due, who signs, and that the letter is not an audit report.
We recommend these elements, in this order:
- Your letterhead, the date and the addressee. Address it to the customer, or to the customer and their auditor.
- The report being bridged. Its name, type, the trust services categories in scope, the period and the issuing firm.
- The bridge period. A start date the day after the report period ended, and a fixed end date.
- The statement on changes. Whether there have been material changes to the system or controls in the bridge period, and a description of each one.
- Known deficiencies and incidents. Whether management is aware of control failures or security incidents that would affect the customer's reliance.
- The next report. The planned period and the expected issue date.
- The disclaimer. A sentence saying the letter is management's statement, not an auditor's report, and gives no assurance.
- The signatory. A named director or officer, their title and a signature.
The statement on changes is where the work sits. Before anyone signs, check change records, incident logs, access reviews and supplier changes for the bridge period. A letter written from memory is a guess with a signature.
What does a SOC 2 bridge letter example look like?
A SOC 2 bridge letter example is easier to follow than a description. The illustrative letter below is for a fictional UK firm that holds both a SOC 2 and a SOC 1 report for one service. It covers three months after the report period, states no material changes, and closes with the disclaimer and a named signatory.
This example is illustrative only. Quillfen Ltd is a fictional firm, and the wording is ours, not an AICPA template.
| Element | Illustrative wording |
|---|---|
| Letterhead and date | Quillfen Ltd, 6 October 2026 |
| Addressee | To the customers of Quillfen Ltd's payroll processing platform, and their auditors |
| Reports bridged | SOC 2 Type 2 report on the payroll processing platform, covering security and availability, for 1 July 2025 to 30 June 2026; SOC 1 Type 2 report on the same platform for the same period. Both were issued by an independent CPA firm |
| Bridge period | 1 July 2026 to 30 September 2026 |
| Statement on changes | Management is not aware of any material changes to the system or the controls described in the reports during the bridge period |
| Deficiencies and incidents | Management is not aware of any control deficiencies or security incidents in the bridge period that would affect the reliance customers place on the reports |
| Next report | The next examination covers 1 July 2026 to 30 June 2027, and we expect both reports to be issued by 30 September 2027 |
| Disclaimer | This letter is a statement by management. It is not an auditor's report and does not provide assurance on the operating effectiveness of controls |
| Signatory | Chief Operating Officer, Quillfen Ltd, with name and signature |
Every claim in the letter is one your management can evidence. That is the test to apply before you send yours.
How do you disclose a change in a bridge letter?
Disclose a change in a bridge letter by naming it, dating it and saying how the control environment absorbed it. A migration, a new subservice organisation or a fixed incident does not spoil the letter. A vague or missing disclosure does, because the customer will learn about the change some other way and doubt the rest.
Here is the same illustrative letter, with a disclosed change in place of the "no changes" statement:
"In August 2026, Quillfen Ltd moved its production database to a new managed service from its existing cloud provider. The access, backup and change controls described in the reports were applied to the new service before migration. The move will be included in the scope of the next examination."
The rest of the letter stays the same. If the change is significant, add a sentence offering a call with your security lead.
Three kinds of change are worth disclosing even when they feel routine:
- System changes, such as a new platform, a major migration or a new subservice organisation.
- Control changes, such as a replaced tool, a redesigned process or a control owner who left without a successor.
- Incidents, where an event in the bridge period affected the service or the data in scope.
A disclosed change reads as control, and an undisclosed one reads as concealment.
How long can a bridge letter cover?
A bridge letter can reasonably cover a gap of a few months. ISA (UK) 402 does not set a maximum gap. Instead, it lists the length of the remaining period as one factor in how much extra evidence a user auditor needs, so the longer the gap, the less a letter can carry.
We recommend treating a bridge letter as cover for about a quarter, and planning anything longer as a reporting problem rather than a letter. When the gap is too long, you have two options:
- Bring the next period forward. End your next Type 2 period earlier so the report lands closer to your customers' review dates.
- Issue a Type 1 report. A Type 1 report on the current design gives a dated, independent opinion while the next Type 2 period runs.
The AICPA's guide to vendor management and third-party risk reviews asks reviewers to check whether there was a gap since the prior report period. The cleanest bridge is a short one. Timing your audit cycle so reports land when customers need them is covered in our guide to the SOC 2 audit.
Does a bridge letter work for ISAE 3402 and ISAE 3000 reports?
Yes. A bridge letter works the same way for ISAE 3402 and ISAE 3000 reports, and for UK reports under the ICAEW's AAF guidance. Each of these reports covers a defined period, so the same gap arises, and management can cover it with the same kind of letter.
ISA (UK) 402 notes that type 1 and type 2 reports may be issued under ISAE 3402 as well as under other recognised standards. The ICAEW's TECH 01/20 AAF guidance sets out good practice for assurance on the internal controls of service organisations, and the ICAEW groups such engagements with others based on ISAE 3000.
Change only the details: name the report, the standard it was issued under and its period. The principles of honest disclosure, a fixed end date and a clear disclaimer do not change.
What are the common mistakes with a SOC 2 bridge letter?
The common mistakes with a SOC 2 bridge letter are putting it on the auditor's letterhead, making a blanket "no changes" claim without checking, leaving the end date open, and letting it stand in for a report that is overdue. Each one either overstates what the letter is or claims more than management has checked.
- Auditor letterhead or wording. The letter is management's statement. Presenting it as the auditor's misleads the reader about who stands behind it.
- A blanket "no changes" claim. Saying nothing changed, when a migration or a new supplier happened, damages the next review as well as this one.
- An undated or open-ended letter. A letter that runs "until the next report" asks the customer to trust a period nobody has looked at yet.
- A letter instead of a report. A bridge letter covers a short gap. It does not replace a report that is months overdue.
- No evidence behind it. If you cannot show the change records and incident log that support the statement, do not sign it.
A bridge letter that promises "no changes" with no end date is a blank cheque, not a bridge.
Frequently asked questions
Yes, as a starting point, including the example on this page. The letter must describe your report, your period and your changes, so the wording has to come from your own records. A template's "no material changes" sentence is only true once you have checked.
Your own management writes a bridge letter, so it needs time rather than an audit engagement. The time goes on checking change records, incidents and supplier changes for the bridge period. If you want your auditor to look at the draft, agree that separately with the firm.
No. A customer's auditor relies on a type 2 report because it includes the service auditor's own report on the controls. A bridge letter has no such report behind it, so it can support a current SOC 2 report but never stand in for one.
Expect a request whenever a customer's review, renewal or year-end falls after your report period ends. Customers with different year-ends may ask at different times. We recommend keeping a dated letter ready from the day after each period ends and refreshing it monthly.
Yes, where an incident in the bridge period could affect the customer's reliance on your report. Describe what happened, when, and what you changed. A customer who learns of an incident from the news, rather than your letter, will question everything else in it.
Standard engine
SOC 2 reference directory.
Every control in this framework and the clause guides that sit above them, grouped by control domain. Open any entry for its control definition, implementation steps and the audit evidence it expects. Dimmed entries are planned.
AllAll Guides12 guides
GuideSOC 2 audit: who performs it, how long it takes and what happensGuideSOC 2 Type 1 vs Type 2: which report should you get first?GuideSOC 2 documentation: the documents, policies and controls matrix you needGuideSOC 2 compliance checklist: the phased checklist for UK firms (starting from ISO 27001)GuideSOC 2 system description: what to include, how to set scope, and a worked exampleGuideSOC 2 report: what's in it and how to read oneGuideSOC 2 certification: what you actually get and the route to your first reportGuideSOC 2 Trust Services Criteria: the five categories, the common criteria and the controls that meet themGuideSOC 2 cost in the UK: what 25–250 person firms payGuideISAE 3000 vs SOC 2: can a UK assurance report replace a SOC 2?GuideSOC 2 bridge letter: what it covers, when customers ask, and a worked exampleGuideSOC 2 readiness assessment: how to find and close your gaps before the audit
SOC 2 Accelerator
Ready to accelerate your path to a clean Type II?
Work with a Trust Architect to scope your criteria, build evidence-generating controls, and get audit-ready — without stalling your roadmap.