SOC 2 bridge letter template
Updated
A bridge letter, also called a gap letter, tells customers what has happened between the end of your last SOC 2 report and today. Fill in the form, check the letter in the live preview, then download it as Word or copy the text. It runs in your browser: nothing is uploaded, and there is no signup.
Fill in the letter
The preview updates as you type. Anything you leave blank appears as [Fill in: ...] so you can finish it in Word. Runs in your browser: nothing is uploaded or stored.
Live preview
[Fill in: company name]
[Fill in: date of the letter]
To whom it may concern
Re: SOC 2 bridge letter for the [Fill in: system or service name] system, [Fill in: day after the report period ended] through [Fill in: last day of the bridge period]
This letter is provided by the management of [Fill in: company name] (the Company) to users of our most recent SOC 2 Type II report on the [Fill in: system or service name] system (the system). That report was issued by [Fill in: CPA firm that issued the report], an independent CPA firm, and covers the period from [Fill in: first day of the report period] through [Fill in: last day of the report period] (the report period).
This letter covers the period from [Fill in: day after the report period ended] through [Fill in: last day of the bridge period] (the bridge period), which falls after the report period and before our next SOC 2 report.
Management is responsible for designing, implementing and maintaining controls over the system, and for the description of the system and its controls in the report.
Management is not aware of any material changes to the system or to the controls described in the report during the bridge period.
Management is not aware of any security incidents or deviations from the controls described in the report during the bridge period that would be significant to users of the report.
We expect our next SOC 2 report on the system to be issued on or about [Fill in: expected date of the next report].
This letter is a representation by the management of [Fill in: company name]. It has not been audited, examined or reviewed by an independent auditor or any other CPA firm, and no auditor expresses an opinion or provides any assurance on it or on the bridge period. It is meant to be read together with the SOC 2 report and does not replace it.
Questions about this letter can be sent to [Fill in: email address for questions about this letter].
Signed on behalf of the management of [Fill in: company name]:
[Fill in: name of the signing officer]
[Fill in: title, for example Chief Executive Officer]
Date: ______________
No generator answers yet? The free policy generator saves your company and system names in this browser so this form starts filled in. The letter text is yours to edit; it is a template, not legal advice.
What a bridge letter is
A SOC 2 report describes a fixed period that has already ended (Type II) or a single date (Type I). Once the report is a few months old, a customer reading it cannot tell whether your system and controls still look the way the report describes. A bridge letter covers that gap. Your management, not your auditor, writes it and an officer signs it. It names the report, states the bridge period, says whether there have been material changes or significant incidents since, and says when the next report is expected.
It is a short document, usually a page. Customers read it alongside the report, so the system name, the dates and the CPA firm should match the report exactly.
What goes in the letter
| Part | What it states |
|---|---|
| Who is writing, about what | the company and the system, using the names in the report |
| The prior report | its type (Type I or Type II), its period or as-of date, and the CPA firm that issued it |
| The bridge period | from the day after the report period (or as-of date) to the date of the letter |
| Management's responsibility | that management is responsible for the controls and for the system description |
| Changes | that management is not aware of material changes to the system or the described controls, or a list of the changes |
| Incidents and deviations | the ones management knows of and how each was handled, or that none are known |
| The next report | the date it is expected |
| What the letter is | management's representation, not audited, with no auditor opinion or assurance, read together with the report |
| Contact and signature | who to ask, and the signature, name and title of an officer |
If you have used the free policy generator in this browser, the company and system names start filled in from your answers. Everything else comes from the form; anything you leave blank stays as a [Fill in: ...] placeholder in the letter.
When customers ask for one
- During a vendor security review, when the report’s period ended more than a few months ago and the reviewer needs to cover the time since.
- At contract signature or renewal, when procurement wants current documentation and the next report is not out yet.
- For the customer’s own audit. A customer that relies on your controls in its own audit may need coverage up to its own period end, which can fall after your report period.
Each customer decides what gap it accepts. Ask before you send a letter for a long gap, and see where to get vendor SOC 2 reports for the same question from the buyer’s side.
What a bridge letter does not do
- It gives no assurance. No auditor has examined it, tested anything for the bridge period or expressed an opinion on it. It is management’s representation, and the letter says so.
- It does not extend the report. The auditor’s opinion covers the report period, or the as-of date, only. A letter cannot say that controls operated effectively after it; it can only say what management knows of changes and incidents.
- It does not replace the report. It is sent with the report, and it does not erase exceptions the report already lists.
- It does not cover the future. The bridge period ends on the date the officer signs. The next report date is an expectation, not a statement of fact.
Before an officer signs
- Check the change records for the bridge period: infrastructure moves, new hosting or subservice providers, a new identity provider, reorganizations, changes to the controls described in the report. The Change Management Policy says where those records live.
- Check the incident log and any control deviations, such as late access reviews or missed backups, with the control owners. The Incident Response Policy defines what counts as an incident.
- Confirm the next report date with your CPA firm before you put it in writing.
- Have someone other than the author read the letter against the report.
- Keep a signed copy with the records you checked, so the next letter starts from them.
Frequently asked questions
- Who signs a SOC 2 bridge letter?
- An officer of the service organization, such as the CEO, CTO or CFO, on behalf of management. The letter is management's own statement. The CPA firm that issued the report does not sign it and performs no work on the bridge period. Some articles describe letters signed by the auditor; if a customer asks for that, it is a question for your CPA firm, because any work an auditor does on a later period is a separate engagement with its own report.
- How long can a bridge letter cover?
- There is no AICPA standard that sets a limit. Three months is often mentioned as a common convention, and in practice each customer decides what gap it will accept, so ask. This form shows a note when the bridge period runs past 12 months, because by then many customers expect a new report rather than a letter.
- Can the bridge period run up to the date of our next report?
- Not if that date is in the future. Management can only say what it knows up to the day it signs. End the bridge period on the letter date and state separately when the next report is expected. If the gap is still open when a customer asks again, issue a new letter with a new date.
- What if something did change, or there was an incident?
- Say so. Describe each change or incident, when it happened, which controls it affected and where remediation stands. A disclosed change does not make the letter useless; a missing one makes it misleading. Do not choose the no-changes wording if management knows of a material change. Check your change, incident and access review records with the control owners before the officer signs.
- Do we need a bridge letter after a Type I report?
- Sometimes. A Type I report covers the design of controls as of one date, so a customer reading it months later may ask the same question: has anything changed since? The letter works the same way, with the as-of date in place of a period. Many customers will also ask when your Type II report is due, which is why the letter states the next report date.
- Is a bridge letter the same as a SOC 3 report or a management assertion?
- No. A SOC 3 report is a short public report issued by a CPA firm with its own opinion. The management assertion inside a SOC 2 report covers the report period and is part of what the auditor examines. A bridge letter is a separate document management writes afterward, about the time after the report, and no auditor examines it.
Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.