Short answer: A SOC 2 bridge letter, also called a gap letter, is a signed statement from your management that covers the period between the end of your last SOC 2 report and today. It says whether anything significant has changed in your controls. It is not an audit, and your auditor does not issue it.
If you have a SOC 2 report in hand, the day it expires in your customers’ eyes is usually earlier than you expect. The report covers a fixed period, say 1 January to 31 December. A customer running its annual vendor review in March sees a report that ended three months ago and asks the obvious question: what happened since? A SOC 2 bridge letter is how most service organizations answer it.
This guide explains what a bridge letter is, what it must contain, who signs it, how long customers tend to accept it, and where it stops being useful. It also includes a template you can adapt.
What is a SOC 2 bridge letter?
A SOC 2 report is an examination performed by an independent CPA firm. The report describes your system and tests your controls over a defined period (Type II) or at a single date (Type I). Once that period or date passes, the report says nothing about what came after.
A bridge letter fills that interval. It is a short document, usually one page, in which your management states that, as of the letter date, the controls described in the most recent report have continued to operate and no material changes have occurred. Many companies call the same document a gap letter, a comfort letter or an interim letter. The names are interchangeable.
Two points matter more than the name:
- It comes from management, not the auditor. Your CPA firm audited the report period. It did not examine the gap, so it does not sign or vouch for the letter.
- It is a representation, not assurance. Nobody has tested anything in the gap period. The letter has value because your officers are putting their names to it, not because it was independently verified.
Why customers ask for one
Enterprise buyers and their auditors rely on a SOC 2 report as evidence that your controls worked. They also know that evidence ages. Three situations trigger most requests:
- The customer’s review date falls after your report period ends. Annual vendor reviews rarely line up with your audit calendar.
- Your next report is still being prepared. Fieldwork and report issuance take time after the period closes, and in that window the previous report keeps getting older.
- A contract or security addendum asks for continuous coverage. Some agreements require current assurance throughout the term.
For a longer view of how buyers read your report, see our guide on how customers evaluate SOC 2.
What a SOC 2 bridge letter should contain
There is no AICPA-prescribed format, so letters vary. Reviewers generally expect the same core elements:
| Element | What to write |
|---|---|
| Company and system | Legal name of the service organization and the system or service covered by the report. |
| Report referenced | Report type (Type I or Type II), the examination period or date, and the name of the CPA firm. |
| Gap period | The exact start and end dates the letter covers, from the day after the report period ends to the letter date. |
| Statement on controls | A statement that, to management’s knowledge, the controls described in the report have remained in place and operating during the gap. |
| Material changes | Whether any significant changes occurred to the system, key personnel, infrastructure, subservice providers or controls. If they did, describe them briefly. |
| Incidents and exceptions | Whether any security incident or control failure occurred that would affect the conclusions in the report. |
| Limitations | A clear line that the letter is not a SOC 2 report, was not examined by the service auditor and does not replace the report. |
| Signature | Name, title and signature of an authorized officer, plus the date. |
A template you can adapt
The text below is a starting point. The items in square brackets are fields you fill in. Have your legal or compliance owner review it before use.
Subject: SOC 2 bridge letter for [Company name]
[Company name] issued a SOC 2 [Type I / Type II] report for [system or service name] covering [period or date], examined by [CPA firm name].
This letter covers the period from [start date] to [end date]. To the knowledge of management, during this period there were no material changes to the system, the controls described in the report, or the service commitments, except as noted: [list changes, or write “none”]. To the knowledge of management, no security incident or control failure occurred during this period that would materially affect the conclusions in the report, except as noted: [list, or write “none”].
This letter is a representation by management. It is not a SOC 2 report, it has not been examined by our service auditor, and it does not replace the SOC 2 report.
[Name], [Title], [Date]
Who writes and signs the letter
Management does. In practice the signatory is a CISO, CTO, COO, head of compliance or another officer who can speak for the control environment. Choose someone who actually knows whether anything changed, because they are making a statement that a customer may rely on and, in some contracts, hold you to.
Your auditor does not prepare, review or sign it. Some firms will answer a question about wording as a courtesy, but that is not an attestation and you should never describe the letter as auditor-reviewed.
How long can a bridge letter cover?
There is no official limit. Customers set their own tolerance. In common practice, a gap of about three months or less is widely accepted, and many reviewers become uncomfortable as it stretches toward six. A letter covering most of a year is closer to an admission that your next report is late.
The practical answer is to ask the customer. Their vendor risk policy often states a maximum gap, and a procurement analyst can tell you in one email.
Bridge letter, SOC 2 report and next report compared
| Bridge letter | SOC 2 report | |
|---|---|---|
| Issued by | Your management | Independent CPA firm |
| What it covers | The gap since the last report period | The examination period or date |
| Testing performed | None | Controls tested by the auditor |
| Level of assurance | Management representation only | Independent opinion |
| Typical length | One page | Dozens of pages |
| Can stand alone | No | Yes |
When a bridge letter will not work
A bridge letter is a short-term fix. It cannot help in these cases:
- You have never had a SOC 2 report. There is nothing to bridge from. The customer needs a report, and starting a SOC 2 readiness program is the real answer.
- The gap is longer than the customer accepts. Some policies require a report that ended within the last 12 months, with or without a letter.
- The scope does not match. If the customer relies on a system, location or Trust Services Category that your report does not include, a letter cannot extend the scope.
- A significant change or incident occurred. You cannot sign a clean letter if the facts do not support it. Describe the event honestly, and expect follow-up questions.
How to prepare a bridge letter, step by step
- Confirm the dates. Pull the report period end date and the date of the customer’s request. The gap runs from the day after the period ends to the letter date.
- Ask control owners what changed. Check infrastructure and architecture changes, new or removed subservice providers, leadership or security team changes, policy updates, and any new in-scope systems.
- Review incidents and exceptions. Look at your incident log, vulnerability backlog and any control failures found since the period closed.
- Compare against the report. Re-read the exceptions noted in the report and confirm whether they were remediated or are still open.
- Draft, review and sign. Use the template above, have compliance or legal review it, and have an authorized officer sign and date it.
- Keep a record. File the letter and the evidence you used. If the customer asks later how you reached your conclusion, you will have an answer.
Common mistakes
- Calling the company “SOC 2 compliant” for the gap. SOC 2 is an examination report, not a certification, and the letter should not claim more than the facts support.
- Backdating or recycling an old letter. Each letter reflects a specific date. Reusing last quarter’s text without checking is how inaccurate statements get signed.
- Omitting known changes. A migration to a new cloud provider or a change of identity platform is material to many customers.
- Implying auditor involvement. Do not use the audit firm’s name beyond identifying the report, and do not suggest they reviewed the letter.
- Using the letter to avoid the next audit. If your reports keep lapsing, the fix is a calendar that starts the next engagement before the last one expires.
How to avoid needing a bridge letter
Letters are useful, but a steady report cycle makes them rare. Companies that rarely need one tend to do three things. They start the next examination soon after the current period ends so that reports overlap cleanly. They keep evidence flowing all year instead of in a scramble before fieldwork, which is the idea behind continuous compliance. They also plan around customer review dates, since the same few enterprise customers usually ask at the same time each year.
If you want a realistic view of what happens during an examination and how long each phase takes, read what to expect during a SOC 2 Type II audit. For help keeping reports on schedule, SOC2.in provides SOC 2 Type I and Type II audit support. Once your report is issued, our guide to sharing SOC 2 reports with clients safely covers how to distribute it and the letter together.
For background on how the AICPA frames SOC examinations, the AICPA SOC suite of services page is the authoritative source.
Frequently asked questions
Is a SOC 2 bridge letter the same as a gap letter?
Yes. Bridge letter, gap letter, comfort letter and interim letter all describe the same management statement covering time between a report period and the current date.
Who issues a SOC 2 bridge letter?
Your management does. A senior officer such as the CISO, CTO or compliance head signs it. The CPA firm that issued the report does not prepare or sign the letter.
Is a bridge letter required for SOC 2?
No. SOC 2 does not require one. It is a business tool that customers request when your report is older than their review policy allows.
How long is a bridge letter valid?
It is valid as of its date only. Customers commonly accept gaps of about three months or less, but each customer sets its own limit, so confirm with the reviewer.
Can a bridge letter replace a SOC 2 report?
No. It carries no independent testing and cannot be used when you have no report. It only extends the usefulness of an existing report for a short time.
What should I do if something changed during the gap?
Describe it briefly and accurately in the letter. A disclosed change handled sensibly is usually fine. An undisclosed one discovered later is a serious trust problem.
Conclusion
A SOC 2 bridge letter is a short, honest management statement that keeps a good report useful while the next one is on the way. Write it carefully, sign it at the right level, keep the gap short and never present it as more than it is. If you find yourself writing these every quarter, treat that as a signal to tighten your audit calendar rather than lean on the letter.
