SOC 2 bridge letter: what it says and when to use it

What is a SOC 2 bridge letter and when do customers ask for one?

A bridge letter (also called a gap letter) is a written statement from the service organization's management, not from the CPA firm, that covers the time between the end of the last SOC 2 Type 2 observation period and a later date. The CPA firm does not issue it and does not vouch for it. Customers usually ask for one when their vendor review is due, the previous report's period closed some time ago, and the next report is not yet issued. The letter tells the reader what management says happened to the controls in that gap, so the customer can decide whether the older report still supports the relationship.

What the letter can say depends on the facts. Management needs to confirm the dates it covers, whether any exceptions were noted in the last report and whether they have been resolved, and whether the system, subservice providers, personnel or locations changed during the gap. A company that made no material changes and has no open exceptions can make a very different statement from one that migrated cloud accounts or lost a key control owner. The same request can therefore need a different answer for each company, and a letter that overstates the position creates risk for both the customer and the company signing it.

Before you agree to provide one, confirm with your auditor which period the next report will cover and whether they expect to test controls across the gap. Ask your customer or bank what wording and date range their third-party risk process requires, and whether they accept management's letter alone. Plan for the work behind the letter, which is evidence that controls kept operating through the gap, not just a signature. Note that a bridge letter is never a substitute for the next SOC 2 report, and customers that rely on it are still responsible for their own risk assessment.

What the letter should say, and what it cannot promise

A bridge letter should name the report period it follows, the period it covers, and the date it was written. Its core is management's statement about the system: whether the system description and controls stayed the same since the last period closed, or what changed and when. It should also disclose known exceptions, control failures and security incidents in the gap, and say how each was handled. The signatory should be a senior officer with authority over the system, such as the CISO, CTO or CEO, and the letter should say who that person is and what role they hold. Ask your customer which of these items they require, because some want a fixed date range and others accept a general statement.

The letter carries no CPA opinion. The CPA firm that issued the last report does not sign it, does not test it as part of the examination, and does not confirm that its statements are accurate. The statements are management's own representations, and they stand or fall on management's record. Auditors also do not extend the report's opinion to the gap period. The customer still owns its risk assessment: a bridge letter gives it information to weigh, and the customer must decide whether that information is enough, whether to ask questions, or whether to request more scrutiny of the provider. Customers may also consult the regulator's third-party guidance when they are banks, which expects them to judge whether the scope and results of SOC reports are relevant to the activity performed.

Vague or overreaching wording is a common reason customers reject a letter. Phrases such as "no issues to report" or "fully compliant throughout" invite challenge because they claim more than management can show and imply a CPA review that never happened. Before sending, check that every statement can be backed by a ticket, log, change record or incident report, and remove anything you cannot evidence. Confirm with your CPA firm which language it considers consistent with its report, and avoid implying that the letter is a new or extended SOC 2 report.

Who writes, signs and relies on a bridge letter

Management of the service organization writes, dates and signs the bridge letter. It owns the statement that, to management's knowledge, the controls described in the last report continued to operate as described from the end of the last examination period to the letter date, and it owns any disclosure of exceptions, incidents, system changes or control failures that happened in that gap. Management does not own the auditor's opinion, which remains tied to the examined period. Management also keeps the evidence behind each statement, because a reviewer may ask for it.

Owns the statement: management writes and signs the letter under its own name and authority.
Owns the evidence: access reviews, change records, incident tickets and monitoring logs that support the statement.
Owns the disclosures: known exceptions, changes to the system or subservice providers, and significant incidents in the gap period.
Does not own the opinion: the CPA firm's opinion covers only the examined period and is not extended by the letter.
Independence boundary: management can prepare drafts with outside help, but the signed statement must reflect management's own knowledge.

Check that the letter names the exact gap period and that each statement is backed by evidence management can produce on request.

What to have in place before you write a bridge letter

A bridge letter is only as credible as the records behind it. Before management signs anything, confirm the dates, the system and the evidence that the controls kept running after the last audited period. Each item below is something a customer's reviewer will ask about.

Confirmed end date of the last Type 2 period

Start with the exact end date of the observation period in your current SOC 2 Type 2 report. The bridge letter covers the time after that date, so every later statement depends on it. Check the report's period statement against your records and confirm that no later period has been audited. If the date is unclear, resolve it with your CPA firm before drafting anything.

Current system description

Compare the system description in the report with how the system runs today. Look at infrastructure, hosting regions, subservice organizations, data flows and the people who administer the platform. Any difference since the period ended belongs in the letter's scope, and a reader will check it against the description first.

Log of control changes since period end

List every change that touched a control, including new tools, identity provider changes, policy rewrites, staffing changes in security roles and infrastructure migrations. Tie each entry to the affected Trust Services Criteria. An incomplete change log is the most common reason a bridge letter loses its value with a reviewer.

Exceptions and incidents register

Pull the exceptions noted in the last report and every security incident, outage or control failure since the period closed. Record the root cause, the fix and the date each was closed. Management should be able to state plainly which items are open, because the letter cannot describe a control as operating when an exception remains unresolved.

Evidence that controls kept operating

Gather dated records for the recurring controls: access reviews, change tickets with approvals, monitoring alerts and their triage, backup restore tests, and onboarding and offboarding records. Sample a few items from each control and confirm they exist and are complete. Gaps found now are easier to explain to a customer than gaps found during a review.

A named owner for the signed letter

Assign one member of management who has authority over the controls and is accountable for the statements in the letter. That person should review the evidence, confirm the change log and sign. Your CPA firm does not issue or sign the bridge letter, so the owner must be ready to answer customer questions about it.

How the bridge letter is prepared, reviewed and delivered

The sequence turns the gap between the last report period and the letter date into a documented statement that management can sign, that the customer can read against the report, and that states plainly what it does not cover.

Confirm the dates with the report
Management pulls the most recent SOC 2 Type 2 report and records the exact start and end dates of its examination period, along with the date the report was issued. The team also records the date the letter will cover through, which is the later date the customer has asked about. Output: a short date sheet signed off by the compliance owner that the CPA firm's report matches. Done when no one on the team has to guess which period the letter starts from.
Collect evidence of control operation over the gap
The control owners gather records showing that the controls ran between the end of the report period and the letter date. Typical evidence includes access review records, change tickets, alert and incident logs, backup and restore records, and training completion reports, drawn from the same sources the auditor tested. Output: an evidence index that maps each relevant control to the artifacts that show it operated. Done when every control named in the letter has at least one dated record in the index.
Document changes and exceptions
The compliance lead compares the current environment with the one the report described, listing changes to systems, subservice organizations, personnel with security roles, policies and the control matrix. Any control that failed, was late or was not performed during the gap is recorded as an exception with its cause and remediation. Output: a change and exception log that management reviews line by line. Done when the log is complete enough that the letter can state its exceptions openly rather than leave them out.
Draft the letter in management's voice
Management, usually through the compliance or security lead, drafts the letter on company letterhead. It identifies the report period, the gap period and the systems covered, states management's view that controls operated as described during the gap, lists known exceptions, and says that the statement is made by management and is not an examination by the CPA firm. Output: a draft letter and a short list of open questions. Done when each sentence can be traced to a record in the evidence index or the exception log.
Review scope wording with legal or the CPA firm
Legal counsel, or the CPA firm if it has agreed to review wording, checks the scope and disclaimer language so that the letter does not imply an attestation, an opinion or a new report. The reviewer compares the draft with the report's system description and confirms the stated systems and services match it. Output: a marked-up draft with agreed wording and a note of any sentence the reviewer rejected. Done when the reviewer has confirmed in writing that the letter makes no claim beyond management's own statement.
Obtain management's signature
An officer with authority over the control environment signs the letter, and the signed version is filed with the evidence index and the exception log. The signatory confirms internally that the people named in the letter have read it and that the evidence supports each statement. Output: a signed letter and an archived package containing the draft history, reviewer notes and evidence references. Done when the package can be produced if a customer, bank examiner or auditor asks how the letter was prepared.
Deliver the letter with a note on its limits
Sales or account management sends the signed letter to the customer with a cover note explaining that it is management's statement for the stated period, that it is not a SOC 2 report or an opinion from a CPA firm, and that the customer should review it alongside the most recent report. The team logs the recipient, the date and the version sent. Output: a delivery record and a note in the customer file on when the next full report is expected. Done when the customer has received the letter with its limits stated in writing.

Bridge letter, next report or extended scope: which fits the request

This table compares three ways to answer a customer who asks for SOC 2 coverage beyond the end of the last report period: a management bridge letter, waiting for the next Type 2 report, or a written explanation backed by added evidence or testing. Read each column against the customer's actual risk and contract wording, because the right choice depends on what the customer needs to rely on, not on which option is quickest to produce.

Option	When it fits	What the customer receives	What it does not prove	Questions a bank or customer will raise
Management bridge letter	A short gap between the end of the last Type 2 period and a later date, with no known major change to systems or controls	A signed statement from the service organization's management about the period after the report, prepared by management, not the CPA firm	That controls operated effectively during the gap; the CPA firm does not test or opine on it	Why the gap exists, whether any incidents or control failures occurred, and whether the signer has authority and the basis for the statements
Wait for the next Type 2 report	The customer's contract or risk review can accept a later report, or the gap is long enough that a letter would be thin	The new report with an opinion on operating effectiveness over its own observation period, issued by an independent CPA firm	Coverage for the interval before the new observation period starts, unless that period is designed to connect with the prior one	When the next period starts and ends, whether the timing covers the customer's renewal date, and whether the prior report had exceptions
Written explanation with added evidence or testing	Significant changes occurred, the gap is hard to justify in a letter alone, or the customer requires specific assurance	A management explanation plus evidence or testing the customer agreed to in writing, with scope and limits defined in advance	A CPA opinion on the period unless the CPA firm has been engaged to report on it; the customer's own risk stays with the customer	What testing was agreed, who performed it, whether results are independent, and how the customer's own controls over this vendor are being assessed

How banks and regulated customers read a bridge letter

If you sell to a US bank, the question is less whether a bridge letter is acceptable and more what the bank's contract and vendor review say it must receive. The 2023 interagency third-party guidance suggests that contracts specify the types and frequency of audit reports a bank is entitled to receive from a third party, and it names SOC reports as an example. A bridge letter is not an audit report, so a bank that asks for one is usually asking for interim assurance on top of the most recent SOC 2 Type 2 report. Check the contract language before you draft anything, because the bank's own wording defines what you owe.

The same guidance says a bank may consider whether the scope and results of SOC reports are relevant to the activity the third party performs, or whether the gap between reports calls for more scrutiny. In practice, reviewers compare the report's system description and subservice organizations with the services the bank actually uses, read any exceptions, and then decide whether a letter covering the gap period is enough or whether they need to ask more questions. Expect questions about whether anything changed in the gap, such as a new cloud region, a new subprocessor, or a significant incident, and prepare clear, dated answers. Your management letter should match those answers exactly.

The agencies proposed replacement third-party risk management guidance in September 2026, and comments are due November 16, 2026, according to the Federal Register notice. Because that proposal could change how banks define these expectations, confirm the current requirements with your bank customer, its regulator and your own counsel before you commit to a letter format or a delivery schedule. This section describes how the existing guidance is applied and does not constitute legal advice.

Why bridge letters get rejected or cause trouble later

A bridge letter is only useful if the customer can rely on it, and most problems come from how it is timed, worded and scoped. The cards below cover the mistakes that make customers reject a letter or find gaps after they have already relied on it.

Signed after reliance began

Management often issues a letter only after a customer has already used the vendor's last report to approve a renewal or onboarding. The letter should cover the period from the end of the last Type 2 observation period forward, and it should be dated and delivered before the customer's next decision. Check that the customer's vendor file shows the letter arriving on or before the decision date, not weeks later.

Wording that sounds like an opinion

A bridge letter is a statement from management, not an examination opinion from the CPA firm. Phrases that suggest the auditor tested or attested to the period after the report can mislead a reader who assumes a CPA is standing behind the claims. Have counsel and the CPA firm review the wording, and state clearly who signed it and what it covers.

Omitting control changes and incidents

A letter that says nothing about system changes, new subservice providers, security incidents or staff turnover invites the question of what was left out. Management should list material changes to the system, controls and vendors since the period ended, along with any incidents and how they were handled. Review change tickets, incident records and the vendor inventory for the gap period before signing.

Ignoring exceptions in the last report

If the last Type 2 report contains exceptions or a qualified opinion, a bridge letter that describes the period as clean will be read as hiding them. The letter should acknowledge each open exception, state its remediation status and say what evidence exists. Compare the letter against the exception list in the prior report line by line.

Used as a permanent substitute

A bridge letter covers a short interval. Treating it as a standing replacement for the annual report means the customer never receives an independent opinion on operating effectiveness. Agree in the contract on when the next report is due, and make the letter a stopgap that ends when that report is issued.

Covering a known, unaddressed gap

When the team already knows a control failed or was never implemented in the Type 2 period, a letter that avoids it creates a misrepresentation risk. The honest path is to disclose the gap, document the planned fix and timeline, and tell the customer it may appear as an exception in the next report. Record that disclosure in the vendor file before sending anything.

Questions buyers ask about SOC 2 bridge letters

Is a SOC 2 bridge letter required by law?

No law names a bridge letter, so whether you must provide one depends on the contract and the customer. A bridge letter is usually requested in a vendor agreement or security questionnaire, often when the last Type 2 period ended well before the customer's review date. US banking agencies' 2023 third-party guidance suggests contracts specify the types and frequency of audit reports a bank can receive, with SOC reports given as an example, so a bank customer may write the requirement into its contract. Read the clause that names the report, then confirm with your customer exactly what they expect to receive.

Who signs a SOC 2 bridge letter?

Management of the service organization signs it, not the CPA firm. The letter is a statement from your leadership about the period between the end of the last examined period and the date it covers, typically addressing whether they are aware of material changes to the system or controls and of any known incidents or exceptions. Your officers are accountable for what it says, so the people who sign should understand the underlying evidence. Confirm the signatory with your legal and compliance leads before drafting.

Does the CPA firm issue a SOC 2 bridge letter?

The CPA firm does not issue the bridge letter, because it is management's statement. The auditor may review the wording or ask questions about the period, but its opinion remains tied to the examined period or date in the report it issued. Ask your CPA firm early what it will and will not comment on, so that the letter does not imply an assurance the auditor never gave. Only an independent CPA firm can issue the SOC 2 report itself.

What does a SOC 2 bridge letter cost and how long does it take?

The direct cost is mostly internal staff time, plus any outside help you choose to buy. Effort depends on how mature your evidence is and how many gaps exist between the examined period and the letter date. A team with current access reviews, change records and incident logs can usually answer quickly, while a team that must reconstruct records or remediate control gaps will spend far more time. No standard fee applies, so ask any provider to break its quote into scope, evidence review, gap analysis and drafting, and state which items are one-time and which recur.

Can we prepare a SOC 2 bridge letter without outside help?

Yes, in most cases, because management writes and signs the letter. Your team needs to review control evidence for the gap period, confirm changes to systems, personnel and subservice providers, and identify any incidents or exceptions. Outside help is useful when the period is complex, when evidence is scattered across tools, or when legal review is needed. Whatever you do, keep a file of the evidence behind each statement so you can explain it to a customer or auditor later.

Does a bridge letter replace the next SOC 2 report?

No. A bridge letter is a short management statement covering an interval after the last examined period, and it carries no CPA opinion on operating effectiveness. Each SOC 2 Type 2 report gives an opinion tied to the period it covers, so the next report is still needed to give customers independent assurance over the newer period. Customers and banks reviewing your vendor file may still ask for the current report, so plan the examination cycle around their renewal dates, not only around the letter.

What should we ask a partner before engaging one for a bridge letter?

Ask what the partner will deliver and what it will not issue, since no implementation partner can issue a SOC 2 report. Request a written scope listing the gap period, the evidence reviewed, the people involved and the deliverables, along with the assumptions behind any timeline. Ask how the partner handles findings it discovers and whether it will document them for your records. DeployOpen prepares systems, controls and evidence for assessments and does not issue audit reports or attestations, so confirm the boundary of any engagement in writing.

How DeployOpen prepares evidence for a bridge letter

DeployOpen works on the systems and records behind a bridge letter, so that management has current, reviewable evidence for the period between the last Type 2 report and the letter date. DeployOpen prepares that evidence inside the client's own infrastructure, while the statement itself remains management's responsibility and any independent report comes from a CPA firm.

How we scope

Agree in writing which systems, services and controls the bridge letter period covers before work starts.
Confirm the start and end dates with management and the CPA firm, so the evidence window is clearly defined.
Identify which self-hosted platforms run in-scope controls and where their logs and records are kept.

How we build

Configure self-hosted platforms so access reviews, change records and monitoring logs are generated consistently throughout the period.
Map the evidence to the relevant criteria so management can show how each control kept operating after the Type 2 period.
Test the evidence collection itself, confirming that records are complete, timestamped and retained for review.

How we hand over

Deliver an evidence register listing each control, the period covered, the source system and the stored location.
Document any gaps, exceptions or control changes in the period so management can disclose them accurately.
Provide a handover session so management can review and sign off on the evidence before the letter is issued.

How we support

Offer ongoing support as a retainer if the bridge period extends or the next Type 2 examination needs further preparation.
Keep evidence collection running between audits so that later bridge letters draw on the same consistent records.
Confirm with your CPA firm which evidence it expects to see, since the auditor decides what sufficient support looks like.