SOC 2 management representation letter: what it covers

What the SOC 2 management representation letter is and when it is signed

When a customer or contract asks for a SOC 2, the team needs to know what management commits to in writing before the examination closes. Under AT-C section 205 of the AICPA attestation standards, the service auditor must request written representations from the responsible party, and those representations go in a letter addressed to the auditor. The AICPA publishes separate illustrative management representation letters for a SOC 2 Type 1 examination and a SOC 2 Type 2 examination, and the Type 2 letter applies to reports dated on or after June 15, 2022, so the letter you sign follows the report type you are buying.

The content of the letter depends on the report type, the scope of the examination and the systems described in management's description. A Type 2 letter carries statements about operating effectiveness over the observation period, which a Type 1 letter does not, so the signatories need to understand that difference before anyone drafts a sentence. The organization owns every statement in the letter, including the claims about the system description, the controls and any exceptions it knows about. The independent CPA firm issues the report and its opinion, but it does not write management's statements for the organization to sign. Read the AICPA illustrative Type 2 letter alongside your own scope before the first fieldwork meeting.

Ask the CPA firm for its draft representation letter early, and confirm which categories, systems and subservice organizations it expects the letter to cover. Check that every system in the description is named consistently across the description, the assertion and the letter. A useful internal check is to ask each control owner whether they can support the statements in the letter that concern their area, and to record any known exceptions before the letter is signed. The letter is only as accurate as the evidence behind it, so treat it as a sign-off on work that has already been completed.

How the Type 1 and Type 2 letters differ

A Type 1 examination reports on the fairness of the system description and the suitability of control design as of a single date, so the representation letter is anchored to that point in time. AT-C 205 requires management to make written representations to the service auditor, and the AICPA's illustrative Type 1 letter adds statements that match the Type 1 scope. Management confirms that the system description is fairly presented, that the controls were designed and placed in operation as of the date, and that it has disclosed what it knows about the system.

Design and implementation as of one date: Management represents that controls were suitably designed and in operation at the specified date, not that they worked over a period.
System description fairness: Management confirms the description presents the system as designed and implemented at that date, including services, infrastructure, software, people, procedures and data.
Subservice and complementary controls: Statements cover how carved-out providers and customer-side controls are described, so the report does not imply coverage that does not exist.
Known noncompliance and incidents: Management discloses instances of noncompliance, known incidents and matters that could affect the description or the design of controls.
Subsequent events: Management reports events after the date that could change the description or the auditor's conclusions.

Before signing, confirm that the letter matches a single as-of date, that each representation reflects evidence your team can produce, and that your counsel has reviewed any wording that goes beyond the template.

Who signs the letter and what each signer is accountable for

The representation letter is signed by people who can personally vouch for different parts of the system, its controls and its evidence. Each signer should be able to explain and support the statements they sign, and the letter is addressed to the service auditor, not to customers.

Chief executive or senior executive

The senior executive responsible for the system is often the signer who answers for the overall description and the organization's commitments. This signer should understand the service commitments in the system description and the scope of the examination. Before signing, confirm that the statements about the system are accurate for the whole examination period, including any significant changes, incidents or vendor changes. Ask the CPA firm whether it expects this role to sign and whether a single signature or multiple signatures are required.

Chief information security officer or CTO

The security or technology leader usually answers for how controls operate in production, including access, change management, monitoring and incident response. This signer should be able to point to the evidence behind each control claim, such as system-generated access reviews or change tickets. Confirm which control statements this person is accountable for, and whether any exceptions or deviations found during fieldwork were disclosed to the auditor. Their signature should not cover statements about controls they did not oversee.

Compliance lead

The compliance lead typically coordinates the evidence request, tracks the control matrix and confirms that policies match practice. This person is often the day-to-day contact for the auditor and can confirm that requests were answered completely. Check that the compliance lead has verified the representations about completeness of information provided to the auditor, since that statement covers every request, not only the ones they handled. Where the lead is not an officer, confirm whether the CPA firm accepts a signature from this role.

System description owner

The person responsible for the system description writes or approves the narrative of the system, its boundaries, infrastructure and subservice organizations. This owner should confirm that the description reflects how the system actually runs, including components added or removed during the period. Representations about the description are only as reliable as this person's knowledge of the environment. Ask the CPA firm whether this owner must sign or only provide input, and whether the description is attached to the letter or referenced by it.

Other officers with delegated areas

Where controls are owned by other functions, such as HR for background checks or facilities for physical access, those leaders may need to confirm their areas. Their confirmations can support the signers' statements, but they do not replace the accountable signer's review. Document who confirmed what and when, and keep those confirmations with the evidence file. Confirm with the CPA firm whether sub-certifications are expected or whether the signers' review of supporting records is enough.

How the letter fits into the examination timeline

The representation letter is not a formality signed on the last day. It is built from the start of the examination, checked against evidence as it is gathered, and signed at a fixed point so that the report, the letter and any bridge letter all describe the same system and period.

Start from the illustrative letter
Management's team, usually the compliance lead with legal or finance input, takes the AICPA illustrative management representation letter that matches the engagement type, Type 1 or Type 2, and adapts its wording to the organization's system, services and subservice organizations. The output is a working draft that lists every representation as a numbered line, with the wording the CPA firm has agreed to review. Confirm early with the CPA firm which illustrative letter and version it expects, because the Type 2 letter applies to reports dated on or after June 15, 2022.
Map each representation to evidence
For every line in the draft, the control owner names the control, the system or document that proves it and the person who can produce that evidence on request. Statements about completeness of information, known instances of noncompliance, fraud, subsequent events and subservice organizations each need a named source. The output is a representation-to-evidence register that the team can hand to the auditor, and any line without an owner or source is flagged before the auditor sees it.
Review the draft with the CPA firm
Management sends the register and the draft letter to the CPA firm and works through the wording line by line. The auditor's comments often concern scope, the period covered, and whether a statement can be supported by the records the team actually keeps. The output is an agreed draft that both parties understand, along with a list of open questions that the team resolves before fieldwork closes. Ask the firm in writing to confirm the final form of the letter, since the firm sets the requirements it will accept.
Close fieldwork and confirm the facts
While testing finishes, the team checks each representation against the latest state of the environment and the exceptions the auditor has raised. Any change in systems, personnel or control operation during the period is recorded and discussed with the auditor. The output is a list of confirmed facts and any exceptions that must be disclosed in the system description or report, so that the letter does not contradict the fieldwork record.
Obtain management's signature at the end of fieldwork
A senior officer who is responsible for the system, usually an executive with authority over the service commitments, signs the letter on the date the auditor specifies, normally at the end of fieldwork and before the report is issued. The signer should have read the register and the supporting evidence. The output is a signed letter addressed to the service auditor, held in the engagement file, and the signer should keep a copy for the organization's own records.
Reconcile the letter with the report date
The team compares the signed letter with the report's period, date and description of the system, checking that the dates, system name, locations and subservice organizations match. Any difference is resolved with the auditor before the report is released. The output is a reconciliation note showing that each representation is consistent with the report, which the team can refer to when customers or reviewers ask questions about the report.
Address the bridge letter if one is needed
When the report is issued some time after the period ends, customers may ask management for a bridge letter covering the gap between the period end and a later date. Management prepares the statement, and the team checks it against current facts and any changes since fieldwork. The output is a dated bridge letter, a short statement that management signs and provides to customers, and the team should confirm with the CPA firm whether any representation changes in that statement before it is issued.

What must be true before management can sign

Management signs the representation letter only after it has checked the facts it is vouching for. The checks below connect the system description, the controls, the known problems and the carved-out vendors, so that nothing in the letter is a surprise to the auditor or to the people who sign it.

The system description is accurate

Management represents that the description of the system fairly presents the system as designed and operated during the period, measured against the description criteria. Before signing, walk each section (services, infrastructure, data flows, people, policies) with the engineers who run it and confirm that nothing has changed since the description was drafted. An outdated description is one of the most common reasons a letter has to be revised.

Every representation has evidence

Each statement in the letter should trace to a document, a system-generated report or a record the auditor can sample. Build a short table that pairs each representation with its evidence owner and the location of that evidence. A representation that rests only on someone's memory is a finding waiting to happen, and the owner should be able to produce the evidence without help from the implementation partner.

Exceptions and incidents are disclosed

Management must disclose known deviations, control failures, security incidents and near misses that occurred during the period, including those already fixed. Review the ticketing system, the incident log, the access review results and the vulnerability backlog for the whole period. Omitting an incident that the auditor later finds in the logs damages the credibility of the entire report, not just one control.

Subservice and CUEC statements match

The representations about subservice organizations and complementary user entity controls must agree with the system description and with the vendors' own reports. Confirm which providers are carved out or included, that the complementary subservice organization controls listed match what those providers actually say they do, and that each listed customer control is one the customer can realistically run.

Post-period events are reported

Events after the period end but before the report date can change what the report should say. Ask the people who run security, engineering and legal to confirm, in writing, whether any incident, acquisition, platform migration, key personnel change or material vendor change has occurred. The letter covers this period, so the compliance lead should record the review date and the names of the people consulted.

Management owns the signature

The organization's own officers sign the representation letter and the assertion. An implementation partner can assemble the evidence, run the pre-signing review and draft the letter for discussion, but it cannot sign for management and it does not issue the report. The independent service auditor decides whether the evidence supports the opinion. Confirm the signatories and their authority with the firm before the fieldwork closes.

What the proposed AT-C 205 changes could mean for future letters

The AICPA Auditing Standards Board exposed proposed revisions in February 2026 to AT-C 105 (common concepts), AT-C 205 (assertion-based examinations) and AT-C 210 (reviews), with comments due June 30. If the revisions are adopted, they would apply to engagements beginning on or after June 15, 2029. Until then, the representation letter your CPA firm requests continues to follow the current standard and the AICPA's illustrative letters for SOC 2 Type 1 and Type 2 examinations. The proposal is a signal to plan for change, not a reason to alter the letter now.

Because AT-C 205 is the standard that requires the written representations, any change to it could affect what the service auditor asks management to represent, how the letter is worded, and when it is dated. Ask your CPA firm to tell you, in writing, which parts of the proposal it expects to affect your engagement and whether it will update its engagement letter or letter template when the final text is issued. Keep the current signed letters and their supporting working papers in your evidence file so that the baseline for any future comparison is clear. The Journal of Accountancy's coverage of the February 2026 proposal is a useful starting point for understanding the scope of the exposure draft.

Plan for the transition on your own calendar. If your first or next examination period would fall close to June 15, 2029, confirm with your CPA firm which version of the attestation standards will govern your engagement and when the letter's wording must be settled. Assign an owner, normally a senior member of the compliance or finance team who signs the letter, to review the final standard once issued and to brief the executives who sign. Do not assume the proposal is final, and do not rely on this summary for the final text, which only the adopted standard and your CPA firm's interpretation can confirm.

Questions buyers ask about the representation letter

Can a consultant draft the management representation letter for us?

Yes, a consultant or implementation partner can prepare a draft, but the organization's management signs it and owns every statement in it. The letter is addressed to the service auditor and is part of the examination record, so the signatories must be able to confirm each representation from their own knowledge and the evidence behind it. A partner can organize the supporting records, map each representation to the people and systems that stand behind it, and walk management through the wording. Only the auditor can issue the report, and the auditor will still test the representations against the evidence. Ask any partner to state in the written scope who drafts, who reviews and who signs.

Does the auditor provide the representation letter template?

The auditor usually expects a letter in a form it can accept, but the starting point is public. The AICPA publishes illustrative management representation letters for SOC 2 Type 1 and Type 2 examinations, and the Type 2 letter includes the representations AT-C section 205 requires plus additional ones specific to a Type 2 examination. Many firms ask the client to use the illustrative wording as a base and adjust it to the system, the categories in scope and the subservice organizations involved. Confirm with your auditor which template and version they want, and whether they require any changes to the standard wording before you draft.

How much effort does drafting the letter take, and what drives it?

Drafting itself is usually a short task, but the work behind each representation is not. Effort rises with the number of systems in the description, the number of categories in scope, the count of subservice organizations and carve-out vendors, and how many changes, incidents or exceptions occurred during the period. A Type 2 letter covers the whole observation window, so management must be able to stand behind statements about operation over that period, not only at a point in time. Ask any partner or auditor to list which representations need supporting records, who owns each record and how far back those records must go.

What happens if a representation in the letter turns out to be wrong?

A representation that proves inaccurate can undermine the examination. The auditor may need to revisit testing, add procedures, describe exceptions, or in serious cases be unable to issue a report that can be relied on. Because the signatories have made the statement in writing, an inaccurate representation can also create professional and legal exposure for them and for the organization. The practical protection is to review each representation against the evidence before signing, to disclose known exceptions, incidents and control failures to the auditor early, and to keep a record of how each statement was checked. Ask your auditor how they handle a representation that needs correction before the report date.

Does the letter change if we add categories to the scope?

Yes, the letter should reflect the categories actually in scope. The security category is covered by the common criteria and applies to every SOC 2. If you add availability, confidentiality, processing integrity or privacy, the representations about those criteria, the related controls and the system description must match. Each added category typically brings additional controls, evidence and representations that management must confirm, so the letter is revised alongside the system description and the control matrix. Confirm with your auditor when a scope change needs to be reflected in the letter and whether it affects the period already under examination.

Who should sign the letter, and does one person have to sign?

The letter is signed by the people responsible for the system, which in most organizations means senior management such as the chief executive officer, the chief financial officer or the chief information security officer. Confirm with the auditor which roles they require, since the wording of the illustrative letters refers to the responsible party. Signatories should have authority over the system and enough knowledge to confirm the representations. Where the signatory is not directly involved in operating controls, the team that owns each control should supply written sub-certifications or confirmations to support the signature.

Can we prepare the letter ourselves without an outside partner?

Yes, an organization can prepare its own letter if it has staff who understand the system, the controls and the evidence behind each statement. An outside partner adds value mainly where internal teams lack capacity, where the system is complex, or where evidence is scattered across tools and needs to be assembled before management signs. Whatever the choice, the organization owns the controls and the letter. Any partner you consider should be able to explain their role in writing, and the auditor remains the only party that issues the report.

Common mistakes that delay signing

The representation letter is the last document management signs, so gaps found at that stage push back the report date. The pitfalls below share a root cause: management makes statements it has not checked against its own records. Each card names one pitfall and the step that prevents it.

Copying a template without tailoring

The AICPA publishes illustrative letters for Type 1 and Type 2 examinations, and teams often paste them in unchanged. Each representation must match the system, the criteria in scope and the report period actually examined. A letter that refers to categories the company dropped, or to a period that does not match the report, forces a rewrite. Check every paragraph against the system description and the assertion before the draft goes to the auditor.

Signing representations without evidence

A representation is a statement that management makes to the service auditor, so every statement needs support in the company's own records. Before signing, ask each control owner to point to the evidence for the statements they own, such as completed access reviews or change approvals. Statements that rest only on memory or on a policy document that nobody follows are the most common reason signing stalls.

Omitting subservice organization statements

Cloud hosts, payroll processors and other vendors often run controls the report depends on. The representation letter must address how those organizations are treated, whether by the carve-out or inclusive method, and must not imply that the company controls their operations. Confirm that the subservice list in the system description matches the vendors in use, and that each vendor's SOC report is current and on file.

Leaving out complementary user entity controls

Where the system description assigns controls to customers, the company's representations should match what is listed as complementary user entity controls. A letter that describes controls the company relies on customers to perform, without naming them, creates a gap the auditor will raise. Compare the CUEC list in the description with the representations and with the controls shared in customer-facing documents.

Failing to disclose known exceptions

Management is expected to disclose known instances where controls did not operate as described, including those already remediated, and any significant changes during the period. Teams sometimes treat a single missed access review as too small to mention. Keep an exception log during the period, including the root cause and the date of correction, so the disclosure is accurate when the letter is drafted.

Dating the letter inconsistently

The representation letter is dated to match the report date and must cover the full period under examination for a Type 2. Drafts often carry a date from an earlier version of the assertion or ignore a system change made late in the period. Align the letter date, the assertion date and the report period in one review, and confirm with the auditor which signatory will sign and when.

Where an implementation partner helps and where it cannot

An implementation partner such as DeployOpen can help management make accurate representations by preparing the systems, controls and evidence those representations depend on. In practice that means confirming that the system description matches the platforms actually running in the client's cloud accounts, data centers or air-gapped networks, that each control has an owner and a documented operating procedure, and that the records behind each statement can be found and explained. Before management signs, a partner can also walk the responsible people through each representation in the letter and show where the supporting evidence lives, so that no statement rests on memory or on a colleague's recollection.

The boundaries matter as much as the help. Only the organization's management signs the representation letter addressed to the service auditor, and management remains responsible for the accuracy of every statement in it. Only an independent auditor or CPA firm performs the examination and issues the SOC 2 report. A partner does not sign on management's behalf, does not write the representations as its own opinion, and does not issue or endorse an audit result. Nothing in a partner's engagement guarantees a clean opinion, a particular number of exceptions or a specific report date.

Before engaging a partner for this work, confirm in writing which tasks are included in the fixed scope, who keeps the evidence index after the engagement ends, and which items remain with management, such as the final review of the letter and the decision on what to disclose about known deviations. Ask the CPA firm to confirm in advance which representations it expects for your report type, since the AICPA's illustrative letters differ for Type 1 and Type 2 examinations. Those answers determine whether the partner's preparation work is aimed at the right statements.

How DeployOpen prepares evidence for management's representations

DeployOpen works on the systems and records behind the representations management makes to the service auditor. We prepare the evidence that supports each statement, while the organization owns its controls and signs the letter, and only the independent CPA firm issues the report.

How we scope

The written scope lists which systems, controls and evidence sources support each representation in the letter.
We confirm with management which report type applies, Type 1 or Type 2, before any evidence work starts.
Engagements are fixed-scope, and scope, deliverables and timelines are agreed in writing before work begins.

How we build

We configure self-hosted open-source platforms in your own environment to produce logs and records that match each representation.
We document where each claim about controls, incidents and exceptions traces to a system or record.
We test that evidence is complete, dated and retrievable, so management can stand behind each statement it signs.

How we hand over

We deliver an evidence index mapping each representation to its supporting records, owners and storage locations.
We walk management through the evidence so signers understand what each representation confirms before they sign.
We leave runbooks for recurring evidence collection so the next letter can be supported without rebuilding the trail.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial scope is delivered.
We can update the evidence index when systems, subservice providers or the assertion change between examinations.
Questions about what the CPA firm expects in its letter should be confirmed with that firm, since it sets the final wording.