What is a bridge letter, and how much should a buyer trust one?

SOC 2 Type II reports cover a period, and periods end. A report for the twelve months to 31 March is issued in May or June, and by the following March the most recent tested evidence is a year old. Buyers reviewing a vendor in the gap ask for a bridge letter, also called a gap letter, which the vendor writes to cover the months since the period end. This explainer sets out what a bridge letter is, what it must contain, how long it can reasonably run, and how much weight it carries next to the report it extends.

90 days

Standard maximum a bridge letter should cover

IS Partners, Vanta and Thoropass guidance

6 months

Point at which buyers become sceptical

Agency, SOC 2 bridge letter guide

0

Auditor tests behind a bridge letter

It is a management representation

What a bridge letter is

A bridge letter is a formal statement from the vendor’s management that covers the period between the end of the last SOC report and a stated date, usually the letter date. It confirms that there have been no material changes to the system, the controls or the control environment described in the report, or it describes the changes that occurred. It is an interim management assertion, not a new audit.

A SOC 2 bridge letter is a formal letter from a company’s management that covers the gap between its last official SOC 2 report and the present moment. It’s not a new audit, it’s an interim management assertion.

What a bridge letter says

• The period the last report covered and the date it was issued, with the report type and the auditor named.
• The date range the letter covers, from the period end to the letter date.
• A statement by management that there have been no material changes to the system or the controls described in the report, or a description of the changes.
• A statement about known incidents or exceptions in the gap, when the vendor chooses to include one.
• A signature from an officer of the vendor, not from the auditor.

What it is not

A bridge letter is not an auditor opinion, and no CPA firm has tested anything in the gap. It is a representation by the vendor about itself. That is fine as far as it goes; it extends the usefulness of a report by a few months while the next one is prepared. It does not extend the assurance. Some vendors issue bridge letters for twelve months or longer, which should prompt the question of whether the next audit is happening at all.

How long a gap is reasonable

Industry guidance converges on 90 days. Most buyers accept a bridge letter covering up to three months after the period end, some accept six, and few accept more without an explanation. A vendor on an annual audit cycle should be able to name the month the next report is due; if it cannot, the letter is doing more work than it should. Compliance platforms and audit firms publish the same threshold, which makes it a reasonable line to write into a contract.

What to check when you receive one

1. 1

   The dates line up

   The letter starts where the report ended. A letter that starts later leaves an uncovered gap.

2. 2

   The system matches

   The system description referenced is the one for the product you use, with the same name as the report.

3. 3

   Changes are listed, not just denied

   A letter that names a new data centre, a subprocessor change or an incident is more credible than one that says nothing changed in a year.

4. 4

   The signatory is identifiable

   A named officer on the vendor’s paper, not a generated PDF from a compliance platform with no name.

5. 5

   The next report has a date

   Ask for the expected issue month and record it in your vendor register.

When to refuse one

• The letter covers more than six months and no next-report date is offered.
• The report it extends is a Type I; a bridge letter cannot turn design-only assurance into operating effectiveness.
• The letter denies any change while the vendor’s own change log, subprocessor list or status page shows otherwise.
• The signatory cannot be identified or the letter is unsigned.

How CertReports records it

The index records a bridge letter as a dated, vendor-stated artefact next to the report it extends, so the row shows both the period end and the letter date. When the period end passes twelve months, the row shows as stale regardless of the letter. Read the SOC 2 reading guide for the rest of the report and expiring this month for periods ageing out now.