Bridge Letter

A bridge letter is a short letter, written and signed by a service organization's management, that covers the time between the end of its latest SOC 2 audit period and the date a customer asks for assurance. It is also called a gap letter. In it, management states whether there have been any material changes to the system or its controls since the period ended, or that it is not aware of any. Because the letter comes from management rather than the auditor, it carries no auditor assurance: the CPA firm does not write, sign, or send it. Bridge letters exist because SOC 2 reports look backward. A Type 2 report covers a fixed audit period, and by the time a buyer reads it, several months may have passed since that period closed. The bridge letter tells the buyer what has happened since. Most bridge letters cover no more than three months. That is a convention rather than an AICPA rule, but a gap longer than three months usually means the next audit period should have started sooner, and buyers may push back on a letter that stretches further. A typical letter names the report it bridges, states the gap period, confirms whether controls changed, notes any significant incidents or system changes, and says when the next report is expected. Companies usually send it together with their latest SOC 2 report, often through a trust center, and refresh it every month or quarter until the new report arrives. The simplest way to keep bridge letters short is to run audit periods back to back, so each new period starts the day the previous one ends.