What a bridge letter is
A bridge letter — also called a gap letter — is a statement from your management covering the period between the end of your last SOC 2 report and today. It asserts that no material changes to the control environment have occurred since the report period closed.
It exists because SOC 2 reports describe a period that has already ended. Your observation window closes in March, the report issues in May, and a customer doing diligence in July is reading about a period that finished four months ago. They ask what has happened since. The bridge letter is the answer.
Who writes it, and who does not
You do. On your letterhead, signed by an officer of the company — typically the CTO, CISO or CEO.
CPA firms generally do not issue bridge letters, and this is the part most people get wrong. The bridge period is unaudited. Nobody tested anything. An auditor cannot offer an opinion on a period they did not examine, so a "bridge letter from our auditor" is either a misunderstanding or a misrepresentation.
| SOC 2 report | Bridge letter | |
|---|---|---|
| Issued by | Independent CPA firm | Your management |
| Based on | Tested evidence and sampling | Your own assertion |
| Contains an opinion | Yes | No |
| Period | The observation window | After it, up to today |
| Can stand alone | Yes | Never |
What belongs in one
Bridge letters are short — usually under a page. What a customer's security team looks for:
Identification of the report. Which SOC 2 report this bridges from, including its exact period and the issuing CPA firm.
The bridge period. Explicit start and end dates. "Since our last report" is not a date.
The assertion. That no material changes to the system or the control environment have occurred during that period.
Any exceptions. Material changes, if there were any. See below.
An acknowledgement of what it is not. That the period is unaudited and the letter carries no auditor opinion. Stating this yourself reads as confidence, not weakness.
Signature and date. An officer, with title.
How long customers will accept one
Roughly three months. Beyond that, acceptance drops off quickly, and reasonably so — a six-month unaudited assertion undermines the point of having an audited report at all.
If you find yourself routinely bridging more than a quarter, the letter is treating a symptom. The underlying issue is your reporting cycle, and the fix is a shorter gap between windows rather than a more persuasive letter.
When something actually did change
This is where bridge letters earn or lose trust.
If a material change occurred during the bridge period — a new subservice organization, a significant system migration, a security incident, a change of control — disclose it. State what changed and what you did about it.
A letter that discloses a specific change and explains the response is credible, and security teams read it as a sign you are paying attention. A letter asserting no changes when a customer later discovers a migration or an incident does considerably more damage than the disclosure ever would have.
The letter is a trust document. Its value comes entirely from being believed.
FAQs
What is a SOC 2 bridge letter?
A bridge letter, also called a gap letter, is a statement from your management covering the period between the end of your last SOC 2 report and today. It asserts that no material changes to the control environment have occurred since the report period ended. It is written by you, not by your auditor.
Who issues a SOC 2 bridge letter?
Your own management issues it, on your letterhead, signed by an officer of the company. CPA firms generally do not issue bridge letters because the period is unaudited and carries no opinion. A letter presented as coming from your auditor is a red flag.
How long can a bridge letter cover?
Usually up to about three months. Beyond that most customers stop accepting them, because a longer unaudited period undermines the point of having a report at all. If you are regularly bridging more than a quarter, the real answer is a shorter reporting cycle.
Is a bridge letter the same as a SOC 2 report?
No, and the difference matters. A SOC 2 report contains an independent auditor opinion based on tested evidence. A bridge letter is your own unaudited assertion about a period nobody examined. It supplements a report; it never substitutes for one.
What if something did change during the bridge period?
Say so in the letter. A bridge letter disclosing a specific change — a new subservice organization, a material system migration, a security incident — is credible. One asserting no changes when a customer later discovers otherwise damages trust far more than the disclosure would have.
Where to go next
Understand the period a bridge letter covers in the SOC 2 observation window, see what the report itself contains in the SOC 2 audit, or start from SOC 2 compliance if this is your first report cycle.