SOC 2 bridge letter

A letter from management covering the gap between the end of a company's last SOC 2 report period and today, usually saying controls haven't materially changed.

A SOC 2 Type II report covers a fixed period that ends before the report is issued, and a customer reviewing it later sees a gap. A bridge letter, also called a gap letter, states that there have been no material changes to the controls since the period ended, or describes any that there have been.

It is written and signed by the company's management, not by the auditor, and usually covers up to three months until the next report is available.

What a reviewer wants to see

• The dates of the gap it covers
• Any material changes to controls or systems
• A signature from someone accountable