SOC 2 Bridge Letter Duration & Importance

Say your SOC 2 report expired yesterday but the customer’s financial reporting period extends beyond the validity. Does it imply a weak security posture in the gap period or lost compliance status? Definitely not. But your clients will need some kind of solid document in the absence of an audited assurance. Enter SOC 2 Bridge letter.

A SOC 2 Bridge letter acts as an interim assurance when there’s a need to bridge the gap between your SOC report and the customer’s year end. Read on to find answers to the most common questions about bridge letters and more.

What is a Bridge Letter?

A SOC 2 bridge letter is a provisional assurance document provided to customers to cover the gap between your last SOC 2 audit report and the next SOC 2 audit.For instance, if there are still 3 months until your next SOC 2 audit but the customer’s financial year is ending, then you can issue a bridge letter for the gap period.

It assures your customers of your organization’s continued security posture, and that there have been no material changes in your internal controls that could adversely affect the conclusions arrived at in the earlier SOC 2 report. 

What’s included in a SOC 2 Bridge Letter?

Although the AICPA’s SOC 2 compliance guidance doesn’t specifically talk about bridge letters, it’s a good practice to include the following components in the bridge letter SOC report: 

• Start and End Date of your most recent SOC 2 attestation.
• A statement on the modifications or changes made, if any, to your organization’s system of internal controls since the end date of your most recent SOC report; an explanation of the changes made since the audit.
• In case of no changes, include a statement that the organization is unaware of any material changes that might affect the auditor’s opinion.
• Disclaimer that the bridge letter is not a replacement for the SOC 2 report.
• A statement that the bridge letter is only meant for the customer to whom it is issued and no other entity.
• The final paragraph of a gap letter should reiterate your organization’s commitment to constantly evaluating and upgrading physical and cloud-based technology and information security controls and procedures. 

SOC 2 Bridge Letter Example

Here’s a SOC 2 Bridge Letter example for your reference.