Skip to Content
SOC 2Bridge letter

SOC 2 bridge letter: closing the gap between two reports

Your SOC 2 Type II report covers January to December 2025. It is now March 2026, and a prospect asks for your report. There is a three-month gap between the end of your report and today. A bridge letter, also called a gap letter or comfort letter, bridges that gap. The AICPA  does not set a formal standard for bridge letters, but in practice it is a widely accepted approach. Also read what the SOC 2 audit cycle involves to understand why a gap arises in the first place.

A bridge letter does not replace your SOC 2 report. It is a supplement: you state yourself that nothing material has changed. No accountant signs it. It is a statement from your management.

When do you need a bridge letter?

A gap always arises. Your SOC 2 report has an end date, but clients ask for it months later. How large a gap is acceptable depends on your client. Which form of report a client expects, and how to share the report safely, is covered on sharing the SOC 2 report with clients.

GapWhat clients usually accept
0-30 daysAlmost always accepted, no letter needed
1-3 monthsAccepted provided a bridge letter is included
3-6 monthsSometimes accepted, depending on the client’s risk classification
6+ monthsThe client usually asks for a new report

Enterprise clients with strict vendor risk policies rarely accept a gap of more than three months, even with a bridge letter. Lower risk gives more room.

You need a bridge letter if:

  • A client or prospect asks for your most recent report while that report is three months old or more
  • You are in an RFP process and the report’s end date falls outside the permitted period
  • Your re-audit has been delayed and you want to inform your clients

What does a bridge letter contain?

The letter is short. One to two pages is normal. Longer letters raise more questions than they answer.

A good bridge letter contains:

  1. Identification of the report: which period, which auditor, which criteria
  2. The statement: that there have been no material changes to the controls or systems described in the report
  3. Exceptions: if something has changed (a major migration, a security incident, new systems), the letter states this explicitly
  4. Signature: by an authorised person within your organisation, usually the CEO, CFO or CISO
  5. Date: the letter is current and must not be backdated

Who writes the bridge letter?

You do. Or more precisely: someone within your organisation with signing authority. The auditor does not write it and does not sign it. That is what separates the bridge letter from the actual report.

Some clients ask whether your auditor has “confirmed the bridge letter.” That is not standard practice. At most, the auditor confirms that they know you are issuing a bridge letter, but they give no assurance about the period after their report. If a client requires that, the only real solution is a new report.

Example structure of a bridge letter

Below is a template you can adapt. Use your own letterhead and have it reviewed by your legal or compliance officer.

[Organisation name]: Bridge Letter

Date: [current date]

To: [recipient name or “interested parties”]

Subject: SOC 2 Type II report, period [start date] to [end date], carried out by [name of CPA firm]

We, the management of [organisation name], hereby declare the following:

Our most recent SOC 2 Type II report covers the period [start date] up to and including [end date]. That report was prepared by [name of CPA firm] and is available to authorised parties under a non-disclosure agreement.

We declare that, to the best of our knowledge, no material changes have occurred in the period from [end date of report] up to and including [date of this letter] to the controls, systems or processes described in the above report. In particular:

  • The scope of our system and the Trust Services Criteria are unchanged.
  • No security incidents have occurred with a material impact on the security of client data.
  • There have been no organisational changes that materially affect the effectiveness of our controls.

[If applicable:] With the exception of the following: [describe any changes and their limited impact].

This declaration is not an attestation and does not replace the SOC 2 report. We expect our next report, covering the period [expected start date] to [expected end date], to be available on or before [expected delivery date].

Name: ___________________________ Position: ___________________________ Date: ___________________________

Common mistakes with bridge letters

Declaring too broadly “Nothing has changed” is a dangerous sentence if things have changed, even if those changes had no direct impact on the controls. Be precise: only make statements about the controls that were in scope for the report.

Waiting too long A bridge letter for a seven-month gap is rarely accepted. If you see that your re-audit is going to run late, send the letter early and reschedule the re-audit.

Not mentioning exceptions If a system was migrated, a key employee left, or an incident occurred during the gap period, mention it. A bridge letter that hides news damages the trust relationship more than an honest disclosure does.

Asking the accountant to sign Do not ask your accountant to do this. They have no assurance about the period after their report, and would be signing for something they have not verified.

The bridge letter in relation to your re-audit

The best remedy for report gaps is a re-audit that starts on time. If your Type II report ends in December, you start preparing for the new audit period in October. That leaves at most three to four months of gap while the new report is finalised.

For a complete breakdown of the cost of the re-audit cycle, see costs and timeline. For the question of whether Type I can serve as an interim step to close the gap: that only works if clients accept Type I. Read the full difference on Type I vs Type II.

More information

Compliance toolingSharing the report with customers