SOC 2 Bridge Letters Explained: What They Are, When You Need One, and How We Get Them for Clients

If you have inherited controls from a data center’s SOC 2 Type II report, you have already done the hard part. You know what is in scope, you have mapped the complementary controls, and your auditor has the report in the evidence folder.

Then the audit window slips. The data center’s report covered January through September. Your auditor wants coverage through December. You have a three-month gap, and the report you have been relying on suddenly does not reach the finish line.

That gap is what a bridge letter exists to close, and the small print on how it is written is what decides whether your auditor accepts it.

What a bridge letter actually does

A SOC 2 bridge letter (sometimes called a “gap letter” or “interim letter”) is a short signed statement from the service organization. It says, in essence: between the end of our last SOC 2 Type II reporting period and today, nothing material changed in our control environment.

That single sentence does real work. It lets your auditor rely on the prior report’s testing for the period the report did not formally cover, without designing and running their own tests against the provider.

Without a bridge letter, your auditor has two unappealing options for the gap period:

1. Treat the provider’s controls as untested for those months and pick up the burden themselves (expensive, slow)
2. Disclose the coverage gap and reduce the level of assurance your own report can provide (worse than expensive)

Bridge letters exist because the alternative is a real cost to you, not because the AICPA mandates them.

When you need one

You need a bridge letter any time your audit period extends past the end of your provider’s SOC 2 reporting period.

The timing math is the trap. Most providers run their SOC 2 on a calendar-year offset, say October 1 through September 30, with the report itself issued one to two months later. If your audit period ends December 31, you need the October–September report plus a bridge letter covering October 1 through December 31.

If you are in continuous-monitoring mode for an annual audit, you will need a fresh bridge letter every three months or so. Build that into your evidence calendar.

What is actually in the letter

A real bridge letter includes:

• A reference to the underlying SOC 2 report, by date range, report version and, ideally, the auditor’s name
• The bridge period, with explicit start and end dates
• A statement of no material changes covering the control environment described in the underlying report
• An exception list, if applicable: anything that did change, called out explicitly
• Signatures by an executive with authority over the control environment, dated on or after the bridge period’s end date

If a bridge letter you receive is missing the date, the underlying report reference, or the no-material-change statement, send it back. Those omissions are not pedantic; they are the parts your auditor reads.

What auditors will and will not accept

The standard most auditors apply in practice:

• Bridge period of three months or less from report end: usually accepted without comment
• Three to six months: accepted with scrutiny; expect questions about why a newer report is not available
• Six months or more: usually rejected; the auditor will ask for a current report or supplemental testing
• Letter signed before the bridge period ended: invalid; the signatory cannot attest to a period that had not happened yet
• Letter that lists material changes without explanation: sends the auditor straight to those changes, often expanding scope rather than closing it

Your auditor’s tolerance depends on your industry and their risk posture. If you are in a regulated sector where control assurance is itself the point, expect the tighter end of the range.

The exception list nobody reads carefully

Most bridge letters include a stock phrase like “no material changes occurred” or “no exceptions noted.” That is the easy case.

Read carefully when there are exceptions. A well-written bridge letter says something like:

During the bridge period, the following changes were made to the control environment: (a) the firewall vendor was migrated from X to Y on November 12; (b) the VP of Information Security position was filled on November 30. Neither change is considered material to the controls described in the underlying report.

That is a useful disclosure. Your auditor sees it, accepts the materiality assessment, and moves on.

A poorly written one says:

No material changes occurred. (Some routine personnel and vendor changes occurred during the period and are not considered material.)

That parenthetical tells your auditor nothing and forces them to ask. Push back on bridge letters that wave at change without describing it.

How it actually goes for a hosted client

Here is the version with real people in it, because the abstract one hides where the work is.

Sigma Underwriting Managers is an insurance underwriter owned by Brown & Brown, a publicly traded company. Sigma’s production systems run on dedicated hardware we build and own, inside Flexential’s SOC 2 Type II data center in Fort Lauderdale. Sigma gets asked for evidence several times a year: by corporate IT, by insurers, by auditors.

The chain of evidence has two links, and a bridge letter only covers one of them:

1. The facility. Physical access, power, cooling, environmental controls. That is Flexential’s SOC 2 Type II report, and when the report period does not reach the audit date, it is Flexential’s bridge letter. We request it from the data center on Sigma’s behalf and pass it through, with the dates checked against the audit window before it goes anywhere.
2. The hardware and what runs on it. Backups, replication, patching, who can log in and when that list was last reviewed. That is not in anyone’s SOC 2 report; it is in the records of the systems we run. We pull those records, fill in that section of the packet, and sit down with Sigma’s office manager to confirm every answer before it is submitted.

The thing to take from that: a bridge letter closes the gap on the facility’s attestation. It says nothing about whether your backups ran last Tuesday. If your hosting provider hands you a data center’s bridge letter and calls the audit done, the second link is missing, and your auditor will find it. Ask who is answering for the hardware.

How to ask for one

Most providers will issue a bridge letter on request, but the request itself can be done well or badly. The good version, sent to the provider’s compliance contact:

Hi — for our [audit type] covering the period through [end date], we will need a SOC 2 bridge letter referencing your most recent Type II report (period ending [date]) and covering the bridge through [bridge end date]. Please confirm you can provide one and an expected delivery date.

That gets a complete response on the first reply. Vague requests (“can you send me a bridge letter?”) get vague responses, often without the key dates filled in.

If a provider needs more than a week to produce one, note it. A mature compliance program treats bridge letters as routine, not bespoke.

Common gotchas

Five things that quietly invalidate bridge letters:

1. The bridge period overlaps the underlying report period. The bridge starts the day after the report ends, not the same day.
2. The letter is dated mid-period. A signature dated November 1 cannot validly attest to anything through December 31.
3. The signatory is not named in the underlying report. Auditors check that the signing executive has actual authority over the control environment.
4. The letter references an auditor that no longer audits the provider. Provider switched CPA firms? You may need a fresh report, not a bridge.
5. No reference to the underlying report’s specific reporting period. Without that anchor, your auditor cannot tie the bridge to anything.

Putting it in your audit calendar

If you are running an annual audit and inheriting controls from a provider, plan for:

• Report renewal date: when the provider’s next Type II report is expected
• Last-known-good bridge letter date: when your most recent bridge expires (typically three months from issuance)
• Audit period close: when you actually need everything stitched together

Send the bridge-letter request 30 days before your evidence-collection cutoff. That gives the provider time to produce one and you time to read it.

For hosted clients, the audit paperwork is inside the monthly number, not an add-on: the data center’s SOC 2 report and bridge letter, proof of backups and replication, and the user-access list, filled in and confirmed with you before it goes back. How that works is on the managed hosting page. If an audit is coming and you are not sure who is answering for the hardware, book a thirty-minute review.