A SOC bridge letter is a management communication that may address the period between the end of a SOC report and a customer’s review date. It can describe whether management is aware of material changes, but it is not a new SOC report and is not independently attested to by the service auditor.
Key Takeaways
- A bridge letter is a management representation, not an auditor’s opinion.
- The letter should identify the applicable SOC report and the exact gap period.
- Management should clearly disclose relevant system, control, or organizational changes.
- A bridge letter does not extend the SOC report or replace a current examination.
Why Might a Customer Request a SOC Bridge Letter?
A customer may receive a SOC report whose examination period ends before the customer’s fiscal year-end, audit date, or vendor-review date. The customer and its auditors may want information about the intervening period while waiting for the service organization’s next SOC report.
For example, a SOC 2 report might cover controls through September 30, while a customer needs assurance information through December 31. Management may provide a bridge letter addressing the three-month gap. Whether that letter provides sufficient information is ultimately a decision for the customer and its advisers.
Who Prepares a SOC Bridge Letter?
The service organization’s management prepares and signs the bridge letter. The CPA firm that performed the SOC examination does not issue an opinion on the bridge period through management’s letter.
A bridge letter should not state or imply that the service auditor performed additional testing after the end of the original examination period. It is a management communication rather than an independent assurance report.
What Information Should a SOC Bridge Letter Include?
A bridge letter commonly identifies the applicable SOC report, defines the period covered by the letter, and states whether management is aware of material changes to the system or related controls.
Depending on the circumstances, the letter may also address:
- Changes to systems, applications, infrastructure, or service delivery
- Significant changes to control activities or responsible personnel
- Acquisitions, reorganizations, or major operational changes
- Security or availability incidents that could affect report users
- Previously reported exceptions and related remediation
- The expected timing of the next SOC examination
The representations should be specific to the organization and the period being addressed. Management should avoid broad assurances that cannot be supported by available records.
What Are the Limits of a SOC Bridge Letter?
A SOC bridge letter does not extend the original examination period, update the service auditor’s opinion, or independently demonstrate that every control continued to operate effectively during the gap.
A bridge letter may also be insufficient when the gap is unusually long or the service organization experienced major system changes, acquisitions, security incidents, control failures, or other significant developments. In those situations, customers or their auditors may request additional documentation or a more current SOC report.
SOC Report and Bridge Letter Comparison
| Document | Prepared By | What It Provides |
|---|---|---|
| SOC report | Independent CPA firm, with information provided by service organization management | Independent assurance covering the scope and date or period defined in the report |
| SOC bridge letter | Service organization management | Management’s representations about changes or developments during an intervening period |
| Customer follow-up | Customer, user auditor, or other report reviewer | Additional questions or procedures based on the customer’s risks and assurance requirements |
What Should Management Review Before Issuing the Letter?
Before signing a bridge letter, management should confirm that its representations are consistent with current records and the system described in the underlying SOC report. Relevant personnel may need to review changes involving information technology, security, human resources, operations, vendors, and control ownership.
Management should also confirm the exact beginning and ending dates of the gap period. If a material development occurred, the letter should describe it accurately instead of relying on a general statement that no changes occurred.
Helpful Resources
- MeredithCPAs SOC Audit Services
- AICPA SOC Suite Overview
- SOC 1 Type 1 or Type 2 Guide
- SOC 2 Type 1 or Type 2 Guide
Frequently Asked Questions
Does the service auditor sign a SOC bridge letter?
No. A bridge letter is generally prepared and signed by the service organization’s management. It is not attested to by the service auditor.
Does a bridge letter extend the SOC report period?
No. The SOC report and the service auditor’s opinion remain limited to the date or examination period stated in that report.
How long can a bridge letter cover?
There is no standard gap period that every customer or auditor must accept. The recipient evaluates whether the length of the gap and the information provided are sufficient for its purposes.
Should material changes be disclosed?
Yes. Significant changes during the intervening period may affect a customer’s evaluation and should be described accurately.
Is a bridge letter required after every SOC report?
No. A bridge letter is generally considered when a timing gap matters to a report user and the customer requests or agrees to accept the letter.
Take the Next Step
A bridge letter should be accurate, appropriately limited, and consistent with the underlying SOC report. Set a meeting with MeredithCPAs to discuss SOC report timing, customer requests, readiness considerations, and preparation for your next SOC examination.
About MeredithCPAs
At MeredithCPAs, we provide accounting and auditing, tax, and consulting services for businesses, organizations, individuals, and families. Our experienced team serves clients in Texas and across multiple states. Long-standing client relationships and low employee turnover help us deliver consistent service and practical guidance based on each client’s circumstances.