SOC 2 Bridge Letters and Gap Period Coverage

A SOC 2 bridge letter addresses the gap after an audit period ends with a management representation. A credible letter defines its scope, discloses changes, and rests on evidence, while a reliable audit cadence prevents it from becoming a substitute for a current report.

Why a gap in SOC 2 coverage exists and why it keeps coming up in deals

A procurement team flags a SOC 2 report as stale even though the vendor has only recently received it. The dates explain the apparent contradiction. A Type II report covers a fixed historical period, and audited coverage stops at that period’s end. The fieldwork, review of evidence, and writing of the report happen after the period ends. The report can therefore arrive weeks to a few months after the last day it covers.

For an audit covering January through December 2025, a report issued in March 2026 still ends its coverage in December 2025. The issue date does not move that boundary. A customer reviewing the vendor in the intervening months needs some account of what happened after the examined period. That request commonly arises during a new deal or renewal, when a vendor-risk platform requests “report plus bridge letter,” or when a fiscal year-end review falls outside the report’s dates.

What a bridge letter actually is — and what makes it different from the report it references

A bridge letter is a signed management representation stating that the controls described in the last SOC 2 report have continued to operate and that no material changes have occurred, except those disclosed. Authorship is the defining distinction. An independent CPA firm issues the report under AICPA attestation standards, while the service organization’s management issues the letter. The auditor does not sign, review, or take responsibility for that management representation. No CPA firm can extend assurance over a period it did not examine.

The AICPA prescribes no standard bridge letter format or template, so organizations use different structures. A letter cannot bridge a period before the organization’s first completed SOC 2 examination, serve as a SOC 2 certificate or badge, or replace a report where audited assurance is required. SAP Central Cloud Services, SAP Enterprise Cloud Services, and SAP SuccessFactors Human Capital Management each publish bridge letter packages that they update regularly and that cover set gap periods. These packages make the letter a routine compliance artifact rather than an exceptional response to a difficult buyer.

What a bridge letter must contain to be accepted

The team issuing the letter should make clear which report the management representation refers to. Include the CPA firm, the Type II designation, the opinion expressed, and the exact observation period. Then define the gap explicitly. Its start date is the day after the report period ends, and its end date is the letter’s issue date.

State whether the system description and controls have materially changed during that interval. If changes occurred, disclose them and explain how they were handled, including changes to people, processes, systems, subservice organizations, or controls. If none occurred, management should state that it is unaware of any material changes. The letter should also remind the recipient to maintain the complementary user entity controls identified in the original report, because the customer’s responsibilities do not disappear during the gap.

Include limitations language stating that the letter supplements the existing report, provides no independent audit testing, and does not extend the auditor’s opinion. Accountability must also be explicit in the document. An officer who genuinely owns the control environment, typically the CISO, CTO, CFO, or CEO, should sign it on company letterhead. The letter should include a contact address, the issue date, and the expected timing of the next SOC 2 report. Omitting these core elements can cause vendor risk teams and user auditors to return or reject the letter.

How long a bridge letter can credibly cover and what happens as the gap grows

Roughly three months is widely accepted as the usual span for a bridge letter, though the AICPA has not published that as a limit. Procurement and vendor risk teams in most industries usually accept gaps of that length. Acceptance becomes more conditional between three and six months. Buyers often ask follow-up questions or ask for evidence to back up the letter, including penetration test results or continuous monitoring output. The longer the unexamined interval, the more the decision depends on evidence beyond management’s statement.

Beyond six months, buyers frequently refuse a letter outright. A document covering most of a year can signal an audit cadence problem. That convention allows exceptions. The SAP packages described for April 1, 2026 to October 31, 2026 illustrate that providers may publish longer bridge periods, but publication alone does not establish acceptance under every buyer’s policy.

Some organizations refresh their letters quarterly. That refresh updates management’s representation, but it does not move the underlying report’s end date or shorten the cumulative unaudited gap. Scheduling is the structural remedy for that problem. Back-to-back Type II periods and timely report issuance reduce reliance on bridge letters, although the time needed to issue a final report still leaves a brief reporting lag.

What a bridge letter cannot guarantee and where the assurance gap is real

The signature creates real exposure for management. If something goes wrong during the gap and management failed to disclose it, the omission can increase legal liability. Management should be able to show access reviews, vulnerability scans, change records, and monitoring logs that back up its statement that controls kept working. Without that evidence, the representation becomes a liability.

The service auditor is not monitoring the gap and cannot confirm that the control environment remained materially unchanged. The letter contains no independent control testing, test procedures, or test results, and it does not reproduce the report’s system description. Its claims are bounded by management’s knowledge when signing. An organization’s track record also affects acceptance, particularly if it lacks a history of unqualified SOC 2 reports.

Auditor transitions can make those boundaries harder to interpret. An illustrative Auth0 (Okta) case in 2026 involved a Type II report listing Ernst & Young as the service auditor and a bridge letter issued by Schellman. At least one user entity questioned which document to rely on and whether a gap remained. That confusion shows why a document’s issuer and function must be distinguished from the period for which an auditor actually provided assurance.

How regulated-industry buyers and user auditors evaluate bridge letters differently from standard procurement

A letter from management alone may pass standard enterprise procurement but hold up a review in financial services, healthcare, or government-adjacent procurement. Those buyers often have stricter vendor risk policies. Their reviewers distinguish a management-signed bridge letter from a package that also includes an auditor’s comfort or engagement letter. Some require that additional document before approval. Its role is to confirm that an audit is scheduled.

Some regulated-industry buyers in fintech and healthtech reject bridge letters entirely and require an in-period report or alternative evidence. That evidence may include a recent penetration test, a continuous monitoring dashboard, or answers to a security questionnaire. The distinction changes what a vendor must supply.

User auditors likewise need to distinguish the period examined from the period addressed only by management. Treating both as audited coverage erases the very boundary the letter should explain. Yet the management statement is not without force. Enterprise customers frequently make bridge letters a policy or contractual requirement during due diligence, giving the representation contractual and reputational stakes even without independent testing.

How to use a bridge letter correctly so it closes deals rather than stalling them

For teams preparing a deal, the practical lesson is to package the latest SOC 2 report and a current bridge letter together in the data room at initiation. This removes a request-and-response cycle from the security review. The package should state the letter’s limits in plain terms. A recently dated representation gives the buyer a current management statement, provided its gap dates remain anchored to the underlying report. It should not imply that a new issue date has renewed audited coverage.

Material changes should be disclosed even if leaving them out would make the letter look cleaner. Omission is the higher-risk path for management. The team should have access reviews, monitoring logs, and change records it can retrieve to back up the management representation and answer tough follow-up questions. For regulated-industry buyers, proactively offering penetration test results and continuous monitoring output can prevent a review from stalling while the buyer requests them.

Continuous compliance tooling supports this work by maintaining real-time evidence feeds and automating control monitoring. ComplyJet positions automated continuous monitoring as a way to keep reports current and renewals on time. Such tooling can provide records behind management’s statement and support the work needed for timely audits. It does not confer audited assurance by itself. The structural fix remains an audit cadence in which the next Type II period opens immediately after the current one closes, with reporting managed so the bridge letter serves a short interval.

Where bridge letters fit as continuous monitoring becomes the baseline expectation

Bridge letters fill a gap left by reports that look backward, while buyers increasingly expect up-to-date evidence. Auditor expectations are shifting in the same direction. Point-in-time screenshots are being supplemented, and in some contexts replaced, by real-time evidence feeds, live dashboards, or query results. Continuous monitoring makes it easier to back up the management representation because the organization has records from more than a single day. Combined with back-to-back audit periods, it can shorten the unaudited interval rather than merely generate another document about it.

This shift does not make the annual audit obsolete. The SAP packages show that bridge letters are still a routine part of large-scale cloud assurance, and most enterprise procurement teams still accept them. How much trust buyers will place in an annual examination without current supporting evidence remains uncertain as scrutiny intensifies. For teams selling to security-conscious customers, the practical response is to maintain that evidence, make the assurance boundary explicit, and keep the next examination on schedule. The letter then serves its proper role as a bounded management statement between reports.