What Is a SOC 2 Bridge Letter? When You Need One
We field more questions about SOC 2 bridge letters than almost any other audit topic — typically from sales teams that need one yesterday to close a deal. Understanding what a bridge letter is and when you need one saves both time and stress.
Key Takeaways
- •For the next operating decision, compare SOC 2 system descriptions with SOC 2 management assertions.
- •The letter is signed by your audit firm (often the engagement partner) and may include a brief inquiry or management representation confirming these assertions.
- •Bridge letters are widely accepted in the market, though their authority comes from the auditor's professional reputation rather than from any formal AICPA standard.
If you have ever been mid-deal with an enterprise prospect and been told your SOC 2 report has expired or does not cover the current period, you have encountered the scenario where a bridge letter for SOC 2 becomes essential. It is not a replacement for a current SOC 2 report, but it can satisfy a customer's vendor security review until your next report is issued.
This guide explains exactly what a SOC 2 bridge letter is, the scenarios where you will need one, what the letter contains, how to obtain one from your auditor (including typical costs), AICPA guidance on their use, how a bridge letter differs from a Type II report, and alternatives for continuous coverage.
For the next operating decision, compare SOC 2 system descriptions with SOC 2 management assertions. Confirm the work included, the evidence you need, and who will own implementation before committing to a provider.
What Is a SOC 2 Bridge Letter?
The letter typically asserts that:
The letter is signed by your audit firm (often the engagement partner) and may include a brief inquiry or management representation confirming these assertions. It does not involve testing of controls — it is an assertion, not an audit.
Bridge letters are widely accepted in the market, though their authority comes from the auditor's professional reputation rather than from any formal AICPA standard.
When Do You Need a Bridge Letter?
Several common scenarios create the need for a SOC 2 bridge letter:
Customer Security Review During Report Gap
The three-month gap between your report period end date and the customer's review triggers a request for bridge coverage. For details on how SOC 2 report periods work, see our SOC 2 report explained guide.
Annual Renewal Timing Misalignment
If your audit cycle shifts (for example, your report used to cover January-December but now covers April-March), there may be a gap between the old period end and the new period start.
Mid-Deal Urgency
Enterprise deals often have security review gates that require current compliance documentation. When your next SOC 2 report is weeks away but the deal cannot wait, a bridge letter fills the gap.
Delayed Audit Completion
Sometimes audits take longer than expected — evidence collection issues, auditor scheduling, or remediation delays can push your report issuance date beyond the previous period end date.
What a Bridge Letter Contains?
A typical SOC 2 bridge letter includes the following elements:
How do you Obtain a Bridge Letter?
Obtaining a SOC 2 bridge letter is a straightforward process:
- Contact your audit firm — Reach out to your engagement partner or audit manager and request a bridge letter for the gap period
- Provide management assertions — Your firm will ask you to confirm in writing that no material changes to your control environment have occurred since the report period ended
- Review and sign — The auditor drafts the letter, you review the management assertions for accuracy, and the auditor issues the final signed letter
Cost
Bridge letters are a relatively modest expense compared to a full SOC 2 examination. The fee depends on your audit firm, the level of inquiry they perform, and whether you are an existing client. Many firms include bridge letter issuance as part of their annual engagement or charge a flat fee. Contact your auditor for their specific pricing.
Turnaround Time
If you know you will need a bridge letter, notify your auditor in advance — they may be able to prepare the template proactively.
AICPA Guidance on Bridge Letters
It is important to understand that bridge letters are not a formally defined AICPA product. The AICPA has not issued specific guidance endorsing or standardizing bridge letters. They exist as a market practice that has become widely accepted through industry convention.
The AICPA's position is nuanced: they do not prohibit auditors from issuing bridge letters, but they also note that such letters should not be mistaken for a SOC 2 examination and should clearly state their limitations. Some auditors and firms have their own policies about what they will and will not assert in a bridge letter.
Because bridge letters are not standardized, the format, content, and assertions can vary between audit firms. If a customer has specific requirements for what the bridge letter must contain, share those requirements with your auditor before they draft the letter.
Bridge Letter vs. Type II Report
A bridge letter is fundamentally different from a SOC 2 Type II report in several critical ways:
| Dimension | SOC 2 Bridge Letter | SOC 2 Type II Report |
|---|---|---|
| Scope | Gap-period assertion only | Full examination of controls over the reporting period |
| Testing | No control testing | Detailed testing of each control's operating effectiveness |
| Opinion | No auditor opinion | Formal auditor opinion on control effectiveness |
| Authority | Market convention | AICPA attestation standard (AT-C 205) |
| Duration | Depends on scope and readiness | Depends on scope and readiness |
| Cost | Modest flat fee | Significant investment |
| Acceptance | Widely accepted but not universal | Universally accepted |
A bridge letter is not a substitute for maintaining a current SOC 2 report. It is a temporary measure to address timing gaps. If your bridge letter periods are consistently long (6+ months), that signals a need to adjust your audit cycle.
Alternatives to Bridge Letters
If you want to minimize or eliminate the need for bridge letters, consider these approaches:
Overlapping Audit Periods
Schedule your new SOC 2 examination to begin before the previous report period ends, creating overlap rather than a gap. For example, if your current report covers January 1 through December 31, begin your next examination period on October 1 rather than January 1.
Continuous Compliance Monitoring
Implement continuous compliance monitoring through platforms that provide real-time evidence of control effectiveness. While this does not replace a SOC 2 report, it provides supplementary assurance to customers during gap periods.
Shorter Audit Cycles
Some organizations move from annual to semi-annual reporting to reduce the maximum possible gap period. This increases audit costs but can be worthwhile if your customer base demands near-continuous coverage.
Management Assertion Letters
If your auditor does not provide bridge letters, you can issue your own management assertion letter (without auditor co-signature) stating that no material changes have occurred. This carries less weight but may satisfy some vendor security reviews.
Need a bridge letter or help optimizing your SOC 2 audit cycle? Contact Agency to ensure your compliance coverage never lapses.
AICPA & CIMA’s SOC overview describes CPA assurance services. It defines the assurance context; it does not establish vendor rankings, market prices, or a particular company’s readiness.
Frequently Asked Questions
What is a SOC 2 bridge letter?
When do you need a SOC 2 bridge letter?
How much does a SOC 2 bridge letter cost?
Is a bridge letter the same as a SOC 2 Type II report?
Tyler Carbone
Managing Director and Cofounder
Tyler Carbone is a Managing Director and Cofounder of Agency and one of the industry's leading voices on governance, risk, and compliance. He holds degrees from Harvard and a JD/MBA from the University of Virginia, and previously worked in cybersecurity at Deloitte. Tyler has helped hundreds of companies operate SOC 2, ISO 27001, HIPAA, and GDPR programs.
LinkedIn
