The three documents do different jobs. The system description says what your system is. The management assertion says the description is fair and the controls meet the criteria. The representation letter is a private letter to the auditor confirming what management has told them. The first two appear in the report.
Side by side
| Document | Who writes it | Job | Dated |
|---|---|---|---|
| System description | Management | Describes services, boundary, components, controls, subservice organizations and user responsibilities | Covers the audit period or point in time |
| Management assertion | Management, as the responsible party | States the description is fair and the controls meet the criteria; the auditor opines on it | Covers the same period or date |
| Representation letter | Management, addressed to the auditor | Confirms representations: responsibility for the assertion, disclosure of known deficiencies, fraud and subsequent events | As of the date of the auditor's report |
The dating detail comes from an explainer on the AICPA attestation standard AT-C section 205.
The description is the thing being asserted
The description is the longest part of the report and the place where scope is stated. The assertion exists to say that description is fairly presented. If the description changes, the assertion changes with it. That is one reason the description is drafted first.
The assertion travels with the report
Readers of your report, such as customers, will see the assertion and the auditor's opinion. The standard expects the assertion to be bound with or accompany the auditor's report. For more on what it says, see what a SOC 2 management assertion is.
The representation letter stays between you and the auditor
The letter is not part of what customers read. According to the same explainer, it asks management to acknowledge responsibility for the subject matter and the assertion, to confirm disclosure of deficiencies it knows about, and to confirm it has disclosed any known actual, suspected or alleged fraud and any subsequent events that matter. Because it is dated as of the report date, it is usually signed near the end.
The AICPA publishes an illustrative version for auditors. Your auditor will send you their own, so do not try to write one from scratch.
Common mix-ups
- Treating the letter as the assertion. Both are signed by management, but the letter is not in the report.
- Signing the assertion before the description is final. Any later edit to the description can make the signed statement wrong.
- Forgetting subsequent events. Something that happens between the period end and the report date, such as a major incident, belongs in the conversation with your auditor.
A signing order that avoids rework
- Finalise the system description with engineering and the control owners.
- Walk through open exceptions and decide how they are described.
- Sign the assertion for the period.
- Sign the representation letter on or near the report date, after confirming nothing material has changed.
Quick check
Can one document serve as both assertion and letter?
The standard notes the two can overlap in some engagements, but a SOC 2 normally needs the assertion bound with the report so readers see it. Follow your auditor's process.
Who keeps the representation letter?
The auditor keeps it with the engagement file. Keep your own signed copy with your audit records.
Safeguard's compliance and evidence automation can keep the control evidence behind all three documents in one place. It does not write or sign them for you.
Sources
Last reviewed: 19 October 2026.
