SOC 2 Bridge Letter: What It Says and What It Cannot Do

A customer has your SOC 2 Type 2 report, but the period ended in June and it is now October. Their security team asks for a bridge letter. Linford and Company, a CPA firm, updated its SOC 2 explainer on 13 October 2026, and its separate guidance on bridge letters is clear on the basic point: management writes the letter, the auditor does not.

What's affected

Any company with a finished Type 2 report whose period has ended before the buyer's review date. The letter bridges the time between the end of your report period and the customer's own review date or year-end.

• Management signs it, on company letterhead. The CPA firm does not attest to the gap period, because no testing has happened since the period ended.
• According to Linford, the AICPA does not set bridge letter requirements, so the contents are a matter of practice.
• Most bridge letters cover no more than three months. A-LIGN says a letter "normally covers a period of three months" and suggests considering a new examination for longer gaps.

What to do now

1. Check the buyer's contract or questionnaire for the maximum report age they accept. It controls the answer.
2. Draft the letter with these parts, which both CPA firms list: the report period with exact dates, a statement of any material changes to the control environment (or that management knows of none), a reminder that the customer must still operate its complementary user entity controls, and a request to read the report. Add a line that the letter does not replace the report and may not be relied on by others.
3. Date the letter on the day you sign it. The statements are made as of that date.
4. Have someone who actually knows the environment confirm each statement before an officer signs. A false "no material changes" line is worse than no letter.
5. If the gap is longer than about three months, talk to your auditor about the next period instead of writing a longer letter.

A minimal outline:

[Company letterhead]
Date: [date of signing]
Re: SOC 2 Type 2 report for the period [start] to [end]

Management confirms the following as of the date of this letter:
1. The report named above covers the period shown.
2. There have been no material changes to the system or controls
   described in the report since [end], except: [list or "none"].
3. Management is not aware of any material deficiencies that would
   change the service auditor's opinion.
4. This letter does not replace the SOC 2 report, is not a report
   from the service auditor, and is for the named customer only.

Signed: [officer name and title]

How to avoid this trap

• Plan the next period before the current one ends. If the next window starts the day after the last one ends, the gap you have to explain stays short.
• Do not let a bridge letter turn into a standing document. Each one needs a fresh review of changes.

Quick check

Sources

• Linford and Company: Bridge (gap) letters in SOC reports
• A-LIGN: Everything you need to know about bridge letters
• Linford and Company: What Is SOC 2? (updated 13 October 2026)