A buyer's procurement team is reviewing your SOC 2 report. Its period ended five months ago. They ask for a bridge letter. Your team has never written one, and someone asks whether the auditor needs to be involved.
A bridge letter is short and easy to produce. It is also a signed representation by your management, which is worth taking seriously. This article covers what it is, what it says, who signs it, when buyers ask for one, and how to schedule your audits so you need them less.
What a bridge letter is
A SOC 2 Type II report covers a defined period that has already ended. Between the end of that period and the date a buyer reads the report, nothing has been examined. A bridge letter, sometimes called a gap letter, covers that interval.
It is a letter from your management, not from your auditor. It refers to your most recent report, states the period it covered, and says whether anything significant has changed since. It carries no auditor assurance, and it is not part of the report.
That last point matters for how you write it and how a buyer reads it. A bridge letter is your word. It is useful because buyers know you will be held to it, and because the next report will show whether it was accurate.
What a bridge letter says
There is no AICPA-mandated form, so contents vary. A conventional letter covers these points:
The report it bridges. Your organization, the system, the report type, the period covered, and the audit firm that issued it.
The bridge period. The day after the report period ended, through the date of the letter or a stated date.
Changes to the system. A statement that there have been no significant changes to the system or its controls since the period ended, or a description of the changes that occurred.
Known deficiencies. A statement that management is not aware of deficiencies in controls, or of incidents that would significantly affect the conclusions in the report, or a description of any it knows about.
The next report. When the current examination period ends and when you expect the report.
A signature. An officer with authority to make the representation, commonly the chief executive, chief technology officer, or the executive who owns security, with name, title, and date.
What counts as significant
You need a working definition before you are asked, so the answer is not improvised under deal pressure. Examples worth disclosing include a migration to a new cloud provider or region, replacement of your identity provider, a reorganization that changes who operates key controls, an acquisition that brought new systems into the service, and an incident that would meet the threshold for disclosure in your system description. Routine releases, new hires, and ordinary vendor changes usually do not qualify.
Writing the SOC 2 system description covers the incident threshold, which is a sensible test for the letter too.
When buyers ask for one
Buyers ask for bridge letters when the timing of your report does not match the timing of their review. The common triggers:
Procurement mid-cycle. A new customer evaluates you several months after your report period ended.
Annual vendor reviews. An existing customer's reassessment falls between your reports.
Their own audits. A customer's auditor wants coverage for their period, and your report period does not line up with it. This is common with SOC 1 reports used for financial audits, and it happens with SOC 2 reports used for customers' own compliance work.
A carve-out in their report. If you are a subservice organization for a customer, they need to show they monitor you, and a bridge letter fills the gap in their monitoring evidence.
Buyers set their own limits on how long a gap they will accept with a bridge letter. There is no standard figure. Expect more questions as the gap grows, and expect some buyers to decline a letter covering a long gap and wait for your next report.
How to handle the request well
Prepare a template before anyone asks. The work is in agreeing the wording once, internally, with whoever will sign. After that, each letter is a matter of updating dates and confirming nothing has changed.
A practical process:
Draft a standard letter with the six elements above, and agree the wording of the change and deficiency statements with your signer.
Define the check behind it. Before each letter, the owner confirms with engineering and security leads that no significant changes or incidents have occurred, and records that check.
Keep a log of letters issued: date, recipient, period covered, and any disclosures made. If your situation changes, you know who received a letter that is now out of date.
Distribute it with the report. If you share reports through a Trust Center, publish the current bridge letter beside the report, behind the same access controls. What to put on a Trust Center and gating documents behind an NDA cover that setup.
Some teams ask whether the audit firm will sign or review the letter. It is management's representation, and audit firms do not generally attest to it. If you want your auditor's view on the wording, ask, but do not present the letter as carrying their assurance.
Reading one as a buyer
If you are on the receiving end, a bridge letter deserves a minute of attention rather than a glance:
Check it refers to the report you hold, with the same system and period.
Check the bridge period starts the day after the report period ended, with no gap of its own.
Read any disclosures. A described change or incident is not a reason to reject the vendor. It is a reason to ask what the next report will say about it.
Check the signer has the authority to make the statement.
File it with your vendor review, and note when the next report is due so you can request it.
Reducing how often you need one
You cannot remove the gap entirely. A report is always issued after its period ends, and the auditor needs time to complete fieldwork and write it. You can keep the gap short and predictable:
Run consecutive periods. When each Type II period starts the day after the last one ended, your coverage has no holes. The only gap is between the latest period end and the report date.
Agree report delivery dates with your auditor at the start of each engagement, and keep evidence current so fieldwork is not delayed waiting for you.
Choose a period end that suits your buyers. If many reviews cluster at one point in the year, ending your period shortly before it means buyers read a recent report.
A Type I report is a separate case. It reports on design at a single date, so a bridge letter covering months after a Type I tells a buyer less. Most buyers in that situation want to know when your first Type II period ends.
The glossary entry for bridge letters and the SOC 2 framework page have the related terms.
How TrustLynce helps
TrustLynce's Trust Center publishes your report and current bridge letter behind gated access, with an access log showing who viewed each one. Continuous monitoring checks controls between audits and routes failures to their owners, which gives your signer a record to check before confirming nothing significant has changed.