Priya Nandakumar had eleven days to save a $2.3 million renewal.
She was VP of Compliance at Cascade Ledger, a mid-market SaaS platform that reconciled payment flows for regional insurance carriers, and the deal in question — a three-year renewal with Thornfield Insurance Group — was sitting in her inbox with a single-line email from Thornfield's vendor risk team: "Your SOC 2 Type II report period ended March 31. It's now June 2. We can't renew without evidence of continuous coverage." Cascade Ledger's next Type II examination wouldn't be signed by its audit firm until early August. That left a 62-day hole between what Thornfield had on file and what Thornfield's own risk committee required to keep the contract active.
Priya had two bad options in front of her: ask the customer to wait ten weeks with no paperwork, or panic-email the audit firm asking them to "just confirm nothing's changed." Neither was right. What she actually needed — and what her audit partner delivered within 48 hours — was a bridge letter: a short, management-signed statement covering the gap between the end of the audited period and the date Thornfield needed assurance. It wasn't a new audit. It wasn't even something her CPA firm could sign. But it was exactly the document a properly run vendor risk process expects to see in that gap, and it kept the deal alive.
This article is about that document — what it is, who can write it, what it's legally allowed to say, and why a wrong assumption about any of those three things can cost a renewal, a vendor relationship, or an auditor's independence.
Who This Is For / What You'll Walk Away With
This is for compliance leads, fractional CISOs, and vendor risk analysts who've been handed a bridge letter request (or a bridge letter itself) and need to know whether what's in front of them is legitimate. You'll leave understanding exactly who is authorized to sign a bridge letter and why it isn't your auditor, what content belongs in one and what would overstate its authority, the informal but consistently enforced ~90-day ceiling on how much gap it can cover, and how to draft — or evaluate — one without creating a false impression of continuous audited assurance where none exists.
What Is a Bridge Letter (Gap Letter)?
A bridge letter — sometimes called a gap letter, and occasionally a "no material change letter" in the field — is a short written statement issued by a service organization's own management, addressed to its customers or their auditors, asserting that no material changes to the organization's control environment have occurred between the end date of its most recent SOC 2 report and the date of the letter. It exists to solve a purely calendar-driven problem: SOC 2 reports are dated. A Type II report covers a fixed window — commonly three, six, nine, or twelve months — and the report itself only speaks to that window. The day after the window closes, the report technically stops describing "now." Customers, however, don't stop needing assurance the day a report period ends, and the next audit rarely closes and gets issued the very next day. A bridge letter fills that interval with a management-level statement rather than leaving customers with nothing.
It's worth being precise about what kind of document this is, because the industry is sloppy with the term. A bridge letter is not an attestation. It is not signed by the CPA firm. It carries no opinion, no testing, no sampling, and no audit evidence behind it beyond management's own representation. It is, functionally, closer to a cover letter than a report — one or two pages, usually on the service organization's own letterhead, signed by an executive (often the CISO, VP of Compliance, or CFO) rather than the audit firm's engagement partner. That distinction — management-authored, not auditor-authored — is the single most important fact in this entire topic, and it's the one most frequently misunderstood by both service organizations issuing letters and customers receiving them.
"I've had prospects tell me their auditor 'signed off' on a bridge letter. That's never true, and if you ever see a CPA firm's signature block on one, stop and ask why — because it means either the terminology got mangled somewhere in the deal, or someone is trying to dress up a management letter as an audit opinion. Those are very different documents with very different legal weight." — Marcus Feldman, CPA, Partner, Feldman Ridge Assurance Partners
Table 1: Bridge Letter — Core Facts at a Glance
Attribute | Detail |
|---|---|
Issued by | Service organization's own management (CISO, VP Compliance, CFO, or similar) |
Signed by | An accountable executive at the service organization — never the CPA firm |
Legal nature | A management representation letter, not an attestation or audit opinion |
Typical length | 1–2 pages |
Covers | The gap between the prior report's period-end date and the letter's issue date |
Typical maximum gap | Roughly 90 days (three months) before customers/auditors expect a new report instead |
Contains audit testing? | No — no sampling, no evidence review, no CPA procedures performed |
Provides assurance? | No formal assurance; it is a representation, not an opinion |
Common triggers | Contract renewal, new customer onboarding, annual vendor review, RFP deadline |
Typical requester | Customer's vendor risk / procurement / security team |
Why the Gap Exists in the First Place
The gap isn't a flaw in the SOC 2 process — it's a structural byproduct of how Type II examinations work. A Type II report tests operating effectiveness over a defined audit period (what we cover in depth in SOC 2 observation period: understanding the review timeframe), and that period has to close before the auditor can begin testing evidence, drafting the system description, and forming an opinion. Fieldwork, evidence walkthroughs, sampling, management review, and quality control on the auditor's side routinely add six to twelve weeks after the period closes before a report is finalized and delivered. A twelve-month Type II audit period that ends December 31 might not produce a signed report until late February or March. During that drafting window — and again in the months following report delivery, before the next audit period even begins — the organization has no "current" report to hand a customer.
Well-run compliance programs plan for this deliberately rather than treating it as a surprise. Some organizations run back-to-back, slightly overlapping audit periods specifically so there's minimal white space between one report's coverage and the next one's start. Others accept the gap as normal and simply have a bridge letter template ready to issue on request, because the alternative — leaving customers with an expired report and no communication — is worse for the relationship than a short, honest gap letter.
"The gap itself isn't the problem. Customers understand that audits take time to close out. What erodes trust is a vendor who goes quiet about it instead of sending something short and factual the moment the old report ages out." — Elena Vasquez, Director of Vendor Risk, Thornfield Insurance Group
Who Writes and Signs a Bridge Letter — Management, Not the Auditor
This deserves its own section because it is the point most often gotten wrong, and getting it wrong has real consequences. A bridge letter is drafted and signed by the service organization's own management — typically whoever owns the SOC 2 program day to day, countersigned by a senior executive with authority to make representations on behalf of the company (CISO, VP of Compliance, CFO, sometimes the CEO for smaller companies). It is not drafted by the CPA firm, and the CPA firm's name, logo, or signature should never appear on it as though the firm is attesting to its contents.
This isn't a technicality — it's rooted in professional standards. Under SSAE 18 and the AICPA's attestation framework, a CPA firm's involvement in an engagement carries specific independence and quality-control obligations. Issuing any kind of assurance statement about a period that wasn't actually tested — no evidence gathered, no controls sampled, no walkthroughs performed — would mean putting the firm's name behind a claim it cannot support. Reputable audit firms will not do this, full stop, and any firm willing to co-sign or informally "bless" a bridge letter's content should be treated as a red flag on independence grounds. What a good audit firm will sometimes do is review a client's draft bridge letter informally and advise on language — confirming, for instance, that the letter doesn't overstate what it's allowed to say — without adding its own name to the document.
Table 2: Who's Responsible — Bridge Letter RACI
Party | Role in the Bridge Letter Process |
|---|---|
Service organization management (CISO/VP Compliance) | Responsible — drafts, gathers internal confirmation that no material control changes occurred, signs |
Service organization executive sponsor (CFO/CEO) | Accountable — countersigns or authorizes issuance on behalf of the company |
CPA/audit firm | Consulted (informally, optional) — may advise on wording; never signs or attests |
Internal audit / control owners | Consulted — confirm no material changes within their control domains during the gap |
Legal/GC | Consulted — reviews representations for accuracy and liability exposure |
Customer's vendor risk team | Informed — receives and evaluates the letter as one input among several |
Subservice organizations (if relevant) | Informed — may be asked to confirm their own status if the gap touches shared infrastructure |
If your own compliance program doesn't yet have this accountability mapped out in writing, our SOC 2 Control Matrix / RACI Template lays out the same responsibility pattern — who owns evidence, who signs off, who gets informed — in a reusable format you can adapt.
How Audit Firms Actually Handle Bridge Letter Requests
Clients frequently assume their CPA firm is being unhelpful or overly cautious when it declines to draft or sign a bridge letter, so it's worth explaining what's actually happening on the audit firm's side of that conversation. Most reputable firms build language directly into their engagement letters clarifying that bridge letters, if the client chooses to issue one, are the client's sole responsibility and representation — not a deliverable the firm produces as part of the engagement. Some firms go further and proactively supply clients with a bridge letter template during onboarding, precisely so the client isn't scrambling to invent the format under deadline pressure, while still making clear the firm's name doesn't appear anywhere on the finished document.
Where audit firms do add value is in the review, not the authorship. A good engagement partner will often read a draft bridge letter before it goes out — not to bless it, but to flag language that oversteps (certification-style phrasing, implied auditor involvement, vague or open-ended gap dates) and to confirm the letter accurately references the underlying report's period and opinion type. Firms with mature SOC 2 practices also track, informally, how many bridge letters a given client has issued since the last report, and will raise it directly with the client if that count starts climbing — both because it reflects on the client's own risk management and because a chain of bridge letters sitting behind an aging report can complicate the next engagement's planning and pricing.
"We'll absolutely proofread a client's bridge letter language before it goes out the door — that's just good client service. What we won't do, ever, is let a client imply we reviewed the gap period itself. Those are two very different kinds of help, and clients sometimes need that distinction spelled out more than once." — Marcus Feldman, CPA, Partner, Feldman Ridge Assurance Partners
Table 16: What Audit Firms Will and Won't Do Around Bridge Letters
Audit Firm Activity | Will Do | Won't Do |
|---|---|---|
Provide a bridge letter template during onboarding | Yes, common practice at mature firms | N/A |
Informally review a client's draft bridge letter for language | Yes | N/A |
Sign, co-sign, or endorse a bridge letter | No | Firm name never appears on the document |
Track a client's cumulative bridge letter usage | Yes, informally, often raised at renewal planning | N/A |
Perform any testing or evidence review covering the bridge letter's gap period | No | This would require a new engagement, not a letter |
Advise a client to accelerate the next audit if bridge letters are stacking up | Yes | N/A |
What a Bridge Letter Can and Cannot Say
Because a bridge letter carries no testing behind it, its content has to stay within tight, honest boundaries. What it can say: that management represents no material changes have occurred to the described system or control environment since the report's period-end date; that the controls described in the most recent report remain in place and, to management's knowledge, continue to operate as described; the specific date range the letter covers; and a plain acknowledgment that the letter is not an audit, attestation, or extension of the underlying report.
What it cannot say — and what should raise an immediate flag if you see it — is anything implying the auditor has reviewed, tested, or endorsed the gap period; any claim of "continued compliance" phrased as though it were a certification; any suggestion that the letter extends the audited period itself (it doesn't — the report's period-end date doesn't move); and any specific new control claims not already covered in the underlying report. A bridge letter restates and reaffirms; it does not expand.
"The bridge letters that get rejected by our risk committee are almost always the ones written in certification language — 'we hereby certify continued SOC 2 compliance.' That phrasing tells me the writer doesn't understand what the document is. A well-written one says something much more modest: no material changes, plain English, dated." — Elena Vasquez, Director of Vendor Risk, Thornfield Insurance Group
Table 3: What a Bridge Letter Can and Cannot Do
Can Do | Cannot Do |
|---|---|
State management's representation that no material control changes occurred in the gap | Provide auditor assurance or an opinion of any kind |
Reference the underlying SOC 2 report by name, period, and issuance date | Extend the audited period or the report's official coverage dates |
Cover a defined, bounded gap (commonly up to ~90 days) | Cover an open-ended or indefinite period |
Be signed by an accountable executive at the service organization | Be signed, co-signed, or implicitly endorsed by the CPA firm |
Be used as a supporting document in a vendor risk file | Substitute permanently for a new SOC 2 report |
Note known exceptions or changes if material ones did occur | Claim "no changes" if material changes actually occurred |
Reassure on continuity of the same system boundaries described in the report | Assert new Trust Services Criteria coverage not tested in the underlying report |
The Roughly Three-Month Rule
There is no line in SSAE 18 that says "a bridge letter may not exceed 90 days." The limit is practical and market-driven rather than codified — but it is remarkably consistent across the industry, and it shows up in nearly every mature vendor risk program's written policy. The logic is straightforward: a bridge letter's credibility rests entirely on the plausibility of "nothing material happened." That's a reasonable claim to make about a six-week gap. It becomes a much harder claim to stand behind about a six-month gap, where staff turnover, infrastructure changes, new vendors, incident response events, or policy revisions become statistically likely to have occurred — whether or not anyone remembered to mention them. Most audit firms will privately (and sometimes explicitly, in engagement letters) tell clients they're uncomfortable seeing bridge letters stretch past roughly ninety days, and most sophisticated customer risk teams have the same ceiling written into their own vendor policies, whether they call it 90 days, one quarter, or "three months."
Beyond that point, the expectation shifts: the service organization should either have completed its next audit, be able to show a firm, imminent completion date backed by real audit progress, or accept that the customer may require interim compensating evidence (a SOC 2 readiness update, a penetration test, a security questionnaire refresh) rather than relying on a stale-feeling gap letter.
Table 4: Timing and Gap Rules
Gap Since Report Period End | Typical Market Response |
|---|---|
0–30 days | Bridge letter alone is routinely accepted with minimal pushback |
31–60 days | Bridge letter accepted; some risk teams ask for a status update on next audit's timeline |
61–90 days | Bridge letter accepted by most, but often paired with proof the next audit is in progress (engagement letter, fieldwork start date) |
91–120 days | Increasingly scrutinized; many risk teams require supplemental evidence or escalate to their own risk committee |
120+ days | Most mature vendor risk programs will not accept a bridge letter alone; a completed report or documented remediation plan is expected |
Repeated back-to-back letters covering 6+ months cumulatively | Treated as a red flag regardless of individual letter length — see "chaining" below |
The Bridge Letter Timeline, Visualized
flowchart LR
A["Type II Audit Period\ne.g., Jan 1 - Dec 31"] --> B["Period End Date\nDec 31"]
B --> C["Auditor Fieldwork &\nReport Drafting\n(6-12 weeks typical)"]
C --> D["SOC 2 Report Issued\ne.g., Feb 15"]
D --> E{"Customer needs\nassurance after\nthe report ages?"}
E -->|"Gap under ~90 days"| F["Bridge Letter Issued\nby Management\n(covers Dec 31 - request date)"]
E -->|"Gap exceeds ~90 days"| G["New Report Expected\nor Supplemental Evidence"]
F --> H["Next Audit Period Begins"]
G --> H
H --> I["Next SOC 2 Report Issued"]
I -.->|"Cycle repeats"| BHow Customers Use Bridge Letters in Vendor Risk Reviews
For customers, a bridge letter is one input in a broader vendor risk management file — never the whole file. Mature risk teams treat it the way they'd treat any management representation: useful, worth having, but weighted less heavily than independently tested evidence. In practice, a bridge letter usually gets filed alongside the most recent full SOC 2 report, any relevant readiness assessment or remediation status if one is in progress, and — depending on the vendor's criticality tier — supplemental artifacts like a recent penetration test summary, a security questionnaire response, or evidence of cyber insurance coverage.
What good risk teams check for specifically: that the letter is dated and signed by a named individual with actual authority (not an unsigned template with no accountable name attached); that it clearly states the gap it covers and ties back to the prior report by name and date; that it uses appropriately modest language rather than certification-style claims; and that the cumulative gap being bridged, added to any prior bridge letters already on file for the same vendor, doesn't quietly exceed the customer's own policy ceiling. Some procurement teams also cross-check the letter's signer against the org chart or LinkedIn to confirm the signatory is a real, current employee with plausible authority — a small step, but one that catches a surprising number of stale or recycled letters.
Table 5: Vendor Risk Review — Bridge Letter Checklist
Checklist Item | Why It Matters |
|---|---|
Letter is dated and signed by a named, accountable individual | Unsigned or generic letters carry no accountability |
Signer's title/authority is plausible for making the representation | A junior analyst signing isn't equivalent to a CISO or CFO signing |
Letter references the specific prior report (period, issuer, opinion type) | Confirms it's tied to a real, verifiable audit, not a generic template |
Gap covered is clearly dated (start/end) | Open-ended letters should be treated with suspicion |
Cumulative gap (this letter + prior letters) stays under policy ceiling | Prevents "chaining" from quietly extending coverage past what's credible |
Language avoids certification/attestation claims | Overstated language signals a misunderstanding of the document's authority |
Status of the next audit is referenced or obtainable on request | Confirms a real report is actually coming, not indefinitely deferred |
Letter is on company letterhead, not a generic or third-party template | Basic authenticity check |
Bridge Letter vs. the Full SOC 2 Report vs. SOC 3
It helps to place the bridge letter next to its neighboring documents, because customers sometimes conflate all three. The full SOC 2 report — covered in detail in SOC 2 report structure: understanding the auditor's report — is the CPA firm's actual attestation: an auditor's opinion, management assertion, system description, and (for Type II) tested control results, typically restricted to named recipients under NDA. A SOC 3 report is the freely distributable, general-use public summary of a SOC 2 — no detailed test results, just a seal-level conclusion, and it's still auditor-issued. A bridge letter sits in a different category entirely: no CPA involvement, no opinion, no testing, and it's only ever a stopgap between two actual reports.
Table 6: Document Comparison
Attribute | SOC 2 Report (Type I or II) | SOC 3 Report | Bridge Letter |
|---|---|---|---|
Issued by | CPA firm | CPA firm | Service organization management |
Contains an opinion? | Yes | Yes (summary form) | No |
Testing/evidence behind it? | Yes | Yes (underlying SOC 2) | No |
Distribution | Restricted-use | Freely distributable | Typically shared directly with requesting customer |
Covers a fixed audit period | Yes | Yes (summarizes underlying SOC 2) | No — covers the gap after a period ends |
Can stand alone as assurance | Yes | Yes, at a summary level | No — only meaningful alongside the underlying report |
Typical length | 20–80+ pages | 2–4 pages | 1–2 pages |
If you're new to reading these documents side by side, our SOC 2 Report Reader's Guide eBook walks through every section of a full report, field by field, so the difference between a tested opinion and a management representation stops being an abstraction.
Anatomy of a Bridge Letter: Template Outline
A well-constructed bridge letter is short by design, but it isn't casual. The strongest ones I've reviewed across client engagements follow a consistent structure: a clear identification of the service organization and the system in scope; a reference to the underlying SOC 2 report by report type, period covered, and issuance date; an explicit statement of the gap period the letter itself covers; a plain-language representation that no material changes to the described system or controls have occurred during that gap (or, if something did change, a factual note of what changed and its materiality); a statement clarifying that the letter is not an audit, attestation, or extension of the underlying report; the name, title, and signature of an accountable executive; and the date of issuance.
Table 7: Bridge Letter Template — Section by Section
Section | Purpose | Typical Length |
|---|---|---|
Addressee/heading | Identifies recipient (customer name or "to whom it may concern") and date | 1–2 lines |
Reference to underlying report | Names report type, TSC categories covered, audit period, and issuance date | 2–3 sentences |
Statement of gap period | Explicitly states the start and end date the letter covers | 1 sentence |
Representation of no material change | Core statement — management affirms controls remain as described | 1 short paragraph |
Disclosure of any known changes (if applicable) | Notes any material changes and their nature/impact, if they occurred | 1 paragraph or "none to disclose" |
Limitation/disclaimer statement | Clarifies this is not an audit, attestation, or period extension | 2–3 sentences |
Signature block | Name, title, signature, date, contact for follow-up | Formal block |
A Sample Bridge Letter, Condensed
Seeing the template outline as an actual letter makes the structure concrete. A real bridge letter would appear on company letterhead, but the language pattern below reflects what a legally careful, appropriately modest bridge letter actually reads like in practice:
To whom it may concern:
Cascade Ledger, Inc. ("the Company") engaged Feldman Ridge Assurance Partners to perform a SOC 2 Type II examination covering the Security and Availability Trust Services Criteria for the period January 1, 2026 through March 31, 2026. The resulting report was issued April 22, 2026, and contained an unqualified opinion.
This letter covers the period from April 1, 2026 through the date of this letter, June 4, 2026. Management represents that, to the best of its knowledge, no material changes have occurred to the system, control environment, or Trust Services Criteria commitments described in the referenced report during this period, with the following exception: the Company updated its quarterly access-review cadence to a bi-monthly cadence effective May 15, 2026, a change that strengthens rather than weakens the control it affects.
This letter is a representation of Company management and has not been reviewed, tested, or attested to by Feldman Ridge Assurance Partners or any other independent auditor. It is not an extension of the referenced SOC 2 report and does not constitute an attestation, audit opinion, or certification of any kind. Questions regarding this letter or the Company's control environment may be directed to the undersigned.
Signed, [Name], Chief Information Security Officer, Cascade Ledger, Inc. — Date: June 4, 2026
Notice what this sample deliberately does: it names the exact report, states an exact gap window, discloses the one real change rather than hiding it, and repeats the limitation language plainly rather than burying it in a footnote. Every one of those choices is defensible if the letter is ever scrutinized later.
Step by Step: How to Draft One
When Priya's team put together Cascade Ledger's bridge letter for Thornfield, the process took under two days because the groundwork was already in place. Step one: confirm the actual gap — the exact period-end date of the last report and today's date, because the letter's credibility depends on precision here. Step two: run an internal check across control owners (IT, HR, engineering, physical security) asking a version of one question — has anything material changed since the report period closed? New critical vendor, leadership change in a control-owning role, a security incident, a system architecture change, a major policy rewrite. Step three: draft the letter using the template structure above, keeping language factual and modest. Step four: route it through legal or general counsel for a final review of the representations being made, since this is, legally, a signed statement the company stands behind. Step five: have the accountable executive sign, and step six: deliver it directly to the requesting customer along with a copy of the underlying report for context, rather than sending the letter in isolation.
"The internal check-in with control owners is the part teams skip when they're rushed, and it's the part that actually matters. A bridge letter is only honest if someone actually asked the question first." — Priya Nandakumar, VP of Compliance, Cascade Ledger
Common Mistakes When Issuing (or Accepting) Bridge Letters
The most common failure mode on the issuing side is treating the bridge letter as a formality — recycling last year's letter with a new date rather than actually confirming nothing changed. The most common failure on the receiving side is accepting a letter without checking who signed it or how long a gap it's actually covering, especially when it's the third or fourth letter in a row for the same vendor. Both failures share a root cause: nobody is asking what the document actually represents versus what it's often assumed to represent.
A less obvious but equally damaging mistake sits in between those two: treating the bridge letter conversation as adversarial rather than routine. Vendors who respond to a bridge letter request as though it's an accusation, and customers who treat every bridge letter as evidence of vendor negligence, both misread what the document is for. A bridge letter is a normal, expected part of a healthy vendor relationship's audit calendar rhythm — the vendors and customers who handle it best are the ones who've simply built it into their calendars as a routine touchpoint rather than a fire drill triggered by surprise.
Table 8: Common Mistakes and Fixes
Mistake | Why It's a Problem | Fix |
|---|---|---|
Reusing a prior bridge letter with only the date changed | Skips the actual internal control check; risks a false "no changes" claim | Run a fresh control-owner check every time, even if brief |
Letter uses certification-style language ("we certify continued compliance") | Overstates the document's authority; misleads readers about what was tested | Use modest, representation-style language throughout |
No named, accountable signer | Removes accountability; hard for customers to verify authenticity | Always have a senior, identifiable executive sign |
Customer accepts letter without checking cumulative gap across multiple letters | Chained letters can quietly cover 6–12 months with zero new testing | Track cumulative bridge letter coverage per vendor in the risk register |
Bridge letter issued to cover a gap where a material change did occur | Creates a materially false representation with real legal exposure | Disclose known material changes explicitly in the letter |
Treating the bridge letter as equivalent to the full report | Understates how much less scrutiny stands behind it | Always pair it with the underlying report for context |
Multi-Bridge-Letter Chains: Why Stacking Gap Letters Backfires
One pattern I flag every time I see it in a client's vendor file: a service organization that issues bridge letter after bridge letter, quarter after quarter, without ever actually closing a new audit. Each individual letter might look reasonable — 60 days, 75 days — but stacked end to end, they can add up to eight, ten, twelve months of "no material changes" resting entirely on management's word, with no independent testing anywhere in that stretch. This is the scenario mature vendor risk teams are specifically trained to catch, and it's the fastest way to have a vendor downgraded in a risk tiering system regardless of how good the underlying controls actually are.
Table 9: Chained Bridge Letters — Risk Escalation
Cumulative Gap Coverage | Typical Risk Team Response |
|---|---|
Single letter, under 90 days | Normal, low scrutiny |
Two consecutive letters, under 6 months combined | Acceptable but flagged for follow-up on next audit timeline |
Three+ consecutive letters, 6–9 months combined | Escalation to risk committee; supplemental evidence usually required |
Any chain exceeding 9–12 months combined | Vendor risk tier downgrade likely; contract remediation clauses may trigger |
Pattern repeats across multiple annual cycles | Treated as a structural compliance program failure, not a one-off gap |
Alternatives to a Bridge Letter
A bridge letter isn't the only tool available when a report ages out, and it isn't always the right one. Alternatives worth knowing: accelerating the next audit's completion date so the gap simply shrinks; providing a formal readiness assessment status update showing the next audit is actively underway with a committed completion date; offering supplemental point-in-time evidence such as a recent penetration test report, vulnerability scan summary, or updated security questionnaire; and, for especially risk-sensitive customers, granting temporary access to a live continuous monitoring dashboard (common with continuous compliance platforms) that shows real-time control status rather than a static, backward-looking letter.
Table 10: Alternatives to a Bridge Letter
Alternative | Best Used When | Limitation |
|---|---|---|
Accelerate next audit completion | Gap is manageable and audit firm has bandwidth | Costs more; not always feasible on short notice |
Readiness assessment status update | Next audit is underway but not yet complete | Still not independently tested; similar limitation to bridge letter |
Supplemental point-in-time evidence (pen test, scan results) | Customer wants technical assurance beyond a management statement | Narrower scope than a full SOC 2; doesn't cover all TSC areas |
Continuous monitoring dashboard access | Vendor already runs a continuous compliance program | Requires infrastructure investment; not all customers know how to interpret it |
Formal risk acceptance by the customer | Vendor is low-criticality or relationship is new/small | Shifts risk explicitly onto the customer's own risk register |
Sample Scenarios: When a Bridge Letter Is (and Isn't) the Right Call
Not every report-freshness question calls for the same response. It helps to walk through a handful of common scenarios side by side, because the right move — bridge letter, accelerated audit, supplemental evidence, or plain risk acceptance — depends heavily on how big the gap is and why it exists.
Table 15: Sample Scenarios and Recommended Responses
Scenario | Gap Size | Recommended Response |
|---|---|---|
Report aged out 3 weeks ago; next audit's fieldwork already scheduled | ~21 days | Standard bridge letter; low friction |
Customer's annual review lands 10 weeks after report period end, report itself delivered 6 weeks ago | ~10 weeks | Bridge letter, paired with next-audit timeline confirmation |
Vendor's audit has been delayed twice due to staffing issues; already 4 months past period end | ~4 months | Bridge letter alone likely insufficient; supplemental evidence or firm audit completion date required |
New prospect wants assurance before signing, current report is 8 weeks old | ~8 weeks | Bridge letter acceptable; also share full report and next-audit date |
Existing customer renewal, this would be the 4th consecutive bridge letter | Cumulative 9+ months | Escalate internally; treat as an audit-calendar failure, not a bridge-letter-eligible gap |
Subservice organization (inclusive method) reports a material infrastructure change mid-gap | Any length | Do not issue a standard "no material changes" letter; disclose the change explicitly or delay until clarified |
Low-criticality vendor, small contract value, report 5 months stale | 5 months | Customer may choose formal risk acceptance instead of requiring a bridge letter or new report |
Case Study 1: Cascade Ledger — The 62-Day Gap That Didn't Cost a Renewal
Back to Priya Nandakumar and the $2.3 million Thornfield renewal. Cascade Ledger's most recent Type II report covered January 1 through March 31, and the report itself was issued April 22 — a normal three-week drafting turnaround. Thornfield's vendor risk review landed on June 2, sixty-two days past the audit period's end date and forty-one days after the report was actually delivered. Cascade's next audit period wasn't scheduled to close until June 30, with a report expected in early August.
Priya's team didn't scramble to fabricate anything. They ran the internal control-owner check within 24 hours (no leadership changes, no new critical vendors, one minor policy update to the access-review cadence that they disclosed rather than omitted), drafted a two-page bridge letter using their standard template, routed it through general counsel same-day, and had it signed by the CISO within 48 hours of Thornfield's initial request. The letter explicitly referenced the March 31 report, stated the gap period (April 1–June 4), disclosed the minor policy change, and was delivered alongside a copy of the underlying report and a one-line note on the next audit's expected completion date. Thornfield's risk committee accepted it without escalation. The renewal closed on schedule. Total elapsed time from request to accepted letter: three business days.
The lesson Priya took from it, and the one she's since built into Cascade Ledger's compliance calendar: bridge letters work when they're boring. Nothing about this one was dramatic — it worked precisely because it was fast, factual, disclosed the one real change instead of hiding it, and never overstated what it was.
Table 11: Case Study Outcomes Summary
Case | Gap Covered | Outcome | Key Factor |
|---|---|---|---|
Cascade Ledger / Thornfield Insurance Group | 62 days (report period end to letter issuance, plus buffer to next audit) | Renewal closed on schedule; letter accepted without escalation | Fast turnaround, factual disclosure of a minor change, template readiness |
BrightPath Health Analytics / regional hospital network | 5 consecutive letters, ~11 months cumulative | Deal stalled; customer required a completed audit before proceeding | Chained letters exceeded customer's policy ceiling |
Vertex Cloud Systems / enterprise portfolio | Near-zero — overlapping audit periods | No bridge letters needed in 18 months | Structural fix: overlapping audit windows plus continuous monitoring |
Case Study 2: BrightPath Health Analytics — When a Bridge Letter Gets Rejected
Not every bridge letter lands the way Cascade Ledger's did. BrightPath Health Analytics, a healthtech vendor processing claims data for a regional hospital network, had fallen into a pattern familiar to anyone who's audited a fast-growing company that deprioritized its compliance calendar: its Type II audit periods kept slipping. A staffing change in its security team delayed evidence collection twice, and by the time its CISO, David Okonkwo, inherited the program, the company had issued five consecutive bridge letters over roughly eleven months, each individually under ninety days, but cumulatively covering nearly a full year with no new independent testing behind any of it.
When BrightPath's largest prospective customer's vendor risk team pulled the file, they didn't reject the fifth letter in isolation — they added up all five, saw an eleven-month unaudited gap sitting behind a report that was, by then, almost two years stale relative to the current state of the business, and declined to proceed until BrightPath produced a completed, current Type II report. The deal — worth an estimated $1.8 million in annual recurring revenue — was paused for four months while BrightPath rushed a new audit to completion.
"We didn't lose the deal outright, but we lost four months and a lot of credibility we had to rebuild. The board asked me directly why we'd let five bridge letters stack up instead of just fixing the audit calendar the first time it slipped. There wasn't a good answer — it had just quietly become normal." — David Okonkwo, CISO, BrightPath Health Analytics
BrightPath's postmortem produced a policy change worth stealing: no more than one bridge letter per audit cycle, full stop, enforced as a hard internal rule rather than a guideline. If the next audit isn't going to close before a second letter would be needed, that's treated as an audit-calendar failure requiring executive escalation, not a bridge-letter problem to paper over.
Case Study 3: Vertex Cloud Systems — Engineering the Gap Away
Vertex Cloud Systems, a workflow-automation platform serving mid-market financial services firms, took a structurally different approach after a near-miss with a Fortune 500 prospect two years earlier. Rather than getting better at writing bridge letters, Vertex's compliance lead, Sarah Lindqvist, redesigned the audit calendar itself so that gaps rarely occurred in the first place. Vertex moved to overlapping six-month Type II audit periods — a new period starts roughly six weeks before the prior one ends — so that by the time one report is delivered, the next audit period is already well underway, and the "white space" between a report aging out and the next one landing shrank from an average of nine weeks to under two.
Vertex paired that calendar redesign with a continuous control-monitoring platform that gives key customers direct, read-only visibility into control status indicators (access review completion, patch cadence, backup verification) between formal audit periods — not a substitute for the SOC 2 report, but a supplementary layer that makes any bridge letter Vertex does still need to issue far more credible, because the underlying claim of "no material changes" is now backed by live telemetry rather than a quarterly memory check.
"We haven't eliminated bridge letters completely — sometimes a customer's renewal date just lands in an awkward week no matter how you schedule things. But we went from needing four or five a year to needing maybe one, and the one we do send is backed by dashboards our customers can look at themselves, not just our word." — Sarah Lindqvist, Compliance Automation Lead, Vertex Cloud Systems
In the eighteen months following the redesign, Vertex tracked zero rejected bridge letters, zero deals stalled on report-freshness grounds, and a measurable drop in the average vendor risk review cycle time from customers who'd previously flagged its audit calendar as a concern.
Requesting a Bridge Letter as a Customer
If you sit on the vendor risk side of this relationship, requesting a bridge letter is usually simple, but a few habits separate a smooth ask from a slow one. State the specific gap you need covered — the date your last accepted report ages out and the date you need coverage through — rather than a vague "can you send something." Ask for it to be signed by a named, accountable individual, not routed to a generic compliance inbox with no signatory. Request it alongside a copy (or confirmation) of the underlying report if you don't already have the current one on file, since the letter alone means little without that context. And build the request into your renewal calendar early — sixty days before a report ages out, not the week a contract is due to renew — so the vendor has time to run its own internal check rather than rubber-stamping a template under deadline pressure.
"The requests that go smoothly are the ones where procurement tells us exactly what gap they need covered and by when, sixty days out. The ones that turn into fire drills are the ones that land four days before a renewal deadline with no specifics." — Tom Reyes, Procurement Director, National Freight Alliance
When a vendor pushes back on a specific, reasonable bridge letter request — or goes silent for more than a few business days — that's itself useful risk signal, worth escalating internally rather than quietly extending a deadline. A vendor with a mature compliance program can usually turn around a properly scoped bridge letter request within three to five business days, roughly matching what Cascade Ledger delivered for Thornfield. A vendor that takes three weeks to produce a one-page letter, or that keeps asking what a bridge letter even is, is telling you something about how seriously it treats its own compliance calendar — information worth folding into the broader vendor risk score, independent of whatever the letter itself eventually says.
Table 12: Bridge Letter Request Process (Customer Side)
Step | Action | Timing |
|---|---|---|
1. Identify the gap | Confirm the last accepted report's period-end date and the date coverage is needed through | 60–90 days before renewal/decision date |
2. Send a specific request | State the exact gap dates and required signatory seniority | As soon as the gap is identified |
3. Request underlying report context | Ask for the current SOC 2 report alongside the letter if not already on file | Same request |
4. Verify signatory and content | Check signer's name/title and that language avoids overstated claims | On receipt |
5. Log cumulative coverage | Record this letter against any prior bridge letters for the same vendor in the risk register | On receipt |
6. Escalate if ceiling exceeded | If cumulative gap exceeds internal policy (commonly ~90 days), require supplemental evidence or a firm audit completion date | If applicable |
Bridge Letters for Subservice Organizations
The bridge letter question gets a layer more complex when a subservice organization is involved — a vendor's vendor, in effect. If your service organization relies on a subservice organization (a cloud hosting provider, a payment processor, a data center operator) and that relationship is handled through the carve-out method, the subservice organization's own controls sit outside your SOC 2 report entirely, and its own bridge letter situation is technically separate from yours — though a sophisticated customer may still ask about it. If it's handled through the inclusive method, the subservice organization's controls are tested as part of your own report, which means a gap in your report period is, by extension, also a gap in coverage for whatever the subservice organization contributes — and your bridge letter should reflect that you've confirmed no material changes occurred on their side too, not just your own.
In practice, this means a service organization using the inclusive method needs its own lightweight internal process for checking in with critical subservice organizations before issuing a bridge letter — a quick confirmation email or a review of the subservice organization's own status update is usually enough, but skipping this step and asserting "no material changes" without actually checking is exactly the kind of gap that turns into a real problem if something did, in fact, change on the vendor's side.
Larger service organizations with several subservice organizations in scope sometimes formalize this into a standing quarterly check-in, independent of when a bridge letter is actually needed, so the answer is always ready rather than chased down under deadline pressure. Smaller companies with only one or two critical subservice relationships can usually handle it with a direct email to their primary vendor contact each time a bridge letter is being drafted — the goal isn't process for its own sake, it's making sure "no material changes" is a checked fact rather than an assumption.
Table 17: Subservice Organization Method vs. Bridge Letter Obligation
Method | Subservice Controls in Your Report? | Bridge Letter Obligation |
|---|---|---|
Carve-out method | No — excluded from scope | Your letter covers only your own controls; subservice status is a separate customer question |
Inclusive method | Yes — tested as part of your report | Your letter should reflect a check-in with the subservice organization, not just your own environment |
Bridge Letters During M&A, Leadership Transitions, and Rebranding
One gap scenario deserves special mention because it trips up otherwise well-run compliance programs: a bridge letter needed during a period when the service organization itself is changing in some structural way — an acquisition, a merger, a CISO or executive team transition, or a company rebrand. A material change to the organization signing the letter is, itself, exactly the kind of thing "no material changes" is supposed to flag, and skipping that nuance is a common and avoidable mistake.
If a company was acquired mid-gap, the acquiring entity's leadership needs to understand that a bridge letter still has to be signed by someone with legitimate, current authority over the audited system — not a departed executive, and not someone from the acquiring company who wasn't part of the original control environment being represented. If the acquisition itself changed anything material about the control environment (a shared identity provider, a merged IT infrastructure, a new executive team overseeing security), that has to be disclosed in the letter rather than glossed over, even if the underlying technical controls are unchanged. The same logic applies to a CISO departure mid-gap: the letter can still be issued, but whoever signs it needs to be someone who can credibly attest to the control-owner check described earlier in this article, which usually means looping in an interim or newly appointed control owner rather than leaving the signature line to whoever is available.
Table 18: Organizational Change Scenarios and Bridge Letter Handling
Scenario | Bridge Letter Implication |
|---|---|
Company acquired mid-gap, controls and systems unchanged | Bridge letter can proceed; new leadership should confirm signing authority before issuance |
Company acquired mid-gap, infrastructure or identity systems merged | Treat as a material change; disclose explicitly rather than issuing a standard "no changes" letter |
CISO or control-owner departure mid-gap | Route the control-owner check through an interim or successor owner before signing |
Company rebrand with no operational or control changes | Bridge letter can note the name change as administrative, not material |
Legal entity restructuring affecting the audited system's ownership | Consult legal before issuing; may require updated system description ahead of the next audit |
Contractual and Legal Considerations
Because a bridge letter is a signed representation from a named executive, it carries real weight even without the word "attestation" attached to it. If a company issues a bridge letter stating no material changes occurred and a material change (an undisclosed breach, a significant control failure, a leadership departure from a control-owning role) is later discovered to have occurred during that window, the letter itself becomes evidence in any resulting dispute — which is exactly why routing every bridge letter through legal or general counsel before signature isn't excessive caution, it's basic risk management. Many master service agreements and vendor contracts now include specific language addressing report freshness and bridge letters directly — some contracts specify the maximum gap a customer will accept without escalation, and increasingly, larger enterprise customers are writing an explicit bridge-letter cadence into contract renewal terms rather than leaving it to ad hoc requests each cycle.
This is especially common in regulated industries — financial services, healthcare, insurance — where the customer's own regulators expect evidence of ongoing third-party risk oversight, not just an annual check-the-box review. A bank's vendor risk team, for instance, may be contractually and regulatorily obligated to document continuous coverage for every critical vendor, which means a service organization serving that market should expect report-freshness language to show up in redlines even if it never comes up in less regulated verticals. Building a standard, pre-approved response to this kind of contract language — rather than negotiating it fresh with legal for every deal — saves real time once a company has more than a handful of enterprise contracts in its portfolio.
Table 13: Contract Language Considerations
Contract Element | What to Address |
|---|---|
Report freshness clause | Maximum acceptable gap between report period end and current date before escalation is triggered |
Bridge letter acceptance terms | Whether bridge letters are pre-approved as sufficient interim evidence, and up to what gap length |
Notification obligations | Vendor's duty to proactively notify of material changes, independent of any bridge letter |
Right to audit / supplemental evidence | Customer's right to request additional evidence if bridge letter chain grows long |
Termination/remediation triggers | What happens contractually if a new report is delayed beyond an agreed threshold |
International and Global Considerations
SOC 2 is a US-originated framework governed by SSAE 18 and the AICPA, but the customer base relying on bridge letters is often global — a US-based service organization with European, Asian, or Latin American enterprise customers, or a non-US company pursuing SOC 2 specifically because its US customers require it. The bridge letter mechanics themselves don't change across borders; there's no separate international standard governing gap letters, and a bridge letter issued by a service organization in Singapore or Ireland follows the same management-representation logic as one issued in the United States.
Where international context does matter is in customer expectations and language. European enterprise procurement teams, in particular, are often navigating their own regulatory frameworks — GDPR-adjacent vendor due diligence obligations, or sector-specific rules like DORA in EU financial services — that expect documented, continuous third-party oversight similar to what regulated US industries expect. A bridge letter that would satisfy a mid-market US customer's vendor risk team may get more scrutiny from an EU-based bank's third-party risk function, simply because that function is operating under a stricter regulatory mandate to document ongoing vendor assurance. Service organizations selling into heavily regulated international markets are often better served treating the ~90-day ceiling as a hard internal limit rather than a soft one, since the customers most likely to push back on a stretched bridge letter are often the ones with the least flexibility to accept it.
Building a Continuous Compliance Program to Reduce Reliance on Bridge Letters
The best long-term fix for bridge letter fatigue isn't a better letter template — it's a compliance program that needs the letter less often. This usually combines three things: an audit calendar engineered to minimize white space (overlapping or back-to-back audit periods, as Vertex did), continuous control monitoring tooling that tracks evidence in near-real time rather than only during formal audit windows, and a standing internal process (not a scramble) for confirming "no material changes" on a recurring cadence so a bridge letter, when one is genuinely needed, can be produced in days rather than weeks. None of this replaces the SOC 2 report itself — it just shrinks the gap the bridge letter has to cover, and makes the letter's core claim more credible when it is issued.
None of this requires enterprise budget to start. A small company can get most of the benefit from a shared calendar reminder that flags the audit-calendar owner ninety, sixty, and thirty days before a report ages out, paired with a lightweight quarterly email to control owners asking the same "anything material changed" question a formal bridge letter would eventually need answered. The continuous-monitoring platforms that larger, well-funded compliance teams adopt automate and formalize that same underlying habit — they don't replace it.
Bridge Letters in Multi-Framework Compliance Programs
Bridge letters are a SOC 2-specific mechanic, but the underlying problem — how do you maintain customer confidence between formal assurance events — isn't unique to SOC 2. Organizations that also hold ISO 27001 certification run into a structurally similar question, just solved differently: ISO 27001 uses annual surveillance audits and a three-year recertification cycle rather than a rolling audit-period-plus-bridge-letter model, so there's no direct ISO equivalent of a bridge letter. For companies pursuing both frameworks, it's worth understanding ISO 27001 vs SOC 2: which one do you need before assuming the assurance mechanics translate directly between them, and teams running ISO 27001 and SOC 2 together often find that ISO 27001's certification status is comparatively easier to communicate continuously (a certificate stays valid between surveillance audits) than SOC 2's more granular, date-bounded report periods. If your organization is mapping controls across both, the ISO 27001, SOC 2 and NIST CSF crosswalk is a useful reference for seeing where the two frameworks' assurance timelines actually diverge.
Table 14: Continuous Compliance Practices and Their Effect on Bridge Letter Reliance
Practice | Effect on Bridge Letter Need |
|---|---|
Overlapping/back-to-back audit periods | Shrinks the natural white space between reports |
Continuous control monitoring platform | Makes "no material changes" claims verifiable, not just asserted |
Quarterly internal control-owner check-ins (independent of audit cycle) | Speeds up bridge letter drafting from weeks to days when needed |
Pre-approved bridge letter template with legal sign-off | Removes drafting delay and inconsistency under deadline pressure |
Vendor/customer contract clauses on report freshness | Sets shared expectations before a gap becomes a crisis |
Single-owner accountability for the audit calendar | Prevents the "nobody noticed it slipped" pattern seen at BrightPath |
Bridge Letters as a Trust Signal, Not Just a Paperwork Fix
It's tempting to treat the bridge letter as a purely defensive document — something you produce when a customer pushes back on a stale report. The compliance leads who get the most value out of it treat it the other way around: as a small, proactive signal that the organization is paying attention to its own compliance calendar even in the weeks a formal report isn't sitting in front of a customer. A vendor that sends a clean, well-signed bridge letter without being chased for it is quietly telling a customer something a report alone can't — that someone owns this process year-round, not just during audit season.
That posture compounds. Customers remember which vendors make renewal reviews easy and which ones turn every report-freshness question into a scramble. In competitive procurement cycles, where two vendors have comparable Trust Services Criteria coverage on paper, the one with a boring, well-run bridge letter process — alongside solid fundamentals like a clear system description, well-documented complementary user entity controls, and a predictable audit calendar — is the one that clears vendor risk review faster and with fewer follow-up questions. Treated well, a bridge letter isn't a workaround for a compliance program's weak spot. It's a small, visible proof point that the program works even when nobody's actively testing it.
For teams building out their broader SOC 2 program, this is worth planning for from day one rather than retrofitting after the first awkward customer email. Understanding how your audit period is structured, how your SOC 2 report will be read by customers, and how your SOC 2 management assertion process holds up between formal audits all feed into how smoothly — or how painfully — the bridge letter conversation goes when it inevitably comes up.
If you're mapping out your own compliance calendar and want a second set of eyes on where your audit periods leave gaps, where your bridge letter process needs tightening, or how your vendor contracts should address report freshness, PentesterWorld's compliance advisory team works with service organizations at exactly this stage — reach out through our SOC 2 readiness assessment resources to start that conversation, or grab our SOC 2 Readiness Checklist to see where your own program stands before your next report ages out.