A SOC bridge letter is an update from a provider’s management about the time after its last SOC report period. It can help you review that gap. It does not extend the auditor’s testing or turn those extra months into audited coverage.
Start with the dates
Suppose a vendor’s SOC 2 report covers January 1 through December 31. You are reviewing it the following April. A bridge letter through March 31 may help explain what happened during January through March. It does not tell you what happened in April.
Check the period printed in the report, not just the date it was downloaded or signed. Then compare it with the dates in the letter.
What should you check?
- The service: Does the letter refer to the same service and SOC report you are reviewing?
- The statement: What does management actually say about changes or problems since that period ended?
- The gap: Are there dates you still need information about?
- The next report: When will it be available? Set a reminder to obtain it.
When is the letter not enough?
Do not treat “nothing material has changed” as a fresh audit opinion. If you know of a major system change or control problem, ask how it affects the service you use. Request supporting information rather than filing the letter and moving on.
For a financial statement audit, let your auditor decide what additional evidence is needed. A vendor review and an audit are not the same job.
If your company is issuing the letter
Management owns the statement. The auditor does not issue a fresh opinion through the letter. Before approving it:
- Confirm the service and report it refers to.
- Ask the relevant owners about changes since the report period ended.
- Check known incidents and control problems before making a no-change statement.
- Set an accurate end date and have an authorized management representative approve it.
Do not copy last quarter’s letter and change the date without checking the facts. Keep the supporting review with the approved version.
What if something changed?
A hosting migration or a new way of granting privileged access may change what customers need to know. Explain the relevant change and its effect rather than hiding it behind generic wording.
Do not use a standard no-significant-change letter when that statement is untrue. Discuss what additional evidence or reporting is appropriate with the customer and auditor.
If you are receiving the letter
Keep a short note of the dates still uncovered and any questions left open. Identify who will follow up and when the next report is expected. Receiving the document is not the same as resolving the gap.
A real provider example
Microsoft publishes Azure bridge letters separately from its SOC reports. Its documentation explains the dates each quarterly letter covers. That is a useful reminder: get the actual letter and check its period. Do not assume the latest document covers today.
Sources and next steps
Grant Thornton explains who issues bridge letters and their limits. Microsoft documents its Azure report and bridge-letter schedule.
Continue with our vendor review guidance to check the report itself.