A SOC bridge letter is an update from a provider’s management about the time after its last SOC report period. It can help you review that gap. It does not extend the auditor’s testing or turn those extra months into audited coverage.
Start with the dates
Suppose a vendor’s SOC 2 report covers January 1 through December 31. You are reviewing it the following April. A bridge letter through March 31 may help explain what happened during January through March. It does not tell you what happened in April.
Check the period printed in the report, not just the date it was downloaded or signed. Then compare it with the dates in the letter.
What should you check?
- The service: Does the letter refer to the same service and SOC report you are reviewing?
- The statement: What does management actually say about changes or problems since that period ended?
- The gap: Are there dates you still need information about?
- The next report: When will it be available? Set a reminder to obtain it.
When is the letter not enough?
Do not treat “nothing material has changed” as a fresh audit opinion. If you know of a major system change or control problem, ask how it affects the service you use. Request supporting information rather than filing the letter and moving on.
For a financial statement audit, let your auditor decide what additional evidence is needed. A vendor review and an audit are not the same job.
A real provider example
Microsoft publishes Azure bridge letters separately from its SOC reports. Its documentation explains the dates each quarterly letter covers. That is a useful reminder: get the actual letter and check its period. Do not assume the latest document covers today.
Sources and next steps
Grant Thornton explains who issues bridge letters and their limits. Microsoft documents its Azure report and bridge-letter schedule.
Continue with our vendor review guidance to check the report itself.