SOC 2 bridge letters, report validity and the annual cycle explained

Why a SOC 2 report has no expiry date, yet still ages

A SOC 2 report is an attestation, not a certificate, so nothing on it says when it lapses. It states the time the opinion covers: a Type 2 reports on how controls operated over a period, typically six to twelve months, and a Type 1 on their design as at one date. Anything after that boundary is unexamined.

Security and procurement teams generally accept a report for roughly a year from its issue date, and most service organisations renew annually. The date worth watching is the last day of the period, because every month since then sits outside the opinion: a report issued in March for a period ending in December already carries two or three unexamined months.

The bridge letter: what it says, who signs it, where it stops

A bridge letter, also called a gap letter, is issued and signed by your management. It covers the time from the end of your latest report's period to the letter's date, stating that, to management's knowledge, the system and controls have not changed materially and nothing has emerged that would alter the auditor's conclusions. The CPA firm is not involved and gives no assurance on it.

Without independent assurance, the letter carries weight only briefly, customarily for no more than about three months after the period end. Customers differ, so ask key accounts what they accept. It supplements a report; it never replaces one.

What we recommend a bridge letter states

• The report it follows: service, type, categories, period and issuing CPA firm.
• The bridge period, from the day after the period end to the letter's date.
• Any material change, control failure or security incident in that interval, described rather than omitted.
• The current examination period and when the next report is expected.
• The name and role of the officer who signs.

Consecutive periods: keeping coverage unbroken

Continuous coverage has one rule: each examination period begins the day after the previous one ended. Two pieces of work therefore overlap: early in a new period the CPA firm is still testing the one just closed, while your teams keep producing this period's evidence. That report is issued some weeks to a few months after the period end and goes to customers with a bridge letter.

A late start is the costly mistake: weeks between two periods belong to no report, and a reviewer comparing successive reports will see the hole. The same applies after a Type 1; begin the Type 2 period straight after the Type 1 date.

Choose the period end deliberately. A first Type 2 period is often shorter than a year, agreed with the CPA firm; mature programmes settle on twelve months. If major customers review vendors at the same point each year, time the period end so a fresh report reaches them then.

When to move to Type 2, and when to add categories

A Type 1 is a sensible first report when a customer deadline falls before a Type 2 period could end. Plan its successor rather than renewing it: a Type 1 shows design on one day, and only a Type 2 shows controls operating over time, as our Type 1 vs Type 2 guide explains.

Security is examined in every SOC 2 report; the other categories join when your commitments call for them:

• Availability when contracts promise uptime or recovery times;
• Processing integrity when customers rely on complete, accurate processing, as in payroll or payments;
• Confidentiality when contracts designate information as confidential;
• Privacy when you commit to how personal information is collected, used, retained, disclosed and disposed of.

Add a category at the start of a period, its controls already producing evidence, and agree it with the CPA firm first; one added part-way through has no history for the earlier months.

Changes that trigger re-scoping

The report describes a system with boundaries: the services it delivers and the infrastructure, software, people, procedures and data behind them. When those move, revisit the scope with the CPA firm before fieldwork finds the change. Typical triggers:

• a new product or service customers will rely on;
• an acquisition, bringing new entities, systems, people and policies;
• a cloud migration or new hosting provider, which changes the infrastructure and usually adds a subservice organisation, presented by the carve-out or inclusive method;
• new locations or offshore teams operating controls;
• new commitments that bring another category into scope.

A change inside a period is handled in that period. The system description in a Type 2 report must explain significant changes during the period, and where a control changed the CPA firm may test both versions. Tell the firm when the change is planned.

How customers read your report

Read your report as a customer's reviewer will:

• The opinion. An unqualified (unmodified) opinion means that, in all material respects, the description is fairly presented and the controls were suitably designed and, in a Type 2, operated effectively throughout the period. A qualified opinion identifies the matters where it does not, and those become the reviewer's first questions.
• Scope and dates. Does it cover the service they use, the categories their contract needs and a recent period?
• Exceptions. A Type 2 lists every deviation found in testing; a report with an unqualified opinion can still list several, and the reviewer judges whether they matter.
• Complementary user entity controls. The controls your system's design assumes each customer operates, such as managing their own users' access. A careful customer checks them against what it actually does.
• Subservice organisations. Where a provider is carved out, the description lists the controls expected of it; expect questions on how you oversee it, usually answered by your review of its SOC report.

A twelve-month SOC 2 calendar

Illustrative, for a January to December period; shift the months to match yours.

SOC 2 bridge letters and the annual cycle: questions buyers ask