SOC 1 Reports in the User Audit: Coverage Gaps, Bridge Letters and Carve-Out vs Inclusive Subservice Organizations

When a client outsources payroll, claims processing, hosting or custody, the controls that matter for the client's financial statements sit at a third party. A SOC 1 report from that provider's auditor is the usual evidence. The report only helps if it covers the right period, the right services and the right controls. This post covers how a user auditor tests those fits. The overview of report types is in reviewing SOC reports and complementary user entity controls, the types are compared in SOC 1 vs SOC 2 vs SOC 3, and the standard is summarized in service organizations and SOC 1 reports.

The two questions

1. Does the report give the user auditor enough information about the services and controls that affect the client's financial statements?
2. Does it give enough evidence, over the right period, that the controls operated, to support the planned reduction in substantive work?

A Type 1 report describes the design of controls at a point in time and supports the understanding of the service. Only a Type 2 report, which adds testing of operating effectiveness over a period, can serve as evidence that controls operated.

Step 1: Match the services to the report

Check that the report describes the services the client uses, at the locations used. A report on payroll processing does not cover benefits administration. Compare the system description with the client's contract and processes. Note the control objectives in the report and map them to the client's assertions: for payroll, accuracy of gross-to-net, authorization of changes, completeness of tax deposits.

Step 2: Check the service auditor

Evaluate the service auditor's competence and independence and the standards under which the report was issued. An unfamiliar report needs more scrutiny.

Step 3: Read the opinion, the exceptions and the user controls

• Look for qualifications in the opinion: scope limitations, controls not suitably designed, tests that failed.
• Read each exception in the tests-of-controls section. Determine whether the exception affects the controls relevant to the client.
• Read the complementary user entity controls section. These are controls the provider assumes the client operates, such as reviewing exception reports or authorizing changes. Determine which are relevant to the client, whether the client has designed and implemented them, and test their operating effectiveness if the audit relies on them. A report cannot support reliance if the client fails its own part.

Also ask management whether the provider has reported, or the client knows of, any fraud, noncompliance or uncorrected misstatements affecting the client's statements.

Step 4: Test the period fit

The Type 2 report covers a period, often twelve months. The client's year covers another. The user auditor evaluates whether the period is appropriate for the audit's purposes, the adequacy of the period covered by the tests and the time elapsed since they were performed.

Step 5: Bridge the gap

If the report ends before the client's year end, say September 30 for a December 31 year end, the auditor needs evidence about the remaining period. The relevant factors are the controls tested and the results, how much evidence the report gives for the period it covers, the length of the remaining period, the possibility of significant changes in the controls since, the significance of the risk and the extent to which the auditor will reduce substantive procedures. The GAO Financial Audit Manual applies the same factors to roll-forward testing and adds that inquiry alone is not enough: if management says controls did not change, the auditor obtains evidence supporting that assertion. Evidence can come from extending tests of controls over the remaining period or testing the client's process to monitor the provider.

A bridge letter (also called a gap letter) is a statement from the service organization's management, covering the period from the end of the report to a later date, whether the system and controls described in the report have materially changed and whether management knows of control failures in the gap. The service auditor does not perform procedures on it or give assurance on the gap. It is a common practice, not a standard requirement, and practice usually limits it to about three months of gap; a longer gap points to a new report. A bridge letter is management's assertion, so its weight is limited. Use it as one piece of evidence alongside other procedures:

• Compare the bridge letter to the client's own experience with the provider during the gap: incidents, error rates, reconciliation differences, complaints.
• Test the client's own controls during the gap, such as reconciliations of the provider's reports to the ledger.
• Match the work to the length of the gap and the risk. A short gap over a low-risk process may be covered by a bridge letter and the client's reconciliations. A long gap over a high-risk process needs more.

Step 6: Subservice organizations

The provider may use its own provider, for example a payroll processor that runs on a third-party data center. The service auditor's report can handle this in two ways.

• Inclusive method: the report includes the subservice organization's relevant control objectives and controls in the description and in the scope of the service auditor's work. The user auditor reads one report.
• Carve-out method: the report excludes the subservice organization's controls. If the subservice organization's services are relevant to the audit, the user auditor applies the service organization requirements to the subservice organization too: obtain its report, test the client's or provider's monitoring of it, or perform other procedures.

If the carved-out services matter and the auditor cannot obtain sufficient appropriate evidence about them, the opinion is affected.

Step 7: If there is no usable report

Test controls directly at the provider, use another auditor, or rely on substantive procedures such as recomputing the provider's output and confirming balances with third parties. Many contracts allow audit access if requested early.

Worked example

A client pays 600 employees through a payroll processor. The processor's Type 2 SOC 1 report covers October 1 to September 30. The client's year ends December 31. The report carves out the processor's data center, hosted by a third party.

• Fit: Control objectives cover gross-to-net calculation, change authorization and tax deposits. They match the client's payroll assertions.
• Exceptions: one exception in 25 tests of change authorization; management's response says it was an isolated case. The auditor decides it does not change reliance but notes it for the client's own review of change reports.
• Complementary user controls: the client must review the payroll register before release. The auditor tests the client's review for 10 pay periods and finds it operated.
• Gap: October 1 to December 31, which is 92 days, about three months and the outer edge of what a bridge letter normally covers. The processor provided a bridge letter stating no significant changes. The auditor also reconciled the processor's year-end summaries to the ledger, obtained the processor's incident log through the contract's information rights, and tested the client's monitoring.
• Subservice: the data center is carved out. The auditor considers the hosting risk (availability and data integrity) against the client's compensating reconciliations and obtains the processor's evidence of monitoring of its hosting provider.

Conclusion: reliance on processor controls for payroll accuracy is supported, subject to the client's own controls and the gap procedures. If the client has no formal review of the processor's report, that goes to management in the AU-C 265 letter.

Documentation

The services and their significance to the client, the report type and period, the evaluation of the service auditor, exceptions, complementary user entity controls and tests, the gap procedures including the bridge letter, subservice treatment and the conclusion.

CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.

Sources

• AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization; AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
• Attestation firm guidance on SOC 1 bridge letters (management-issued, no service auditor assurance, about three months): ispartnersllc.com and a-lign.com
• Schneider Downs, how subservice organizations are presented in SOC reports: schneiderdowns.com
• AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
• U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, sections 360 and 495 C (control testing and roll-forward period evidence): gao.gov

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error