Definition
A bridge letter, also called a gap letter, is a letter from the service organization's management to its users that covers the period between the end of the latest SOC report and a date near the user's year end. It states whether management is aware of material changes to controls or control failures in the gap period.
Why it matters in an audit or review
If the SOC report period ends before the client's year end, the user auditor needs evidence that controls continued to operate. A bridge letter helps, but it is management's representation, not a service auditor's opinion, so it gives limited assurance. AU-C 402 allows the auditor to obtain additional evidence such as asking the service organization about changes or testing the client's own controls in the gap period.
Example
The provider's Type 2 report covers October 1 to September 30. The client's year end is December 31, so three months are not covered. The auditor obtains a bridge letter for October to December, finds it says nothing changed, and also checks the client's reconciliations of provider output for those three months.
Common mistakes
Treating a bridge letter as the equivalent of a Type 2 report for the gap period.
Sources
- AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
- AICPA, AT-C Section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting
- AICPA, SOC 1 Guide, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' ICFR
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error