Bridge letters and gap periods between a SOC 1 report and year-end

• Measure the gap between the report period and the user entity period
• Explain what a bridge letter provides and its limits as evidence
• Design procedures for the gap period under AU-C 402 and AS 2201
• Decide when the gap is too long to rely on the report

The gap problem

Service organizations choose their own report periods, often a fiscal year that does not match the client's. A report for October 1 to September 30 leaves a three-month gap for a December 31 client. For an issuer, the gap matters most at the as-of date of management's ICFR assessment, because the auditor's opinion is on controls as of year-end.

AU-C 402 requires the user auditor to evaluate whether the type 2 report is for an appropriate period and to evaluate the adequacy of the time period covered by tests and the time elapsed since the tests were performed. AS 2201.B24 says that when a significant period of time has elapsed between the period covered by the tests in the service auditor's report and the date of management's assessment, additional procedures should be performed.

What AS 2201.B24 tells you to do

The auditor should inquire of management whether it has identified any changes in the service organization's controls after the report period. AS 2201.B24 lists examples of what management might have learned: changes communicated by the service organization, changes in personnel at the service organization with whom management interacts, changes in reports or other data received, changes in contracts or service level agreements, or errors identified in the service organization's processing. If management has identified changes, the auditor evaluates their effect on ICFR, and also evaluates whether the results of other procedures indicate changes at the service organization. AS 2201.B25 then requires the auditor to decide whether to obtain additional evidence about operating effectiveness at the service organization, with the need increasing as risk increases.

For nonissuer audits, the AU-C 402 application material (.A35 and .A36) lists factors for deciding what evidence to obtain about controls operating outside the report period: the significance of the assessed risks, the controls tested and significant changes since, the evidence already obtained, the length of the remaining period, how far you plan to reduce substantive procedures, and the effectiveness of the control environment and monitoring. It adds that the evidence can come from testing controls that operated during the remaining period or testing the user entity's monitoring process.

Bridge letters

Neither AU-C 402 nor AS 2601 uses the term. A bridge letter (also called a gap letter) is a letter from management of the service organization stating that it is not aware of material changes to the system or controls described in the most recent report between the end of the report period and a stated date, and not aware of control failures in that window.

What it is:

• a written representation from service organization management;
• evidence about whether anything changed.

What it is not:

• an examination or opinion by a service auditor;
• evidence that controls operated effectively during the gap.

So a bridge letter supports your inquiry; it does not replace your judgment about whether more evidence is needed.

How to evaluate the gap

Consider:

1. Length of the gap. Some firms set thresholds in their methodology (for example, gaps of three months or less handled by inquiry and a bridge letter, longer gaps needing more). These are firm policy, not standards.
2. Risk of the controls. Higher-risk controls need more evidence in the gap.
3. Stability of the service. History of exceptions, recent system changes, or provider turnover increase risk.
4. User entity controls. Strong CUECs or other user controls during the gap (for example, monthly reconciliations of output) provide direct evidence.
5. Next report. If the next report will be issued before your report date and covers the gap, obtain it.

Additional procedures for the gap

• Test the user entity's controls over the service organization's output during the gap.
• Obtain and read the bridge letter, and compare its content with what the client knows (incidents, errors, contract changes).
• Perform substantive procedures over transactions processed in the gap.
• For long gaps, consider tests at the service organization or the next report.

Documentation

Record the report period, the client period or assessment date, the gap length, the bridge letter (date, signer, content), inquiries made, user entity controls tested in the gap, and your conclusion. A mismatch between what the bridge letter says and what your client knows is a red flag to resolve before relying on the report.

A six-month gap at Crestview Credit Union