SOC 2 Type II Bridge Letters: Navigating 90-Day Audit Gaps & Vendor Expirations

The SOC 2 Validity Myth: Why Reports Do Not Have an Expiration Date

Enterprise procurement and risk management teams routinely ask SaaS vendors: "When does your SOC 2 report expire?" This phrasing reveals a fundamental misunderstanding of the American Institute of Certified Public Accountants (AICPA) attestation standards.

A SOC 2 Type II report does not have an expiration date. It is a historical attestation issued by an independent CPA firm certifying that specific Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, or Privacy) were designed effectively and operated continuously over a past testing window—for example, January 1, 2025 through December 31, 2025.

However, enterprise risk standards (and auditors examining your own SOC 2 compliance) dictate that a report is only considered "fresh" for 12 months following the conclusion of the audit period. Once more than twelve months elapse since the audit end date, the vendor's security controls are legally unverified.

The 90-Day Bridge Letter Rule: What It Covers and What It Cannot Attest

Because third-party CPA firms require 60 to 90 days after the close of an audit period to complete fieldwork, review testing samples, and draft the final report, there is an unavoidable "blackout gap." If a vendor's audit period ends on December 31, their next report may not be published until late March or April.

To bridge this window, vendors issue a formal Bridge Letter (also called a Gap Letter or Management Assertion Letter). Under standard corporate governance:

• The 90-Day Cap: A bridge letter is universally recognized as valid for a maximum of 90 days (extended to 120 days in rare enterprise circumstances).
• Management Responsibility: The bridge letter is signed by the vendor's executive leadership (typically the CTO, CISO, or General Counsel)—not the CPA firm. It affirms that no material changes or security breaches have compromised the control environment since the audit window closed.
• No Substitution: A bridge letter cannot replace an actual audit. It is valid only when paired with the preceding full SOC 2 Type II report.

Vendor Risk Due Diligence: Handling a Provider Whose Audit Expired 6 Months Ago

A major compliance failure occurs when procurement departments accept a bridge letter dated six, seven, or nine months after the prior audit period ended. If a vendor's audit concluded in June 2025, a bridge letter issued in February 2026 is worthless: the vendor has operated for eight months without CPA oversight.

Key Elements Required in an Authoritative Management Assertion Letter

When reviewing a bridge letter provided by a critical subprocessor or cloud platform, your legal and security teams must verify four mandatory components:

1. Exact Reference to Preceding Report: Must cite the specific CPA firm, the exact title of the report, and the exact period covered.
2. Material Change Disclosures: Must explicitly state whether any structural changes occurred in technical architecture, key personnel, or hosting infrastructure.
3. Explicit Breach Affirmation: Must confirm that no security incidents or data breaches compromised customer data during the gap period.
4. Authorized Officer Signature: Must be signed by a corporate officer (VP of Security, CISO, or General Counsel) on official corporate letterhead.

Vendor Security Attestation Calendar Template

Organizations managing dozens of enterprise SaaS vendors cannot rely on manual spreadsheet checks to monitor audit observation periods. When an enterprise customer requests your vendor security review during contract negotiations, discovering that your primary database hosting provider's SOC 2 report lapsed six months ago can delay multimillion-dollar deals.

Connecting vendor contracts to automated 90-day and 30-day attestation tracking in RenewOS ensures that security teams proactively request updated SOC 2 reports and bridge letters the moment prior audit windows expire.