Soc 2 gap letter is a phrase that gets searched by two people: the one who wants a definition for a memo and the one who has to sign an attestation about it next quarter. This page is written for the second. For a regulated small business, soc 2 gap letter comes down to a record and a set of figures: the record is the obligations, the controls, the evidence, the incidents, the cases and the attestations, kept with an owner, a date and a status; the figures are the evidence load that record puts on its reviewers, the days an audit of it takes, the gaps an audit will find and what they cost, the incidents and cases it produces, and the training it requires. The sections below explain soc 2 gap letter in those terms, say what it is not, and show where the free sheets on this site work each figure from the program's own numbers with no account.
Why the search is soc 2 gap letter
The words in soc 2 gap letter are the words a regulated small business uses when the obligation has a name and the program does not yet have a number. The name is the regulator's, linked below; the number is the program's own, and it is the count of obligations, controls and evidence items behind regulatory compliance turned into reviewer hours on the obligations register sheet and into audit days on the audit scope sheet. A program that searches soc 2 gap letter and comes away with those two figures has done the first day of the work, and the paid plan on this site keeps what follows: the record, with owners, dates and the attestation that closes each period.
What soc 2 gap letter means in practice
For a regulated small business, it means being able to show, for each obligation, which control satisfies it, what evidence proves the control operated, who reviewed the evidence and who attested to the result. The record is the obligations, the controls, the evidence, the incidents, the cases and the attestations. The regulator's own material, linked below, says what the obligations are; this site publishes none of that and no legal advice. What it publishes is the arithmetic: the obligations register sheet turns the count of obligations, controls and evidence items into reviewer hours and the months to a full attestation.
What is a bridge letter for soc 2, and when a buyer asks for one
A gap letter and a bridge letter are the same document under two names. The report covers a stated period; a buyer reading it in the fourth month after that period ended wants something saying nothing material changed in between. The letter is written and signed by the service organization, not by the CPA firm, because the firm examined the period and has no opinion about the months after it. Buyers usually ask for one when the gap runs past a quarter, and the register is what makes it cheap to write: if every control has an owner, a date and a last review in it, the letter is a summary of rows that already exist.
The figures behind soc 2 gap letter
Evidence items and reviewer hours; audit samples, days and coverage; expected gaps, remediation hours and cost; incident hours; case backlog months; training seats outstanding. Each is a free sheet on this site and each computes from the program's own inputs. For regulatory compliance the sheet to start with is the obligations register sheet, which works the figure a regulated small business is examined on first. A program that knows those numbers has stopped estimating its own compliance.
What soc 2 gap letter is not
It is not a certificate, a piece of software or a consultant's memo, although all three are sold under the name. It is a record and the figures that follow from it, kept by the business that owes the obligations. The guide this page supports covers choosing among regulatory compliance consulting firms, the help a small business buys around that record. Attestvio Pro keeps the record at one flat price; the sheets are free with no account.
A soc 2 bridge letter example, and what the letter must say
Four things, and no more than four. The report it bridges, named by its period. The dates the letter covers, from the period end to the day it is signed. A statement that no change to the system or to the controls in scope would have changed the report's conclusions, or a plain description of any change that would. And a signature from someone at the organization who can stand behind that, with a date. What a letter must never do is opine on the controls' effectiveness in the gap period, because nobody examined them; a letter that does is a letter a buyer's own auditor will reject.
The soc bridge letter outside SOC 2, and a bridge letter for soc 1
The same mechanism runs across the SOC suite, which is why the soc bridge letter is written the same way whichever report it bridges. A bridge letter for soc 1 covers the gap after a report on controls over financial reporting, and its reader is usually a customer's external auditor working to a year end that does not line up with your period. That reader is stricter about what the letter claims than a procurement team is, so the change description matters more and the signatory is usually the finance owner rather than the security owner.
Questions people ask about soc 2 gap letter
What is soc 2 gap letter?
For a regulated small business: keeping the obligations, the controls, the evidence, the incidents, the cases and the attestations as a record with an owner, a date and a status, and being able to show for each obligation the control, the evidence and the attestation. The regulator's own material, linked below, defines the obligations; the free sheets on this site work the arithmetic.
Who is responsible for soc 2 gap letter in a small business?
The compliance officer, or the owner wearing that hat, who signs the attestation. The sheets on this site are written for that person and need no account.
Does Attestvio make a business compliant with regulatory compliance?
No. The business meets the obligations; Attestvio keeps the record and works the figures, and publishes no rule and no advice. Counsel and the regulator's own material say what the obligations are.
Is a soc2 bridge letter a different document?
No. The spelling with no space is the one most people type; the document, the signatory and the four things it has to say are identical. Keep one template and reuse it each period rather than writing a fresh letter per buyer.