SOC 1 (SSAE 18 / ISAE 3402) D.9: SOC 1 D.9 Bridge letters between report periods

Since the period of a type 2 report closes ahead of the user entities' year end, the service organisation issues a bridge (gap) letter, signed by its management and not by the auditor, stating whether the described controls and objectives remained in place and materially unchanged from the end of the report period to the letter date and disclosing any changes or known incidents; the held Bureau of the Fiscal Service letters are examples. No attestation standard prescribes the letter; it is the practice user auditors expect under AU-C 402 and ISA 402, and it gives no assurance.