Bridge Letter After a December Ransomware Event
Cobalt Ridge provides benefits administration. Its SOC 2 Type II covers Security and Confidentiality for the period 1 October 2023 through 30 September 2024, with an unqualified opinion. In December 2024, a ransomware incident encrypted two file servers; the company restored from backup in 36 hours, notified 14 clients, and engaged forensics. No evidence of data exfiltration was found, but the incident response plan was not followed for the first six hours because the on-call engineer's phone tree was outdated. A large client's procurement team asks in February 2025 for 'the SOC 2 report plus a bridge letter confirming there have been no changes and no incidents since the period end.' Cobalt Ridge's CFO wants to send the September report with a one-page letter stating 'no material changes' and to omit the ransomware event because it was after the report period. The auditor is not engaged to issue a bridge letter.
1. What can a bridge letter appropriately state, and what can it not do?
Read the worked answer
A bridge letter is a management representation, not an auditor's report. It can cover the gap between the end of the SOC 2 period and the date of the letter. It can state whether the system description remains materially accurate, whether controls have changed in a way that would affect the report, and whether management is aware of any incidents or exceptions that would change a user's understanding of the controls. It can also point readers to separate communications or a future report.
It cannot extend the auditor's opinion, provide assurance that no incidents occurred, or convert a post-period event into audited evidence. If the auditor is not engaged, the letter should say so. A statement that there have been 'no changes and no incidents' is too absolute and is false here. The letter should be dated, signed by an accountable executive, and restricted to the intended users and purpose. Procurement teams often understand that a bridge letter is unaudited management communication; the danger is presenting it as if it carried the same weight as the report.
2. Advise the CFO on whether the ransomware event may be omitted from the bridge letter.
Read the worked answer
It should not be omitted. The client asked specifically about incidents since period end, and the event is known, affected two file servers, triggered client notifications, and exposed a weakness in the incident response plan. Omitting it while saying 'no material changes' would be misleading even though the event occurred after the report period. The report itself may remain accurate for its period, but the bridge letter is a separate communication about the gap.
The better approach is to describe the event factually: date, systems affected, containment and restoration time, forensic conclusion, client notifications, and the control changes made, such as updating the phone tree and testing the call list. Management should state its conclusion about whether the event changes the report's usefulness, and avoid a legal conclusion about materiality that it cannot support. If the incident reveals a deficiency in the incident response control, management should assess whether a future report or separate communication is needed. The auditor can be asked to perform agreed-upon procedures, but that is a separate engagement, not an implied audit of the letter.
3. Draft the key content for the bridge letter and the immediate follow-up actions.
Read the worked answer
The letter should include: the report period and the gap period covered; a statement that the system description remains materially accurate or identify changes; a summary of control changes, including the updated incident response phone tree and any new backup or monitoring controls; a factual summary of the December incident and management's assessment; a statement that the letter is unaudited management information and is not a substitute for the SOC 2 report; and a contact for questions.
Follow-up actions should include testing the revised incident response plan, retaining forensic and notification evidence, updating the risk assessment, and deciding whether to commission a new Type II report for the post-period. The client should receive the report, the bridge letter, and an offer to discuss the incident. If the client requires auditor assurance over the gap, management should discuss a separate engagement rather than ask the auditor to sign a management letter. The CFO should also avoid using 'no material changes' as a slogan; specificity is more credible.