In short
A bridge (gap) letter is a statement from a service organization's management covering the period between the end of its latest controls report and a customer's year-end, saying whether controls have changed.
Key takeaways
- It comes from management, not the service auditor, so it gives less assurance than the report.
- Customers weigh it with the length of the gap and their own monitoring controls.
- A long gap may need other procedures.
Where it's tested
ISC: Third-Party & Vendor Risk — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A service organization's controls report covers January to September, but a user company's year ends December 31. The service organization's management provides a letter stating that no significant control changes occurred from October to December. This letter is a: