The SOC 2 management assertion, printed in full

Three documents, one name

The assertion, the representation letter and the bridge letter reach different readers and carry different weight. They are not interchangeable. Search results treat them as if they were.

The representation letter is where you confirm to the firm that you handed over everything relevant, including incidents and known control failures. It is required by the attestation standards.² Nobody outside the firm sees it.

The bridge letter is different again. It covers the months after your report period closed, it is unexamined, and it adds no assurance. The bridge letter page has that one in full.

The Type 1 assertion, as of a date

Type 1 fixes one day. Design and implementation on that day, and nothing about the weeks on either side of it.

Two dates, doing two jobs. June 30 is what the letter speaks about. July 14 is the day it was signed, which is the day the report was issued. The gap between them is the subject of the last section here.

The Type 2 assertion, throughout the period

One phrase changes. The burden changes with it. Throughout means every day in the window rather than the last one.

The criteria named in that last line are the common criteria for Security.⁴ Name the categories you actually scoped, and no others.

The subservice sentence

Your description leans on vendors you cannot test. The assertion says which of two methods you used, in one sentence, in both variants. Silence leaves the reader unable to tell what was examined.

Carve out

Acme uses Amazon Web Services as a subservice organization. The description presents Acme’s controls and excludes the controls of the subservice organization, and it presents the complementary subservice organization controls assumed in the design of Acme’s controls.

Inclusive

The description includes the controls of Amazon Web Services relevant to the system, and those controls were examined. Saying this commits the vendor to producing its own assertion and sitting for testing beside you.

Carve out is the ordinary choice for a small company, because the second sentence needs a hyperscaler to agree to it. The system description works the same choice through Section 3.

The sentence that discloses a deviation

A control that did not operate as described does not drop out of the letter. The assertion carries a qualifier and points at the section holding the detail. Section 4 holds the tests and their results.³

Write the qualifier once, then stop. The detail belongs in Section 4 and the remediation belongs in Section 5, so an explanation squeezed into Section 2 reads as an argument with the report it sits inside. The firm decides separately whether the deviation changes the opinion, and what an exception actually does to a report covers that decision.

Who is entitled to sign it

An officer with authority to speak for the company, who also knows how the system runs. Both halves matter. Authority without knowledge produces a letter nobody can defend in a customer call, and knowledge without authority produces one a buyer will not accept.

Chief executive, chief technology officer and chief information security officer are ordinary choices. The title is printed under the name.

The auditor never signs it. A firm that drafted your assertion would be reporting on its own work, and that separation is what the report rests on. Who can perform a SOC 2 examination sets out the rule and how to check a firm against its state board. A consultant may draft the wording. An officer signs it.

When the signer has left before issuance

The letter is dated the day the report is issued, and that day can arrive weeks after the period closes. People leave in the gap. This is the case a downloadable template has no answer for.

The signature belongs to whoever holds the office on the issuance date. A successor signs on behalf of the company rather than personally, and asserts about a period they may not have been present for. That is permitted. It is also uncomfortable, and the discomfort is the useful part.

1. Capture the knowledge before the departure. A handover memo naming the systems, the open exceptions and the evidence locations, dated while the outgoing officer is still in post.
2. Name the successor to the firm early. The engagement team needs to know who signs both letters before fieldwork closes.
3. Let the successor read the evidence. They are asserting on the strength of the record, so the record has to be legible to somebody who was not there.
4. Do not backdate, and do not use a departed signature. A letter signed by someone who had already resigned is a defect a buyer finds later.

A company that changes chief executives twice in a year can still sign a clean assertion. It cannot reconstruct one from memory.