The SOC 2 management assertion, printed in full
Section 2 is one page, and your name goes on it. Both variants are below, with the clauses for vendors, exceptions and a signer who left.
The SOC 2 management assertion is Section 2 of the report. Management writes it and an officer signs it.1 It runs about one page, and it is the part of the report your own signature lands on.
Three separate documents get filed under that name. Both variants of the letter are printed below, and the Word and PDF template carries the same wording with brackets where the example company sits.
Three documents, one name
The assertion, the representation letter and the bridge letter reach different readers and carry different weight. They are not interchangeable. Search results treat them as if they were.
| Document | Addressed to | Where it appears | Date it carries |
|---|---|---|---|
| Management assertion | Whoever reads the report | Section 2, inside the report itself | The examination date, or throughout the Type 2 period. The signature time is recorded separately |
| Management representation letter | The CPA firm, by name | Nowhere. It stays in the firm’s engagement file | The practitioner’s report date |
| Bridge letter | The customer who asked for one | Nowhere. You send it yourself, later | The day you sign it |
The representation letter is where you confirm to the firm that you handed over everything relevant, including incidents and known control failures. It is required by the attestation standards.2 Nobody outside the firm sees it.
The bridge letter is different again. It covers the months after your report period closed, it is unexamined, and it adds no assurance. The bridge letter page has that one in full.
The Type 1 assertion, as of a date
Type 1 fixes one day. Design and implementation on that day, and nothing about the weeks on either side of it.
We have prepared the accompanying description of the Acme platform system as of June 30, 2026 (description) based on the criteria for a description of a service organization's system set forth in DC section 200, 2018 Description Criteria for a Description of a Service Organization's System in a SOC 2 Report (description criteria). The description is intended to provide report users with information about the Acme platform system that may be useful when assessing the risks arising from interactions with it, particularly information about system controls that Acme has designed and implemented to provide reasonable assurance that its service commitments and system requirements would be achieved based on the trust services criteria relevant to the Security category (applicable trust services criteria) set forth in TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Acme uses Amazon Web Services as a subservice organization. The description includes only the controls of Acme and excludes the controls of Amazon Web Services. The description also indicates that certain applicable trust services criteria can be met only if complementary subservice organization controls assumed in the design of Acme's controls are suitably designed and operating effectively, along with the related controls at Acme. The description does not disclose the actual controls at the subservice organization.
The description also indicates that complementary user entity controls assumed in the design of Acme's controls are necessary, along with controls at Acme, to achieve Acme's service commitments and system requirements. The description presents those complementary user entity controls and does not disclose the actual controls at the user entities.
We confirm, to the best of our knowledge and belief, that:
a. the description presents the Acme platform system that was designed and implemented as of June 30, 2026 in accordance with the description criteria.
b. the controls stated in the description were suitably designed as of June 30, 2026 to provide reasonable assurance that Acme's service commitments and system requirements would be achieved based on the applicable trust services criteria, if its controls operated effectively as of that date, and if the subservice organization and user entities applied the complementary controls assumed in the design of Acme's controls as of that date.
Dana Okafor, Chief Executive Officer, Acme, Inc. Signed July 14, 2026.
Two dates, doing two jobs. June 30 is what the letter speaks about. July 14 is the day it was signed, kept on record apart from the practitioner’s report date. The gap between them is the subject of the last section here.
The Type 2 assertion, throughout the period
The period replaces the date, and a third statement joins the two: the controls operated effectively. The burden changes with it. Throughout means every day in the window rather than the last one.
We have prepared the accompanying description of the Acme platform system throughout the period January 1, 2026 to June 30, 2026 (description) based on the criteria for a description of a service organization's system set forth in DC section 200, 2018 Description Criteria for a Description of a Service Organization's System in a SOC 2 Report (description criteria). The description is intended to provide report users with information about the Acme platform system that may be useful when assessing the risks arising from interactions with it, particularly information about system controls that Acme has designed, implemented and operated to provide reasonable assurance that its service commitments and system requirements were achieved based on the trust services criteria relevant to the Security category (applicable trust services criteria) set forth in TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Acme uses Amazon Web Services as a subservice organization. The description includes only the controls of Acme and excludes the controls of Amazon Web Services. The description also indicates that certain applicable trust services criteria can be met only if complementary subservice organization controls assumed in the design of Acme's controls are suitably designed and operating effectively, along with the related controls at Acme. The description does not disclose the actual controls at the subservice organization.
The description also indicates that complementary user entity controls assumed in the design of Acme's controls are necessary, along with controls at Acme, to achieve Acme's service commitments and system requirements. The description presents those complementary user entity controls and does not disclose the actual controls at the user entities.
We confirm, to the best of our knowledge and belief, that:
a. the description presents the Acme platform system that was designed and implemented throughout the period January 1, 2026 to June 30, 2026 in accordance with the description criteria.
b. the controls stated in the description were suitably designed throughout the period January 1, 2026 to June 30, 2026 to provide reasonable assurance that Acme's service commitments and system requirements would be achieved based on the applicable trust services criteria, if its controls operated effectively throughout that period, and if the subservice organization and user entities applied the complementary controls assumed in the design of Acme's controls throughout that period.
c. the controls stated in the description operated effectively throughout the period January 1, 2026 to June 30, 2026 to provide reasonable assurance that Acme's service commitments and system requirements were achieved based on the applicable trust services criteria, if complementary subservice organization controls and complementary user entity controls assumed in the design of Acme's controls operated effectively throughout that period.
Dana Okafor, Chief Executive Officer, Acme, Inc. Signed July 14, 2026.
The applicable criteria named in the first paragraph are the common criteria for Security.4 Name the categories you actually scoped, and no others.
The subservice paragraph
Your description leans on vendors you cannot test. The assertion says which of two methods you used, in a short paragraph, in both variants. The letters above use carve out. Silence leaves the reader unable to tell what was examined.
- Carve out
- Acme uses Amazon Web Services as a subservice organization. The description includes only the controls of Acme and excludes the controls of Amazon Web Services. The description also indicates that certain applicable trust services criteria can be met only if complementary subservice organization controls assumed in the design of Acme's controls are suitably designed and operating effectively, along with the related controls at Acme. The description does not disclose the actual controls at the subservice organization.
- Inclusive
- The description includes the controls of Amazon Web Services relevant to the system, and those controls were examined. Saying this commits the vendor to producing its own assertion and sitting for testing beside you.
Carve out is the ordinary choice for a small company, because the inclusive method needs a hyperscaler to agree to it. The system description works the same choice through Section 3.
The sentence that discloses a deviation
A control that did not operate as described does not drop out of the letter. The assertion carries a qualifier and points at the section holding the detail. Section 4 holds the tests and their results.3
c. except for the matter described in Section 4 of this report, the controls stated in the description operated effectively throughout the period January 1, 2026 to June 30, 2026 to provide reasonable assurance that Acme's service commitments and system requirements were achieved based on the applicable trust services criteria, if complementary subservice organization controls and complementary user entity controls assumed in the design of Acme's controls operated effectively throughout that period.
Write the qualifier once, then stop. The detail belongs in Section 4 and the remediation belongs in Section 5, so an explanation squeezed into Section 2 reads as an argument with the report it sits inside. The firm decides separately whether the deviation changes the opinion, and what an exception actually does to a report covers that decision.
Who is entitled to sign it
An officer with authority to speak for the company, who also knows how the system runs. Both halves matter. Authority without knowledge produces a letter nobody can defend in a customer call, and knowledge without authority produces one a buyer will not accept.
Chief executive, chief technology officer and chief information security officer are ordinary choices. The title is printed under the name.
The auditor never signs it. A firm that drafted your assertion would be reporting on its own work, and that separation is what the report rests on. Who can perform a SOC 2 examination sets out the rule and how to check a firm against its state board. A consultant may draft the wording. An officer signs it.
When the signer has left before issuance
The letter is signed near the end of the engagement, and that can be weeks after the period closes. People leave in the gap. The letter itself has no answer for this case.
The signature belongs to whoever holds the office on the issuance date. A successor signs on behalf of the company rather than personally, and asserts about a period they may not have been present for. That is permitted. It is also uncomfortable, and the discomfort is the useful part.
- Capture the knowledge before the departure. A handover memo naming the systems, the open exceptions and the evidence locations, dated while the outgoing officer is still in post.
- Name the successor to the firm early. The engagement team needs to know who signs both letters before fieldwork closes.
- Let the successor read the evidence. They are asserting on the strength of the record, so the record has to be legible to somebody who was not there.
- Do not backdate, and do not use a departed signature. A letter signed by someone who had already resigned is a defect a buyer finds later.
A company that changes chief executives twice in a year can still sign a clean assertion. It cannot reconstruct one from memory.
What the letter asserts is that your controls were suitably designed, and the design lives in your policies. The information security policy says who owns them, and the access control policy and incident response plan set out controls that an examination tests against the records of the period.
The wording above is what Polara GRC drafts into Section 2, built from your questionnaire answers and carrying the signer name, title and date you give it, then indexed into the package your independent partner auditor reviews. Star is $2,000 one time, and a Type 1 report is $2,000 more. On Orbit, $7,800 a year, your SOC 2 Type 2 audit is included in every contract year. The first one starts once the 3-month observation window completes.
Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.
Questions
What is a SOC 2 management assertion?
What is the difference between the management assertion and the management representation letter?
Who signs the SOC 2 assertion?
How does the Type 1 assertion differ from the Type 2 assertion?
What happens if the person who signed has left the company?
Sources
- SOC 2 Report
- Statements on Standards for Attestation Engagements
- SOC 2: Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy
- TSP Section 100, Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy
Get audit-ready without a compliance team.
The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.
Take the free assessmentPolara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.