Definition
AICPA · SOC 2 reporting practice (not a defined term)A short letter from the service organisation, not the auditor, covering the gap between the end of the last SOC 2 Type 2 period and the date a customer needs assurance for. It states whether the controls described in the report have changed materially and whether management knows of any failures since. It is not audited, so treat it as management's representation; most buyers accept one for a gap of up to about three months.
Also called gap letter