Question 1

What happens if a control fails during the observation window?

Accepted Answer

You disclose it, and your report can still be useful. A Type 2 report describes the exceptions an auditor found. An exception is not automatically fatal. What matters is whether it was detected, how you handled it, and whether the control got fixed. A report with a documented exception and a clear remediation reads better than a spotless one from a company that clearly tested nothing. What damages you is an exception you knew about and did not raise. Tell your auditor early, in writing. The conversation stays about the control.

Question 2

What is a bridge letter?

Accepted Answer

It covers the gap between your report ending and today. A Type 2 report describes a window that closed on a date, and that date recedes as the year goes on. A bridge letter is a short statement from you saying nothing material changed since. No AICPA standard defines one. Your auditor does not issue it and does not attest to it. It is your assertion, and that is exactly how a reviewer weighs it. Bridge letters are accepted in practice for a few months. Stretch one past that and expect questions about your next report.

Question 3

Does an exception ruin the report?

Accepted Answer

No. A qualified opinion is a different matter, and the two get confused. An exception is something the auditor found while testing a control. Reports carry them regularly, and reviewers read them as evidence that testing happened. A qualified opinion is the auditor stating a broader reservation. That is the one procurement notices. When you see an exception coming, document what happened, fix it, and be able to show the fix operating. What you cannot do is argue it away and hope your customer skips that section.

Question 4

What does the auditor's opinion actually say?

Accepted Answer

Whether your controls were suitably designed, and for a Type 2, whether they operated effectively across the period. That is the sentence the whole report exists to support. It attaches to your description of the system, not to your company in general, which is why scope matters so much. An unmodified opinion means the auditor found nothing requiring a reservation. A modified or qualified one states a reservation, and your reviewer will read that paragraph first. Read your own opinion before you send it. Founders forward reports they have not read to the end.

Question 5

What is management's assertion?

Accepted Answer

Your statement that your description is accurate and your controls work. You sign it, not your auditor. This trips people up because the report feels like something done to you. It is not: you assert, and the auditor examines your assertion. That is why the representation letter exists and why it lists what you are confirming. Read it as a document you are personally standing behind, because that is its function. If anything in your system description is aspirational, the assertion is where that becomes your problem rather than a drafting question.

Question 6

What is a system description and how much detail belongs in it?

Accepted Answer

It describes the service, its boundaries, and the controls you claim. Enough detail that a reader can tell what is covered, and no aspiration. The opinion attaches to this document, so a description saying you do something you do not is not a marketing overreach. It is the thing your auditor tests you against. Two common mistakes. Describing a target architecture rather than the running one. And drawing boundaries loosely enough that a reviewer cannot tell whether the system they depend on is inside. Write it so somebody outside can answer both questions.