Best SOC 2 Compare

Timing and the audit · Lesson 5 of 10

  1. Lesson 1
  2. Lesson 2
  3. Lesson 3
  4. Lesson 4
  5. Lesson 5
  6. Lesson 6
  7. Lesson 7
  8. Lesson 8
  9. Lesson 9
  10. Lesson 10

What your auditor needs when you change tools

Short answer

Your auditor needs complete evidence for the period, a clear account of what changed and when, and confidence that controls kept operating through the move. Give them a changeover note, both evidence sets and early warning.

By The Switchyard Desk, Best SOC 2 Compare · Published 2026-03-02 · Vendor pages read 2 March 2026 · Editorial assessment

2 min read

Who is the auditor, and what are they checking?

A SOC 2 report is issued by a CPA firm. The AICPA describes SOC as a suite of services CPAs may provide, and its SOC 2 guide covers controls relevant to security, availability, processing integrity, confidentiality and privacy. The auditor is checking your controls, not your software. The platform is only where the evidence lives.

What will they ask for?

  • Evidence for the whole period, from both platforms if you switched mid-period.
  • The date of the changeover and what moved.
  • Proof that monitoring did not stop: for example, overlapping evidence from both platforms around the changeover date.
  • Policy versions and approval records, with their original dates.
  • Any change to your system description, if the platform is part of how you describe your controls.

What is a changeover note?

A short, dated document you write: the old platform, the new platform, the changeover date, the evidence exported and where it is stored, the integrations reconnected and the date each was confirmed, and who signed it off. It answers most of the auditor's questions before they ask them.

Does a new platform change the scope of the audit?

Not by itself. Scope is set by the system and the Trust Services Criteria you include. If your switch comes with new systems, new vendors or new frameworks, discuss scope with your auditor separately.

Which questions should you ask your auditor first?

  • Is a mid-period switch acceptable for this report, and how should evidence be presented?
  • Do you need read access to the old platform after we leave it?
  • Will you work in the new platform, or do you want exports?
  • Does anything about the new vendor's audit route affect your work with us?

When should you brief the auditor?

As early as you can, and before you sign with the new vendor if the switch falls inside a report period. A short call in which you explain the plan, the dates and the evidence you will export costs little. Finding out during fieldwork that half the period sits in a platform nobody can open any more costs a great deal more. Confirm the outcome of that call by email, so the agreed approach is on record for both sides.

Next lesson: Keeping or changing your auditor when you switch platforms

Keeping or changing your auditor when you switch platforms

Related pages

Terms used in this lesson