Usually, avoid migrating a control tool in the middle of an audit observation period. If you must, agree the plan with your auditor, overlap both tools so evidence has no gap, and document the change. Waiting until the period closes is simpler and carries less risk of an unexplained control gap.
Why timing matters
An audit that covers a period of time asks whether controls operated throughout it. A tool change inside that period gives the auditor one more thing to test: that the control worked before, after and across the switch. A point in time review is less sensitive, but still looks at what is running on the date.
Check the exact type and dates of your engagement with your auditor. Do not assume.
Decision table
| Situation | Suggested approach |
|---|---|
| Contract ends mid period, no overlap possible | Negotiate a short extension rather than a gap |
| Old tool is failing or unsupported | Migrate, with auditor agreement and overlap |
| Period ends in a few weeks | Wait, then migrate |
| Early in the period, tool is a poor fit | Migrate early, document, run overlap |
| Between periods | Best time to switch |
If you must migrate
- Tell the auditor before you start, with the reason and dates.
- Run both tools through the cutover. See keeping audit evidence continuous.
- Update the control description and keep a dated change record.
- Save the first reports from the new tool and a comparison of the two on the same code.
- Keep reviews and tickets flowing through the same process so the human steps look unchanged.
What not to do
Do not stop the old tool on the day the new one is switched on. Do not change the scope of what is scanned quietly during the switch. Do not leave the control wording naming a tool you no longer run.
Use the calendar
Place consolidation work against your audit calendar and your contract notice dates, covered in auto-renewal notice dates for security tool contracts. Often the clean answer is to renew the old tool for a short term and migrate after the period.
What to say to the auditor
Keep it short and factual: which control, which tool, the planned dates, the overlap, and the evidence you will provide. Ask whether they want a sample from the new tool early. Auditors generally prefer to hear about a change before it happens than to find it in the evidence later. Confirm anything you are unsure about with them directly, because practices differ between firms.
Quick check
Will changing tools fail the audit?
Not by itself. Problems come from gaps, undocumented changes or controls that no longer match what you run.
Does this apply to a Type 1 style review?
The sensitivity is lower, but your description of the control should match what is running on the review date. Confirm with your auditor.
Safeguard covers SBOM and dependency scanning, reachability analysis, policies and gates, and compliance evidence automation. You can try a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
