Changes during a SOC 2 Type 2 period are normal, and auditors expect them. What matters is that each change goes through your own documented controls, that you tell your auditor early, and that evidence for new tools, people and systems starts on the day they join. A Type 2 tests operating effectiveness across the whole period.
Why do mid period changes matter?
A Type 2 report covers a period and includes tests of operating effectiveness, according to the AICPA Trust Services Criteria text. That means the auditor samples across the period, including after the change. A new hire, a new vendor or a new production system each creates a fresh set of control obligations that must run from the first day. The criteria also anticipate change. CC3.4 asks the entity to identify and assess changes that could significantly affect the system of internal control, and CC8.1 covers authorising, testing, approving and implementing changes to infrastructure, data, software and procedures.
What happens with a new tool?
Treat it as a vendor and as a system.
Before use, complete a vendor review under your vendor management process (CC9.2 covers risks from vendors and business partners). Collect their assurance report or security answers, log the data they will hold and note who approved it. Add the tool to your system and vendor inventory.
Then handle access. Turn on single sign on and multi-factor authentication if the tool supports them. Record who has access and why (CC6.1 to CC6.3 cover access provisioning and removal). Add the tool to the next access review.
If the tool replaces an existing one, plan the cutover. Export logs and records from the old tool so evidence from the early part of the period is not lost, and note the date of the switch in your change records.
What happens with new hires?
Each hire must follow the onboarding steps you promised: background check if your policy says so, policy acknowledgment, security training within your stated window, access granted by role with approval, and device setup. The sampled hire might be the one who joined in month five. Keep a dated onboarding record per person. When someone leaves, the leaver steps run within your stated time, and you keep the proof.
What happens with a new system or environment?
Run it through change management. Record the request, risk review, testing, approval and release. Update the system description, network diagrams and asset inventory. Confirm logging, monitoring, backups and vulnerability scanning cover the new system from day one, since CC7.1 expects detection of configuration changes and new vulnerabilities. If it changes the boundary of the audit, talk to your auditor before it goes live.
How and when should you tell the auditor?
Early, in writing, with a short note: what changed, when, who owns it, and which controls apply. Auditors can then decide how to sample. They may need to update the system description and test the new element separately. Surprises found at sampling time are worse than changes announced in advance.
What about control owners and policies?
If a control owner leaves, assign a new one the same week and note the handover. If you change a policy mid period, keep the old version, record the effective date and apply each version to the right part of the period. Do not rewrite a policy to cover a missed control.
What to do
- Keep a change log for people, tools, systems and policies during the period.
- Run every new vendor through review before use.
- Provision access through your normal approval flow and add it to the next review.
- Keep dated onboarding and offboarding records per person.
- Run system changes through change management and update the system description.
- Export evidence from any tool you retire.
- Notify your auditor in writing of material changes.
- Reassign orphaned controls within a week.
Quick check
Does a mid period change break my Type 2?
Not by itself. The auditor tests whether your controls operated effectively, including for the change. Unmanaged or undocumented changes cause the problems.
Should I add a new tool right before the period ends?
Be careful. It still needs the full onboarding steps, and a late change gives you little operating history. Discuss timing with your auditor.
How Safeguard helps automate this
Mid period change is where manual evidence trails break. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously, which means a new system or tool can be picked up as it connects. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, so a new service or library shows up in your inventory with its findings. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Your independent auditor makes the final call.
Try the framework mapping demo full screen.
Sources
- AICPA, 2017 Trust Services Criteria with revised points of focus (2022): Type 2 engagement description, criteria CC3.4, CC6.1 to CC6.3, CC7.1, CC8.1 and CC9.2
Last reviewed: 18 October 2026.
