Switching compliance platforms mid audit period: a checklist

You can switch compliance platforms during an audit period if you export all evidence first, tell your auditor in advance, run both tools in parallel for a short overlap, and keep the old data accessible until the audit closes. The risk is a gap in evidence, not the move itself.

Decide whether to switch now or later

If you are weeks from fieldwork, switching adds risk with little upside. Evidence collection continuity is more valuable than a better interface. If you are early in a Type 2 window or between audits, the cost of moving is lower.

A reasonable rule: do not switch inside the final stretch before fieldwork unless the current tool is actively failing you. Otherwise wait until the audit closes and move before the next window opens.

Before you start

1. Tell your auditor. Ask what they need to see to be satisfied that evidence is continuous across the move.
2. Check your current contract: end date, notice period, and data export terms.
3. Export everything you can: policies with version history, evidence files, task history, vendor records, risk register, training records, and access reviews.
4. Open the exports and check they are readable without the old tool.
5. List automated tests in the old tool and map each to the new one. Find controls the new tool does not test.

Run both in parallel

Keep the old platform live while you connect the new one. Overlap them for a period long enough to cover at least one full cycle of your regular checks, such as a monthly access review.

During the overlap, compare results. Differences are useful. If the two tools disagree about a control, find out which is right and why.

Preserve the audit trail

Evidence from before the switch must still be available to the auditor, in a form they can sample. Options:

• Keep the old account read-only until the audit report is issued.
• Import records into the new tool where it supports it, and keep the original export as a reference.
• Store a dated archive in your own storage, with a short note that explains where each item came from.

Whichever you choose, write a one page note describing what moved, what did not, and when. Auditors appreciate a clear explanation. See what to do when a control fails mid audit period for a similar approach to documenting changes.

After the move

• Reassign control owners and reminders.
• Remove the old integrations and revoke their credentials.
• Confirm the old vendor has deleted or returned your data as agreed, and keep that confirmation.
• Update your system description if it names the tool.

Where Safeguard fits

Safeguard offers compliance and evidence automation, and it can import compliance records such as spreadsheets and exports so you are not starting from blank. The free scan at gold.safeguard.sh/scan covers dependency evidence with no setup.

Quick check

Last reviewed: 19 October 2026.