There is no universal expiry date, so set your own freshness rule per document type and per tier. A common approach is to treat evidence as current for about a year, ask for a refresh or a bridging statement after that, and shorten the window for high tier vendors.
Why age matters
Evidence describes a point in time or a period. A report covers a window. A penetration test covers a version. A questionnaire answer covers the day it was written. Software and teams change, so older evidence says less about today.
A freshness table you can adapt
| Document | What it covers | Suggested handling |
|---|---|---|
| Independent audit report | A defined period and scope | Ask for the next one when the period ends; read any gap statement |
| Penetration test summary | A version at a point in time | Ask what changed since; request a retest summary for major changes |
| Certificate | A scope and validity dates | Check the dates and scope, not only the logo |
| Questionnaire answers | The day they were written | Refresh yearly or when scope changes |
| Data processing agreement | The contract term | Review at renewal |
| SBOM | One build | Refresh each release |
The numbers are your policy, not a standard. Write them down so reviewers apply them the same way.
When evidence is old
- Ask the vendor for the newer version.
- If it is not ready, ask for a short written statement of what has changed in the controls since the last report, signed by an accountable person. See SOC 2 bridge letters for what that kind of letter can and cannot say.
- For a high tier vendor, ask for supporting facts, such as a recent test result.
- Record the age and your decision. Do not let the row quietly turn stale.
Events that reset the clock
Treat these as triggers for a fresh look regardless of document age:
- A breach or serious incident at the vendor
- A change of ownership
- A major product change or move to a new hosting provider
- A new subprocessor that touches your data
- A significant vulnerability in the product
Tracking it
Put an expiry or review date next to every evidence item in your register. A simple reminder a month before the date is enough to avoid a scramble at renewal. See vendor risk register fields.
Quick check
Is a two year old audit report acceptable?
By most internal policies it is too old on its own. Ask for the current one, or a bridging statement plus other recent facts, and record why you accepted the gap.
Do certificates expire?
Certificates carry validity dates, and the scope on them matters as much as the date. Check both.
Safeguard's compliance and evidence automation can track evidence dates alongside controls, and a free scan is at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
