Switching doesn’t have to be complicated. With the right planning and communication, you can move to a new provider while keeping continuity, minimizing disruption and meeting your reporting obligations.
Choosing an auditor or certification body is an important business decision. Over time, your provider gets to know your operations, systems, controls and reporting requirements. So even when you feel it may be time for a change, the idea of switching can create uncertainty.
Will the new provider understand our business? Will we have to start from scratch? Will there be a gap in our report or certificate? Will our customers still accept it? And how much extra work will it create for our team?
These are reasonable questions, and they’re often the reason organizations hesitate. In reality, changing providers rarely means starting over. With a structured transition, you can build on the work already done, keep important history, and set up a productive relationship with your new auditor.
When is it time to consider a change?
Organizations switch for many reasons. It may be worth exploring if:
Your communication or service needs have changed
Your organization has outgrown its current provider’s capabilities or resources
Your reporting or compliance requirements have changed, for example adding ISO/IEC 27701 privacy or ISO/IEC 42001 AI, or a SOC 2 alongside ISO/IEC 27001
You need deeper expertise in your technology or industry
You want a different working style, for example more frequent check-ins or a single point of contact
You’d prefer one provider for both SOC reporting and ISO certification
Changing doesn’t mean there’s something wrong with your current provider. It can simply reflect your organization’s changing needs.
1. Will we have to start over?
This is usually the biggest concern, and the answer is different for ISO and SOC.
ISO certification: usually not. An accredited ISO certificate can normally be transferred to a new certification body under IAF MD 2. Your certificate stays valid and your three-year certification cycle continues. You don’t go back to a Stage 1 audit. Before accepting the transfer, the new certification body completes a pre-transfer review. It checks that your certificate is accredited, valid and not suspended, reviews your recent certification and surveillance reports, and confirms the status of any open nonconformities, any complaints and your reason for transferring. In most cases, your next audit is then the one that was already due.
SOC reports: you keep your history, but the opinion is new. Your previous SOC reports, system description and control documentation carry forward. An experienced incoming auditor will use them to understand your environment quickly. The new firm must form its own independent opinion, so it plans and tests the controls itself. The goal isn’t to repeat everything. It’s to build the understanding needed to meet professional standards efficiently.
2. Will there be a gap in our report or certificate?
For many organizations, this matters most because it’s what customers notice.
SOC 2 Type II: Customers usually expect each reporting period to follow straight on from the last. Align the new firm’s first period so it starts where your last report ended. If a short gap can’t be avoided, management can give customers a bridge letter covering the interim. Planning the timing to avoid one is better.
ISO: A properly managed transfer causes no gap. Your certificate remains valid throughout.
3. Will our customers and stakeholders still accept the report?
SOC reports and ISO certificates are often what customers, partners and regulators rely on. Switching doesn’t change their requirements, but don’t assume every report or certificate will automatically satisfy every recipient. Before you switch, confirm:
The required report type or standard (SOC 1, SOC 2, SOC 3, Type I or Type II, or ISO/IEC 27001:2022)
The required scope, and any specific Trust Services Criteria
Reporting periods and submission deadlines
Any requirements about the provider (for example a licensed CPA firm or an accredited certification body)
Any other requirements set by customers or other report recipients
At MHM, we start by understanding why you need the report or certificate and who relies on it, so the result meets those requirements.
4. Will the new provider understand our business?
Every organization has its own operating environment, technology, controls and regulatory considerations. A transition gives your new provider the chance to learn these properly, through planning, conversations with management, documentation review and the audit itself. The aim is a relationship where your auditor understands not just what needs to be audited, but why it matters to your organization.
5. Will switching disrupt our business?
Your finance, IT and compliance teams already have full workloads. A transition needs some time upfront, mainly to walk the new team through your environment. After that it shouldn’t take more than a normal audit. What makes the difference is coordination:
One consolidated request list instead of scattered emails
Reuse of existing documentation wherever possible
An agreed timeline and a named contact on both sides
6. Will it increase our costs?
There may be some one-time effort in the first year while the new team learns your environment. Existing documentation and prior reports can be reused, so you shouldn’t be paying to redo work that’s already done. Cost depends on:
The complexity of your organization
The scope of the engagement or certification
The quality and availability of your existing documentation
The condition of your controls and supporting records
Any changes in reporting requirements
Your timing and deadlines
Agree on the scope, responsibilities and fees upfront so there are no surprises. Look beyond the first-year fee to the overall value: communication, responsiveness, technical expertise, and support as your compliance program grows.
7. Will we lose knowledge and continuity?
Your current provider may have years of history with you, and that knowledge matters. A well-planned transition captures it. With your permission, the incoming auditor can communicate with the previous provider, subject to professional and confidentiality requirements. For ISO transfers, a review of your previous audit reports is a required step. Management helps too, by sharing significant changes and past findings. The new provider forms its own conclusions, but your history isn’t lost.
When is the best time to switch?
Before your next cycle (ideal). For SOC, engage the new firm before your next reporting period starts, so planning and period alignment happen in advance. For ISO, transfer ahead of your next surveillance or recertification audit.
Mid-cycle (possible, with planning). An ISO transfer can happen at any point in the cycle. A SOC change mid-period needs careful coordination over what the new auditor can test and rely on.
Well before your deadline. Waiting until just before a contractual or customer deadline narrows your options and adds pressure for everyone.
Our advice: start the conversation early. Even if your next cycle is months away, an initial discussion helps you understand what’s involved and pick the right timing. Let’s discuss your needs.
What the transition looks like
Initial consultation: Your current reports or certificate, scope, deadlines and stakeholder requirements.
Documentation review: Prior SOC reports, or ISO audit reports and certificate, plus any open findings.
Transition or transfer: For ISO, the pre-transfer review and certificate transfer. For SOC, period alignment and, with your permission, coordination with the previous firm.
Planning and fieldwork: A consolidated request list and an agreed timeline.
Ongoing communication and reporting: Your SOC report or ISO certificate, issued on schedule.
A new relationship doesn’t have to mean starting over
Choosing a new provider is an important decision, but fear of disruption shouldn’t drive it. At MHM, we provide both SOC reporting and ISO certification, including ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001, so one team can support your whole assurance program. We take the time to understand your business, your reporting objectives and the stakeholders who rely on your reports.
Thinking about changing auditors? You don’t need all the answers to start the conversation. Book a 30-minute transition call and we’ll review your current report or certificate, your deadlines and your customers’ requirements, and give you a realistic plan. Book a transition call.
