Evidence has a shelf life. Your vendor file should know it.

Vendor evidence ages. A SOC report describes a period that has already ended; a certificate has an expiry date; an insurance policy renews once a year. The review that approved a vendor two years ago was based on documents that may no longer describe the vendor at all. In most organisations nobody notices until an auditor asks for the current report, or until the vendor changes hands and somebody wonders whether the controls changed with it.

This post follows one such case in the demo organisation, Northwind Labs. Ledgerly, the accounts-payable vendor, had a SOC 1 Type II report on file that expired on 15 September 2026. The expiry raised a signal and a finding; a news item said Ledgerly had been acquired by Harbour Capital; and finance had asked to renew for another year. Ledgerly and Harbour Capital are fictional, and the news item is marked illustrative in the demo. The screens are the product as built.

Why stale evidence is a business risk

Ledgerly processes Northwind’s supplier payments: Tier 2, about $48k a year. A SOC 1 report covers a service organisation’s controls that are relevant to its customers’ financial reporting — here, how invoices are entered, approved and paid. If Northwind relies on those controls in its own financial reporting, its external auditor is likely to ask for a report that covers the year under audit, and to ask how any gap was handled. A report whose period ended long ago does not answer that question.

There is a security angle too. An accounts-payable system is a classic target for payment fraud: changed bank details, fake invoices, approvals bypassed. The controls that stop those are exactly what a SOC 1 tests. Without a current report you are relying on how the vendor behaved in a period that has ended.

Standards expect the monitoring to be continuous rather than one-off. ISO/IEC 27001:2022 Annex A 5.22 covers monitoring, review and change management of supplier services; US interagency guidance on third-party relationships (June 2023) describes ongoing monitoring as part of the life cycle; the EU’s DORA expects financial entities to keep their ICT third-party information current. Confirm what applies to you with your compliance team.

How the expiry was caught

When the Document agent read Ledgerly’s SOC 1 Type II, it extracted the type, the audit period, the auditor and the opinion, each with its page, and set the document’s validity. When that date passed on 15 September 2026, three things happened without anyone remembering to look:

What	Where it shows	Effect
The document is marked expired	Documents list and Ledgerly’s documents tab	No longer counted as assurance
A document_expiry signal fires	Monitoring feed and Ledgerly’s monitoring tab	The Monitoring agent decides the reaction
A finding is raised	Findings queue and Ledgerly’s findings	An owner and a due date; it adds to residual risk

The loss of the reduction matters as much as the finding. A current SOC report takes points off residual risk; an expired one stops doing so, and the open finding adds points. The score on Ledgerly moves without anybody re-scoring it by hand, and the history keeps the trend, so a reviewer can see when and why it changed.

What happens on the day a document lapses.

The news that makes it urgent: an acquisition

On its own, an expired SOC 1 at a stable vendor is a paperwork problem: the next report is probably with the auditor, and a bridge letter covers the gap. What changes the picture is the news signal on the same vendor: Ledgerly has been acquired by Harbour Capital.

A change of ownership is when controls are most likely to change. Systems are consolidated, teams are reorganised, the audit firm may change, and the next SOC report may be delayed or rescoped. None of that is necessarily bad; all of it is worth asking about. The Research agent and InsightPulse bring news like this to the vendor record, and the Monitoring agent decides the reaction by tier. In the demo the Pulse item is illustrative.

The renewal already in flight: VR-0003

Meanwhile, finance had asked: “Renew Ledgerly for another year — finance needs it for AP, same 12 users”. That became VR-0003, a renewal request, Tier 2 with inherent risk 64. The renewal workflow opened four lanes — privacy, finance, IT and business owner — and the request page records the routing reasons for each.

This is where the expired report earns its place in the process. A renewal reviewer opening VR-0003 sees the vendor’s open findings, including the expired SOC 1, and the acquisition signal. The useful conversation is not “do we renew?” — finance needs the system — but “what do we need from Ledgerly before, or as a condition of, renewing?”. A lane can approve with conditions, and each condition becomes a tracked finding.

The contract notice date for Ledgerly was 4 November 2026, and it has passed. What that means depends on the contract: if it auto-renews, Northwind has probably committed to another term and its leverage is now the relationship and any audit or termination rights. The companion post on renewal decisions covers that case; the lesson for evidence is that the documents should have been chased before the notice date, not after it.

Bridge letters and what to request

A bridge letter, or gap letter, is a short statement from the service organisation’s management — not the auditor — covering the time between the end of the last audited period and a recent date. It says, in effect, that there have been no material changes to the controls described in the report, or lists the ones there have been. It is weaker than an audit, because nobody independent has tested it, but it is the accepted way to cover the gap until the next report is issued.

For Ledgerly, the request to the vendor should cover both the gap and the acquisition:

Request	Why
The most recent SOC 1 Type II report, or the expected issue date of the next one	Restores independent assurance for the controls Northwind relies on
A bridge letter from the end of the last audited period to a recent date	Covers the gap with management’s statement until the next report
Any material control changes since the period ended, named specifically	A bridge letter that lists changes is more useful than one that says none
What the Harbour Capital acquisition changes: systems, hosting, staff, auditor, report timing	Change of control is when controls are most likely to move
Confirmation of any new subservice organisations	New owners often consolidate providers; these become fourth parties
Updated insurance certificate if the policy holder changed	Coverage may have moved to the new parent

The request can go as a targeted questionnaire through the vendor portal, by signed link with no account to create. The invitation is held in the outbox until someone in procurement releases it. When the documents come back, the Document agent reads them like the original: type, period, auditor, opinion, exceptions, CUECs and subservice organisations, with the page for each. If a bridge letter covers the gap, it is cited as the reason the vendor is current again.

From the lapsed date to restored assurance.

Keeping evidence current as a habit

The Ledgerly case is one vendor; the habit is what matters across eighty or eight hundred. A few settings make it routine:

What it adds up to

For the vendor-risk lead, a lapsed report becomes a finding on the day it lapses rather than a surprise at audit time. For finance, the renewal goes ahead with a clear list of what Ledgerly owes Northwind. For the board, the claim is simple and checkable: the evidence behind every important vendor is current, or there is a named person chasing it.

Keep reading