When to change your QSA - 5 warning signs before assessment

Updated: 8 September 2026

When is changing a Qualified Security Assessor justified? Changing your QSA is justified when the assessor has stopped functioning as a partner verifying real security and has begun functioning as a certificate issuer. The relationship with a QSA can feel difficult to change – the assessor knows your environment, holds the history of previous assessments, and switching means an onboarding period. But the cost of staying with a poor QSA for three to five years is higher: assessments that do not identify real problems, findings surfaced by an acquirer or an incident rather than the audit, an AOC challenged by an enterprise client, or – in the worst case – a data breach in an environment that passed assessment without genuine verification.

According to the Verizon Payment Security Report 2024, fewer than half of organisations maintain full PCI DSS compliance between assessments – which means an audit with zero findings in an environment of anything less than exceptional maturity should prompt questions, not satisfaction.

When to change your QSA – at a glance:

A QSA who produces zero or minimal findings year after year is not necessarily exceptional – they are more likely testing insufficiently deeply, particularly against requirements that became mandatory on 31 March 2025
Findings appearing only in the final report (rather than communicated during the assessment) eliminate the opportunity for remediation and extend the timeline to AOC – a good QSA communicates within 24 to 48 hours of discovery
A QSA who does not understand your technical environment (cloud-native, containerised, fintech) creates risk: genuine gaps may go undetected because the assessor does not know what to look for
Pricing increasing 20 to 30% annually without a change in scope or environmental complexity warrants a clear explanation
Changing QSA between certification cycles (after the AOC, before the next cycle begins) is operationally the simplest approach – the new QSA conducts an independent assessment without any obligation to validate the previous firm’s conclusions
Patronusec, as an accredited QSAC, conducts independent scope assessments for organisations considering a switch – mapping the CDE from scratch, without preconceptions carried over from prior assessments

What are the 5 warning signs that your QSA relationship needs to end?

Warning sign 1: Zero or minimal findings year after year

Two explanations exist: (a) the organisation has an exceptionally mature security programme – which a good QSA can verify and confirm with evidence, or (b) the QSA is not testing deeply enough. Industry data suggests option (b) is more common. PCI DSS v4.0.1 introduced requirements that became mandatory on 31 March 2025 – including 11.3.1.2 (authenticated internal vulnerability scans), 6.4.3 (payment-page script inventory and integrity controls), 3.5.1.1 (keyed cryptographic hashes). Organisations assessed for the first time under v4.0.1 should expect findings against these requirements unless prior preparation was thorough.

What to check: ask your QSA to explain specifically how they tested Requirements 11.3.1.2, 6.4.3, and 3.5.1.1 in the last assessment. If the answer is vague or non-specific, that is a warning sign.

Warning sign 2: Findings appear only in the final report

A professional QSA communicates findings within 24 to 48 hours of discovery, giving the client time to provide context, explanation, or begin remediation before the requirement is formally closed. A QSA who delivers a report with 15 findings three weeks after a five-day assessment eliminates the opportunity to respond – and turns what should be a dialogue into a crisis.

Warning sign 3: The QSA does not understand your technical environment

An assessment of a Kubernetes environment where the assessor asks “what is etcd?” A review of tokenisation where the assessor does not understand how PSP scope reduction works. An AWS audit where Security Groups are treated like physical firewalls. Misunderstanding the technical environment does not merely slow the assessment – it creates risk that genuine gaps will go undetected.

Warning sign 4: Pricing increases without explanation or change in scope

QSA fees rising modestly year on year is natural. An increase of 20 to 30% without a change in CDE scope, without increased environmental complexity, and without any explanation is a sign the relationship is being treated as a captive contract rather than a competitive one.

Warning sign 5: No support after the AOC is issued

Acquirers and enterprise clients ask questions after receiving an AOC. A good QSA answers standard questions about scope and methodology without additional billing. A QSA who disappears after issuing the report leaves you to answer questions that fall squarely within their domain.

Patronusec Insight: We regularly speak with organisations who have had “the same QSA for five years” but cannot describe what was specifically tested in the most recent assessment. They hold an AOC marked “compliant” but have no evidence that testing of Requirements 11.4.x (penetration testing) or 11.3.x (vulnerability scanning) was sufficiently thorough. A good assessment should leave you with genuine knowledge about your environment – not only a certificate. As part of a gap analysis engagement, we conduct an independent review of prior assessment documentation and identify what was tested, what may have been missed, and what the new mandatory requirements demand.

How do you change QSA between certification cycles without disruption?

Changing QSA after the AOC is issued, before the next cycle begins, is operationally the most straightforward approach. The new QSA is under no obligation to validate the conclusions of the previous firm.

Step 1: Timing
Ideal timing: 3 to 4 months before the planned start of the next assessment cycle. This allows 2 to 4 weeks for onboarding the new QSA and completing a scope assessment before Stage 1 begins.

Step 2: Gather historical documentation
Prepare: the most recent ROC or SAQ, network diagrams, scope definition, TPSP list with AOCs, and the system inventory for the CDE. The new QSA needs historical context but is not bound by previous findings.

Step 3: Independent scope assessment with the new QSA
A good QSA begins with an independent scope assessment – mapping the CDE, and reviewing the TPSP list. This is the moment when a new QSA may identify issues that the previous firm missed.

Step 4: Communication with your acquirer
You are not required to notify your acquirer of the QSA change before the assessment – notification occurs when the new AOC is issued under the new QSAC firm’s name. An acquirer cannot require a specific QSA firm, only an accredited QSAC from the PCI SSC list.

Step 5: Onboarding the new QSA
Provide access to: network architecture diagrams, previous scope definitions, the CDE system inventory, and the TPSP list with AOCs. For complex environments, allow 2 to 4 weeks for onboarding before scoping discussions begin.

Patronusec Insight: Stale obserwujemy, że podczas wcześniejszych audytów testy segmentacji sieci ograniczały się wyłącznie do weryfikacji dokumentacji – audytor (QSA) uznawał schemat sieci za wystarczający dowód, nie weryfikując technicznie, czy ruch między segmentami CDE a segmentami spoza CDE był faktycznie blokowany. Wymóg 11.4.45 standardu PCI DSS jest jednoznaczny: testy segmentacji muszą mieć charakter techniczny, a nie opierać się jedynie na dokumentacji. Przeprowadzając testy segmentacji, wykonujemy aktywne próby przejścia z segmentów spoza CDE do segmentów CDE, ponieważ tylko takie działanie dostarcza dowodów, które rzetelny audytor powinien uznać za wiarygodne. Szczegółowe informacje na temat naszego podejścia do testów penetracyjnych i testów segmentacji można uzyskać podczas bezpłatnej konsultacji wstępnej.

Considering a QSA change and want to know what a fresh assessment might find differently?

Patronusec conducts independent scope assessments for organisations considering a switch – mapping the CDE from scratch, and reviewing documentation without carrying forward preconceptions from prior assessments.

Book an independent scope assessment

Can a new QSA find issues the previous firm missed?

Yes – and this is one of the primary arguments for changing QSA when assessment quality is in question. Each QSAC firm has a different testing process, different areas of expertise, and slightly different interpretations of certain requirements.

What a new QSA may identify:

A CDE scope defined too narrowly by the previous firm (connected-to systems omitted)
Segmentation testing conducted purely on a documentary basis, without technical verification
TPSPs with expired AOCs that were “overlooked” in prior cycles
Requirements from v4.0.1 that the previous QSA treated as best practice recommendations but which became mandatory on 31 March 2025 (11.3.1.2, 6.4.3, 3.5.1.1)

How to approach new discoveries:
Findings from a new QSA are an opportunity to fix problems before an attacker or a regulator finds them. Treat them as the value a fresh perspective should deliver, not as an unwelcome surprise.

FAQ – When to change your QSA?

Can I change QSA mid-assessment cycle?

Technically yes, but operationally costly. The new QSA must issue a certificate based on their own testing. If the previous firm has completed Stage 1, the new QSA must decide whether to accept those results or conduct their own. Changing mid-assessment typically extends the timeline and increases cost. Changing after the current cycle concludes is strongly preferable.

Should I inform the outgoing QSA of the change?

Yes – notify the previous QSAC firm with appropriate notice (4 to 6 weeks is standard practice). Before ending the relationship, ensure you hold complete copies of all project documentation, including the ROC, evidence packages, and scope definitions.

Will the new QSA have access to reports from the previous firm?

Only if you share them. You may do so as historical context to accelerate onboarding. The new QSA will conduct their own independent assessment regardless of previous conclusions.

What if our acquirer prefers a specific QSA firm?

An acquirer cannot require a specific QSA firm – doing so would conflict with PCI SSC programme rules. They can require an accredited QSAC from the PCI SSC list, which is standard. If an acquirer is applying pressure to use a specific vendor, consulting PCI SSC directly or taking legal advice is the appropriate next step.

How does Patronusec approach onboarding clients who are changing QSA?

We begin with an independent scope assessment – mapping the CDE ourselves. We document any differences from the previous scope definition if we identify them. We do not validate the previous firm’s conclusions – we conduct a current, independent assessment of the environment as it exists today.

How much does a PCI DSS assessment with Patronusec cost?

Scope assessment and onboarding are included in the project cost – not charged separately. After a free 30-minute scoping call, we provide a fixed-price quotation for the full engagement (scope assessment plus assessment). For clients engaging us for both penetration testing and the PCI DSS assessment, we offer preferential combined pricing.

Changing your QSA – free scope-assessment call

Patronusec, as an accredited QSA, conducts independent assessments for organisations considering a switch – without preconceptions and without any obligation to validate previous conclusions.

In a free 30-minute consultation we will help you:

Discuss the warning signs suggesting a QSA change is warranted in your situation
Explain our independent scope assessment process and onboarding approach
Provide transparent pricing with a phase breakdown
Answer all 5 questions from this article’s warning signs in the context of your environment

Free scope-assessment call | PCI DSS certification | Gap analysis | Penetration testing | vCISO