You say "My concern is we don't have anything from the customer stating that it was okay to run the credit report that is dated by them for the date of the credit report."
Ask yourself: How would you have the SSN to pull their credit report unless they gave it to you? if they gave it to you, they most likely were applying for a loan.
It sounds like an internal policy requirement. As Randy stated, there is no regulatory requirement to have the customer sign anything before pulling their credit report. You simply need a permissible purpose.