SOC 2 exceptions and qualified opinions: what they mean, how to respond and how to avoid them

What a SOC 2 exception is, and why only a Type 2 has them

In a Type 2 examination the CPA firm tests whether each control in your description operated effectively across the whole examination period. It samples occurrences of each control, such as leavers or production changes, and records a deviation when a sampled item fails. Reports usually call these exceptions; the two words are interchangeable in practice.

A Type 1 report covers design as at a single date, so it has no tests of operating effectiveness and no list of deviations.

Most exceptions are operating deviations: a well-designed control that, on a particular occasion, did not happen. Less often the control was not designed to meet the criterion, or the description does not match what actually runs, which is why the system description guide urges you to describe the system you have.

Where exceptions appear in the report

A Type 2 report normally runs in four or five parts: the service auditor's opinion, management's assertion, the system description, the controls with the tests performed and their results, and often a final part for other information from the service organisation. Numbering varies, but tests and results are commonly the fourth.

That is where exceptions sit. Beside the control that failed, the result column states what was found, often with the count of failures against the number of items tested, for example that two of the sampled leavers kept access beyond the policy timeframe. Management's response sits beneath the exception or in the other-information part, and the CPA firm expresses no opinion on it. A reader therefore sees two voices: the examiner's factual result, and your explanation of it.

How samples are drawn and exceptions raised during fieldwork is covered in our guide to the SOC 2 examination.

From exceptions to the opinion: unqualified, qualified, adverse, disclaimer

There is no pass or fail in SOC 2. The CPA firm gives an opinion on whether the description is fairly presented and the controls were suitably designed and operated effectively to achieve your service commitments and system requirements under the criteria in scope. Exceptions feed that judgement; they do not decide it alone.

The test the firm applies is whether, taking the deviations together and considering any other controls that address the same risk, the relevant criterion was still met. An isolated late access removal, with a quarterly access review that caught it and no evidence of misuse, usually leaves the criterion intact; the report lists the exception and the opinion stays unqualified. Repeated failures of a key control with nothing else covering the risk can mean the criterion was not met, and the firm then qualifies its opinion for that criterion or those criteria.

An adverse opinion says the controls as a whole did not achieve the criteria. A disclaimer says the firm could not reach any conclusion at all.

Typical exceptions, and what a proper fix looks like

The same few exceptions recur across very different organisations, usually from controls that depend on someone remembering a scheduled task, or processes that break on unusual cases.

Our guide to the ten common mistakes that produce exceptions takes these patterns further, including the design choices behind them.

How to write management's response

Security reviewers often read the response more closely than the opinion. A good one does four things briefly.

• States the cause. Say why the control failed on those occasions, specifically: a contractor leaver was not routed through the HR system, not "a process gap".
• Assesses the impact. Say what you checked and what you found, for example that access logs for the affected accounts showed no activity after the leaving date, and whether another control would have caught the problem.
• Describes the remediation and its date. Separate what was corrected for the individual items from what was changed in the control, and give the month the change took effect.
• Stays factual. Do not dispute the result or claim a fix that has not yet operated; the next report will test what you wrote.

Agree the wording with the CPA firm at the draft-report stage; it will not endorse the response, but it will object to statements that contradict its findings. A response that reads like marketing weakens the report.

Correction versus a lasting fix before the next period

An exception in one report is understandable; the same one in consecutive reports tells a customer that management treated the symptom. A correction deals with the items found: the access is removed, the change is reviewed. A lasting fix removes the cause, so the control operates correctly without relying on someone's memory, and it must be in place early enough to operate through most of the next examination period.

Confirm the root cause while the evidence is fresh, redesign the control where the cause is structural, update the policy and description, and test the new control internally soon after go-live. Keeping evidence flowing between examinations is the subject of our continuous monitoring guide.

How customers read your exceptions

Experienced reviewers do not expect a report without exceptions; they expect ones that are minor, explained and not repeated. They check whether an exception touches a control protecting their data, the failure rate against the sample, and whether remediation took effect within the period. A qualified opinion usually brings a questionnaire or a request for evidence that the fix has operated. The customer's side of this, including complementary user entity controls, is set out in how to read a SOC 2 report.

SOC 2 exceptions: questions buyers ask