The draft report arrives, and the testing section has a line that does not say "no exceptions noted". Someone asks whether the report is now qualified. A salesperson asks whether they can still send it to prospects.
An exception and a qualified opinion are different things. Most exceptions do not change the opinion. Some do. The difference depends on how the auditor judges the exception against the criteria, and knowing how that judgment works tells you what to do about it.
This article covers what an exception is, how auditors move from exceptions to an opinion, the four types of opinion, and how to respond as the organization being audited. It builds on how to read a SOC 2 report as a buyer, which covers where these appear in the report.
What an exception is
An exception is a test result that did not match the control as described. The auditor tested a control, usually on a sample, and found at least one item where the control did not operate as stated.
Say a hypothetical company's control states that access is removed within one business day of termination. The auditor samples leavers from the period and finds one whose access was removed a week late. That is an exception. The report will describe the control, the test, and the result, typically stating how many items were tested and how many deviated.
Exceptions also come from design. A control that could not meet its criterion even if it operated perfectly is a design deficiency. In a Type I report, design is all that is tested, so design issues are the main source of findings.
How auditors sample controls covers how the sample is chosen, which explains why one late removal in a sample is taken seriously: the auditor cannot assume the untested items were all fine.
How an exception becomes, or does not become, a modified opinion
The opinion is not about individual controls. It is about whether the description is fairly presented, and whether controls were suitably designed and operated effectively to provide reasonable assurance that your service commitments and system requirements were achieved, based on the criteria.
So the auditor asks a sequence of questions about each exception:
What caused it? A one-off human error and a systemic process failure carry different weight.
How extensive was it? One deviation in a sample is different from several, and the auditor may extend testing to find out.
Did other controls compensate? If a quarterly access review caught the late removal and the account was never used, the criterion may still have been met.
Was the criterion met? This is the deciding question. If, taking all relevant controls together, the criterion was still met, the opinion can be unmodified. The exception is still disclosed in the testing section.
If the answer to the last question is no for one or more criteria, the opinion is modified. Problems with the description itself, such as describing controls that did not exist, can also lead to a modified opinion.
The four types of opinion
SOC 2 examinations are performed under the AICPA's attestation standards, which provide for four kinds of opinion:
| Opinion | What it means | Common wording to look for |
|---|---|---|
| Unmodified | The description is fairly presented and controls were suitably designed and, for Type II, operated effectively | No "except for" or basis-for-modification paragraph |
| Qualified | The same conclusion, except for specific matters that are material but not pervasive | "Except for the matter described..." |
| Adverse | The matters are material and pervasive, so the conclusion is negative | "...because of the significance of the matters..." |
| Disclaimer | The auditor could not obtain enough evidence to form an opinion | "We do not express an opinion..." |
A qualified opinion is specific. It names the criteria affected and leaves the rest of the conclusion intact. A buyer can read it and decide whether the affected criteria matter to them.
Adverse opinions and disclaimers are much harder to recover from with buyers. A disclaimer often reflects missing evidence rather than failed controls, which is a separate kind of problem: the controls may have operated, but nobody can show it.
What exceptions do and do not say
For a buyer, an exception is information, not a verdict. Exceptions are a normal part of SOC 2 reporting. A report with none at all is not proof of a better program than a report with a few explained ones.
What matters is pattern and relevance. Several exceptions in the same area suggest a process that does not work. A single exception in a control central to your risk deserves a question. An exception in an area that does not affect your use of the vendor may need no action.
For the organization being audited, the lesson is the reverse. An exception is permanent for that period. You cannot fix the past, only show that you found the cause and changed the process. The next report is where improvement shows.
Responding when your report has exceptions
You will usually see exceptions before the report is final, often during fieldwork. Use that time.
Confirm the facts. Check the sample item yourself. Sometimes the evidence exists and was not provided. If so, provide it. If the exception stands, accept it and move on.
Find the root cause. A late access removal might trace to an HR system that did not notify IT, not to a careless admin. Fix the cause.
Write a management response. Many reports include one for each exception. State what happened, the cause, and what changed, with dates. Keep it factual. It is your statement, not the auditor's, and buyers read it that way.
Check the knock-on effects. An exception in one control may affect how the auditor views related controls or the description.
Prepare to talk about it. Sales and security teams should be able to explain each exception in a sentence. A buyer who hears a clear account before they find it in the report is usually reassured.
The year after
Expect your auditor to look closely at a remediated control in the next period. Fixing a process late in one period means the old and new versions may both be in scope. A repeat of the same exception in consecutive reports is much harder to explain to buyers than a first occurrence, because it suggests the response did not work. Track each remediation to completion, and keep the evidence that the new process ran.
Preventing the avoidable ones
A common source of avoidable exceptions is evidence rather than security. The control ran, but the record is missing, late, or incomplete. Three habits cut them down:
Write policies you can meet. If your policy says quarterly, every quarter is tested. Promise what you can deliver.
Capture evidence when the control runs, not when the auditor asks. Reconstructed evidence is weak evidence.
Monitor controls between audits, so a failure is found in weeks rather than at fieldwork.
The glossary entry for exceptions and the SOC 2 framework page cover the related terms.
How TrustLynce helps
TrustLynce's continuous monitoring checks controls between audits and routes failures to their owners, so a lapse is found and fixed during the period rather than discovered in sampling. The auditor portal keeps findings and your responses with the requests that produced them.