It follows exceptions serious enough that a criterion was not met, or a part of the scope the auditor could not test. The other opinions are unqualified, adverse and a disclaimer of opinion; most SOC 2 reports are unqualified.
Readers usually weigh the explanation of what happened and how it was fixed more heavily than the qualification itself.
Read more
Related terms
- Exception
- An exception is a deviation an auditor finds when testing a control, such as a skipped access review or a change deployed without the required approval.
- Management's assertion
- Management's assertion is the signed statement in a SOC report that the service organization's description and controls meet the criteria.
- Attestation engagement
- An attestation engagement is an engagement in which an independent practitioner reports on a subject matter, or on someone else's assertion about it.