A SOC 2 exception is a deviation the auditor found while testing a control, such as an access review that was skipped one quarter or a change deployed without the required approval. Exceptions are listed in the tests and results section of a Type 2 report and do not by themselves mean the report failed. The opinion is only modified when the exceptions are severe enough that a criterion was not met. Opinions come in four kinds: unqualified, qualified, adverse and a disclaimer. Most reports with a few exceptions still carry an unqualified opinion, and a clear management response explaining cause and remediation is what readers look for.
"We had exceptions" sounds like a failed audit. Usually it is not. Experienced readers of SOC 2 reports expect to see some exceptions, and what they judge is how serious they are, whether they point to a pattern and what the company did about them.
What counts as an exception
In a Type 2 examination the auditor tests each control by sampling occurrences across the review period. An exception, sometimes called a deviation, is any sample where the control did not operate as described. Typical examples:
- A leaver whose access was removed later than the policy requires.
- A quarterly access review that was not performed, or not documented, for one quarter.
- A production change merged without the required second review.
- A new hire who did not complete security training within the stated time.
- A backup restore test that was scheduled but not run.
Where exceptions appear in the report
The section that lists the criteria and controls shows, for each control, the test the auditor performed and the result. A clean control reads "no exceptions noted". An exception is described there, often with the number of samples that failed out of the number tested. Management can then add a response, in a section of the report the auditor does not opine on, explaining the cause and the remediation.
The four opinion types
| Opinion | What it means | When it is given |
|---|---|---|
| Unqualified | The description is fairly presented and the controls were suitably designed and, for a Type 2, operated effectively to meet the criteria | The usual outcome, including reports with isolated exceptions |
| Qualified | As unqualified, except for one or more specific matters described in the opinion | Exceptions serious enough that a criterion was not met, or a limited scope the auditor could not test |
| Adverse | The description is materially misstated or the controls did not meet the criteria | Pervasive failures |
| Disclaimer | The auditor does not express an opinion | The auditor could not obtain enough evidence to form one |
When exceptions lead to a qualified opinion
The auditor asks whether the criterion the control supports was still met. If other controls cover the same criterion, or the exception was isolated and caught, the criterion can still be met and the opinion stays unqualified. If the exception means nothing else addressed the criterion for part of the period, the opinion can be qualified for that criterion. This is why controls that run quarterly or annually are risky: with only a few occurrences in the period, one miss can leave nothing to show the criterion was met.
Writing a management response
- State the facts plainly: what happened, how many samples, over what time.
- Explain the cause, such as a manual step that depended on one person.
- Describe the remediation and when it took effect.
- Say how you know it is fixed, such as an automated check or later samples that passed.
Avoiding exceptions in the first place
Most exceptions are not security failures but record-keeping ones: the control ran, or nearly ran, and nothing proves it. Evidence collected from the systems as controls run, and alerts when a scheduled control is missed, catch these during the period instead of in fieldwork. The SOC 2 evidence list sets out what each common control should leave behind.