SOC 2 exceptions and qualified opinions

You cannot fail a SOC 2, because it is not a test. You can collect exceptions, and enough of them in the wrong place produces a qualified opinion, which is survivable and expensive.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

A SOC 2 exception is a case where the auditor tested a control and it did not operate as described. Exceptions are written into the report along with your response, and most reports contain some. They only become a problem when they are numerous enough or serious enough that the auditor cannot say a criterion was met, at which point the opinion becomes qualified. A qualified opinion does not void the report and does not stop you selling, but every security reviewer who reads it will ask about it.

The four opinions an auditor can issue

The opinion wording comes from the AICPA attestation standards, not from anything SOC 2 specific. The four outcomes are the same four an accountant can issue on any attestation engagement, and the words material and pervasive are the hinge between them.

Unqualified

The controls were suitably designed and, in a Type 2, operated effectively throughout the period. This is what you are paying for. A report can be unqualified and still contain exceptions, as long as the exceptions did not prevent the criteria being met.

Qualified

Everything holds except for specific, identified matters, which the opinion names. In the language of the attestation standards the problem is material but not pervasive. This is the outcome companies encounter when something goes wrong.

Adverse

The problems are both material and pervasive, so the description as a whole is not fair. Rare, and generally a sign the engagement should never have proceeded to a Type 2.

Disclaimer of opinion

The auditor could not obtain enough evidence to form any opinion, usually because records did not exist. You paid for an engagement and received a document that says nothing. Rarer than adverse.

The exceptions Canadian companies actually collect

Nearly all first-year exceptions come from the same handful of controls, and they share a shape: a control that requires somebody to do something on a schedule, in a quarter when that person was busy.

Most of these are not security failures. They are documentation failures against a control you wrote yourself. Writing a control that says quarterly when you can only sustain semi-annual is a choice you make during readiness, and the readiness guide on SOC2Prep covers writing controls you can operate.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

What happens when the auditor finds one

1. The auditor raises it during fieldwork, usually the same week they test it. Nothing is written yet.
2. You provide context or additional evidence. Some exceptions evaporate here because the evidence existed and nobody had asked the right person.
3. If it stands, the exception is written into section four of the report with the population size, the number of failures, and the test performed.
4. You write a management response that goes into the report beside it. This is your only chance to frame the finding for every reader.
5. The partner decides whether the exceptions, taken together, prevent a criterion from being met. That decision produces the opinion.

The management response is the part you control

A weak response repeats the finding. A strong one names what changed, when it changed, and how the change is now evidenced. "Access reviews were missed in Q2 following the departure of the IT manager. The review is now assigned to the Director of Engineering, scheduled in the ticketing system, and Q3 and Q4 were completed on time." A reviewer reading that has their answer and moves on. Write these carefully. They are permanent and they get read.

What a qualified opinion does to a deal

It depends on which criterion was qualified. A qualification on a change management control at a company selling developer tooling is a conversation. A qualification on logical access at a company holding health records is a lost deal in a regulated buyer. Reviewers are not counting exceptions, they are asking whether the failure touches the risk they care about.

A qualified report that discloses a real problem and a real fix is more credible to an experienced reviewer than a spotless first-year report over a three month window. Some security teams read a first Type 2 with zero exceptions as evidence that the window was too short to catch anything. Do not chase a clean report by narrowing controls until they cannot fail. The reviewer reads the control list too.

Recovering from one

You do not reissue a SOC 2. The period is over and the report describes what happened. What you do instead is fix the control, run the next period cleanly, and in the meantime give buyers something to hold. That is usually a short remediation memo naming the finding, the change, the date it took effect and the evidence that now exists.

If the qualification is blocking revenue right now, a Type 1 dated after the remediation is the fastest credible artifact: a CPA firm can opine that the redesigned control is suitably designed. It says nothing about operation, so pair it with the remediation memo and a committed date for the next Type 2. The observation window page covers how to sequence that without leaving a coverage gap.

Can you discuss an exception before the report is drafted?

Yes, and that is the only time it helps. During fieldwork the auditor tells you about a potential exception as it is found. That is the moment to check whether the evidence exists and was sent under the wrong request, and to draft management's response while the facts are fresh. Once the draft report arrives, the finding is settled and only the wording of your response is still yours. Managing your SOC 2 auditor covers the conversation, including what you can and cannot ask an auditor to change.

Where to go from here

• How to read a SOC 2 report you received. Where the exceptions sit in the report and how to read around them.
• SOC 2 bridge letter. What a bridge letter covers between your report date and the buyer's question.
• SOC 2 renewal. How an exception in year one changes year two.
• Questions to ask a SOC 2 auditor. What to ask an auditor about how they handle a finding mid-fieldwork.
• What to do when a SOC 2 audit stalls. Recovering an audit that is waiting on evidence nobody has.

Common questions