SOC 2 exceptions and qualified opinions: what happens

Updated 25 October 2026

An exception is one test result: a control the CPA firm tested and found not designed properly, or not operating as described. A qualified opinion is the firm's overall conclusion on the whole report. They are not the same thing, and one exception does not by itself qualify an opinion. SOC 2 has no pass or fail result, so a report with exceptions is still a report. Its sources agree that the number and severity of the exceptions decide what the opinion says. This guide separates the two ideas, lists the exceptions that come up most and the recurring records that prevent them, and covers what to do if the opinion is qualified.

An exception is a test result; the opinion is the conclusion

During the examination the CPA firm tests your controls against the criteria. Each control gets a result in the report. When a test finds a deviation, the report lists it as an exception. Scrut describes it as a documented control gap inside the report, not a verdict on your whole program (Scrut). Sensiba describes exceptions as instances where a company's practices do not fully meet the criteria or controls, and notes you receive a report regardless of the findings raised during the audit (Sensiba).

The opinion is a separate paragraph written after the firm weighs all the results. Secureframe says the number and severity of exceptions affect it (Secureframe). Scrut adds that a single isolated exception rarely changes the opinion, while a pattern across one criterion can. Its example: one failing control under CC6.1 is an exception, but if every control under that criterion fails, the result is a qualification (Scrut). For the wider question of what a SOC 2 report is, and how to describe it, see is SOC 2 a certification?

The four opinions in plain terms

A report can carry one of four opinions: unqualified, qualified, adverse or disclaimer. The certification guide gives the short version. Here is the detail, with where the sources differ.

• Unqualified. Scytale calls it the best outcome: the auditor is satisfied the controls are designed properly and operating effectively. It adds that isolated failures can still fall under an unqualified opinion where other controls mitigate them (Scytale). Sensiba describes the same opinion as controls suitably designed and operating effectively with no significant exceptions or deficiencies in the period (Sensiba).
• Qualified. The controls work except for specific problems. Sensiba describes the issues as limited in scope, not affecting the control environment pervasively, and calls it unusual (Sensiba). Scytale describes it as at least one control not designed properly or not operating effectively, and says qualified opinions are more common than many expect (Scytale). The two sources disagree on how common it is, so do not quote a frequency. Scytale reads it as the criteria not having been achieved, while Sensiba describes controls that are effective except for specific issues: the same facts, framed differently. Check the wording in the report itself.
• Adverse. Scytale describes it as the worst outcome, tied to fundamental deficiencies in the control environment, and as unusual.
• Disclaimer. The auditor is unable to express an opinion, usually because evidence was insufficient or the scope was limited in a pervasive way (Scytale).

Sensiba says unqualified and qualified are the most common of the four for SOC 1 and SOC 2 reports. None of the sources publishes a count of exceptions that triggers a qualified opinion, and each CPA firm applies its own judgment under the professional standards.

Exceptions an unqualified report can still list

A report can carry exceptions and an unqualified opinion together. Sensiba says minor exceptions are common, especially in a first Type II examination, and unlikely to affect the overall opinion if the control environment is strong (Sensiba). The reader of the report sees the exception in the test results and the opinion above it. That is why a reviewer reads past the opinion paragraph: the observation period is the window in which the controls have to operate, and every recurring control is a chance for a missed instance to land in the test results.

Common exceptions and the recurring control behind each

Scrut sorts exceptions into three types: a design deficiency, a system description misstatement and an operating effectiveness deficiency. Secureframe lists the same three (Secureframe). The scenarios below are the illustrations in Scrut's article, which it labels as illustrative. They are not statistics about how often anything happens (Scrut). The right-hand column is the record a team can keep to show the control ran.

Scrut lists causes behind these: missing documentation, controls built for an earlier state of the system, inconsistent execution of recurring controls, vendor failures that pass through, changes made mid-period and insufficient staff training (Scrut). Most are habits, not one-off mistakes, which is why the fix is a recurring record and not a one-time cleanup. A control that depends on someone remembering will drift.

How findings surface, and what a management response can do

Sensiba says its firm notifies clients of exceptions when it discovers them, which it calls a "no surprises" approach, so both sides can look at remediation early (Sensiba). That describes one CPA firm. Ask yours how and when it tells you, and whether a finding raised in fieldwork can be corrected before the period closes. The auditor interview prep page lists the questions auditors put to you in the walkthrough.

The report can also carry management's response. Scrut says management comments in Section 5 of the report can explain causes and fixes but do not change the opinion (Scrut). Write the response as facts: what happened, how many instances, what changed, and the date the corrected control began operating. Do not argue with the test result in it.

How to reduce the chance

The sources give similar advice, and it is mostly about keeping records. Secureframe lists accurate documentation and evidence, controls that fit their purpose, continuous monitoring of how controls operate, automation tools and expert help (Secureframe). Scrut adds automating recurring controls such as access reviews, scans and backup tests, and running quarterly internal rehearsals (Scrut). In practice:

• Write a calendar for every recurring control before the period starts, with an owner and a place where the evidence lands. The evidence checklist shows what to keep for each criterion.
• Match the system description to reality and re-read it when the stack changes.
• Rehearse the questions. The mock audit asks walkthrough questions from your own policies and says whether each answer matches them. It is practice, not an examination, and it cannot see your systems. It runs with an Audit Kit key ($59, one time) or an Agency key. The what auditors ask about policies guide covers the same ground for free.
• Do not write a policy you cannot run. A policy that promises a weekly review you do twice a quarter becomes the test criterion you miss.

Not the same thing as an approved policy exception

Two meanings of the word sit close together, and mixing them causes real confusion.

• An auditor's exception is a deviation the CPA firm found in testing. It goes in the report. You do not approve it; you respond to it.
• A policy exception is something your own company approves in advance: a documented, time-limited permission not to follow one policy requirement, with the reason and the compensating controls. The Policyseed policy exception register and request form records these, with an expiry date for each.

The two connect in one direction. A system without MFA that has no approved exception looks like a control that was not followed. The same system with an approved, unexpired exception and working compensating controls looks like a decision someone made and recorded. The register does not stop the auditor from recording an exception, and the firm decides how to treat a deviation your own policy permitted. What it does is show the deviation was known, approved by the right person and limited in time. Keep both lists, and do not call one by the other's name when you talk to the firm.

If you have a qualified report

Scytale describes a qualified opinion as an indication that you are on the right track with work still to do, and says it can still be valuable in the short term (Scytale). Practical steps:

1. Read the exception, not just the opinion. Find the control, the criterion, the period and the number of instances. A customer will ask the same questions.
2. Tell customers first. Scrut says silence is what damages the relationship, not the exception itself, and advises accepting the finding and showing its scope and impact with logs and timelines (Scrut). A short note with the facts and the date the control was corrected serves a security reviewer better than a delay. Share the report under NDA as you would any other.
3. Fix the root cause. Scrut's remediation steps are to identify the root cause, strengthen the control, re-run it with clear evidence and document the full path. Update the policy or procedure if it was the cause.
4. Plan the next period. The corrected control has to operate and leave a record through the next examination. Secureframe says an organization may need another audit once deviations are resolved (Secureframe), so ask the firm what it needs to see and from when. If the report has aged, a bridge letter can describe the time since the period ended, and it cannot cure an exception.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.