SOC 2 Exceptions vs. Qualified Opinion: What They Mean and How to Respond

A SOC 2 exception is a deviation found when the auditor tests a control, for example one terminated employee whose access was not removed on time. A qualified opinion is the auditor's overall conclusion that the description, design, or operating effectiveness is fairly stated in all material respects, except for a specific matter that is material but not pervasive. Exceptions are findings. The opinion is the verdict. A report can have several exceptions and a clean opinion, and understanding SOC 2 exceptions vs. qualified opinion language matters to every buyer who reads it.

This guide explains the difference, how auditors decide when exceptions lead to a qualified opinion, how buyers react to each, and how to write a management response and customer communication that keeps deals moving.

What is a SOC 2 exception?

A SOC 2 exception, also called a deviation, is a documented instance where a control did not operate as described during the auditor's testing. In a SOC 2 Type 2 report, exceptions appear in the description of tests of controls and results, usually Section 4, next to the control that was tested.

A typical exception entry reads something like this:

Exception noted. For 1 of 25 terminated employees sampled, logical access to the production environment was not revoked within the timeframe defined in the access management policy.

Exceptions come in a few forms:

One thing that is not an exception: a control that had no occurrences during the period. If no security incidents occurred, the auditor cannot test incident response operation, and the report will usually say the control did not operate during the period. That is not a failure, though buyers may ask about it.

What is a qualified opinion in a SOC 2 report?

A qualified opinion in a SOC 2 report is a modified opinion in which the service auditor concludes that the subject matter is fairly presented in all material respects, except for the effects of a specific matter described in a "Basis for Qualified Opinion" paragraph. The matter is material, but its effects are not pervasive across the report.

SOC 2 examinations are performed under the AICPA's attestation standards, primarily AT-C Section 205. Under those standards, a service auditor issues a modified opinion when the subject matter is materially misstated, or when the auditor cannot obtain sufficient appropriate evidence. There are three types of modified opinion, plus the clean opinion:

A qualified opinion can relate to a specific part of the opinion. For example, an auditor might qualify only the operating effectiveness conclusion for the criteria affected by a control failure, while the description and design conclusions remain unmodified.

How do auditors decide whether exceptions lead to a qualified opinion?

Auditors decide whether exceptions lead to a qualified opinion by evaluating whether, after considering all exceptions affecting a criterion, the controls still provide reasonable assurance that the service organization's commitments and system requirements were achieved for that criterion. The question is never "how many exceptions are there?" It is "was this criterion met?"

The factors auditors weigh include:

• Deviation rate versus the sample. One exception in a sample of 25 for a frequently operating control is evaluated differently from one exception in a sample of 2 for a quarterly control. Our guide to SOC 2 sample sizes explains how sample size affects tolerable deviations.
• Nature and cause. An isolated human error is different from a systemic breakdown. A missed approval because the approver was on leave differs from an approval step nobody follows.
• Other controls addressing the same criterion. Most criteria are met by several controls. If other controls mitigated the risk, the criterion may still be met. For example, a late access revocation may be mitigated if the account was disabled through single sign-on and logs show no activity after the termination date.
• Aggregation. Several exceptions that each look small can, together, mean a criterion was not met.
• Pervasiveness. If a failure affects many criteria or the system as a whole, the auditor considers an adverse opinion rather than a qualified one.

Three illustrative scenarios

The scenarios below are simplified illustrations of how the same kind of finding can lead to different outcomes. Real conclusions depend on the full facts and the auditor's judgment.

Scenario 1: Isolated exception, clean opinion. An auditor samples 25 terminated employees and finds one whose production access was removed late. Single sign-on was disabled on the termination date, which prevented login, and logs show no activity. Other access controls for the same criterion operated without exception. The auditor reports the exception in Section 4 but concludes the criterion was met. The opinion is unmodified.

Scenario 2: Systemic exception, qualified opinion. An auditor samples four quarterly access reviews and finds that two were never performed and a third was signed off without evidence that anyone reviewed the user list. No other control addresses whether access remains appropriate over time. The auditor concludes that the related criterion was not met for the period. Because the failure is limited to that criterion and does not undermine the system as a whole, the auditor issues a qualified opinion on operating effectiveness for the affected criterion.

Scenario 3: Evidence gap, qualified opinion or disclaimer. The service organization cannot produce change management records for three months of a twelve-month period because of a ticketing system migration. The auditor cannot obtain sufficient evidence for change management during that time. If the effect is material but confined to change management, a qualified opinion may result. If missing evidence affected many criteria, the auditor could disclaim an opinion.

The lesson from these scenarios is that the opinion depends less on how many exceptions there are and more on whether each affected criterion was still met.

This is why two reports with the same number of exceptions can carry different opinions. One may list five exceptions across five different criteria, each mitigated by other controls, and carry a clean opinion. Another may list a single exception in a key control with no mitigation and carry a qualified opinion.

SOC 2 exceptions vs. qualified opinion: side-by-side comparison

Can you fail a SOC 2 audit?

You cannot technically fail a SOC 2 audit, because a SOC 2 examination produces an opinion rather than a pass or fail grade (Cloud Security Alliance). In practice, however, an adverse opinion or a disclaimer of opinion functions as a failure from a buyer's perspective, because neither provides assurance a buyer can rely on. A qualified opinion is not a failure, but it requires explanation. If your report came back adverse or disclaimed, see what happens if you fail a SOC 2 audit.

The more common problem is that teams and buyers treat any exception as a failure. That reaction is understandable, since "exception noted" sounds bad. But exceptions are a sign that the auditor tested real samples and reported what they found. A large Type 2 report with zero exceptions anywhere can actually prompt more questions from experienced reviewers, not fewer.

How do enterprise buyers react to SOC 2 exceptions?

Enterprise buyers react to SOC 2 exceptions by evaluating whether each exception affects the services they use and whether the vendor has addressed it. Most mature vendor risk programs accept explained exceptions as normal. Their reaction to a qualified opinion is stronger: a qualified opinion is not automatically disqualifying, but in many programs it requires escalation and a written vendor response before onboarding or renewal can proceed.

A typical buyer review follows this order:

1. Read the opinion in Section 1. Clean, qualified, adverse, or disclaimer?
2. Check the scope and period. Does the report cover the services and period they rely on? Any carved-out subservice organizations?
3. Read the exceptions in Section 4 and map them to the risks that matter for their use case.
4. Read the management responses, if any, usually in Section 5.
5. Check complementary user entity controls to understand what they need to do themselves. See our guide to CUECs.
6. Decide: accept, accept with conditions, or escalate.

Deals slow down when step 3 happens without step 4. If a buyer finds an exception with no explanation, procurement escalates, someone schedules a call, and the deal waits. If the buyer finds an exception with a clear management response and a cover note from the vendor, the review often moves on.

Where do management responses to SOC 2 exceptions appear?

Management responses to SOC 2 exceptions usually appear in a separate section of the report titled something like "Other Information Provided by the Service Organization," commonly Section 5. The service auditor does not audit this information and does not express an opinion on it, and the auditor's report typically says so.

Two points follow from that:

• Management writes the response, not the auditor. The auditor must remain independent and cannot draft management's statements. The auditor reads the other information for material inconsistencies with the report, but the words are yours.
• Readers know it is unaudited. A response that overclaims ("this has been fully remediated and will never recur") does not gain credibility by being in the report. It loses credibility.

How to write a management response to a SOC 2 exception

Write a management response to a SOC 2 exception by acknowledging the finding factually, explaining the root cause, describing your assessment of impact, stating what you have done or will do with dates, and noting any other controls that reduced the risk. Keep it short. Most strong responses are four to six sentences.

Use this structure:

1. Acknowledge. Restate the exception plainly, without minimizing it.
2. Root cause. One sentence on why it happened.
3. Impact assessment. What you checked to determine whether the gap was exploited or caused harm.
4. Mitigating controls. Other controls that reduced the risk during the period, if any. Only include them if they genuinely operated.
5. Remediation. What changed, and when. Use dates.

Weak response:

Management has addressed this issue and it is no longer a concern. Our controls are operating effectively.

This says nothing, claims operating effectiveness management cannot assert for an untested period, and invites follow-up questions.

Strong response:

Management acknowledges that for one of 25 terminated employees sampled, production access was revoked eight business days after termination rather than within the one business day required by policy. The delay occurred because the termination was processed outside the standard HR workflow, so no offboarding ticket was created. Management reviewed access logs for the account and found no activity after the termination date; the employee's single sign-on account had been disabled on the termination date, which prevented authentication to production. In [month, year], management configured the HR system to create offboarding tickets automatically for all terminations, including those processed outside the standard workflow.

How to explain SOC 2 exceptions to a customer's security team

Explain SOC 2 exceptions to a customer's security team by telling them before they find them. Send a short cover note with the report that lists each exception, summarizes the response, and offers a call. This takes the surprise out of the review and shows the maturity buyers are actually looking for.

A cover note paragraph might read:

Our SOC 2 Type 2 report for the period [start] to [end] carries an unmodified opinion. The report notes two exceptions, both described with management's responses in Section 5. The first relates to timeliness of access revocation for one terminated employee; we confirmed no access occurred after termination and have automated offboarding ticket creation. The second relates to one late quarterly access review, which was completed [X] days after the due date. We are happy to walk your team through either item.

Rules for these conversations:

• Do not sound defensive. Exceptions are normal. Treat them as information, not accusations.
• Do not overpromise. Say what you changed, not that it can never happen again.
• Do not reinterpret the auditor. Do not say the auditor "agreed it was minor" or "didn't consider it important." The report says what the auditor concluded.
• Do offer evidence. If you have post-period evidence that the fix is working, offer to share it under NDA.
• Do not go quiet. Silence is what damages the relationship, not the exception itself.

If your report carries a qualified opinion, the same principles apply with more weight. Expect the buyer to ask for a written response covering the qualified matter, its impact on the services they use, remediation status, and when your next report period will show the fix. Answer each of those directly.

How to prevent the same SOC 2 exceptions next year

You prevent repeat SOC 2 exceptions by fixing the root cause, not the instance, and by monitoring the control during the next period rather than discovering the result at fieldwork. Repeat exceptions are what buyers react to most, because they suggest the remediation did not work.

The controls that most often produce exceptions share a pattern: they depend on someone remembering to do something on time. Common examples include:

• Offboarding. Access not revoked within the policy timeframe.
• Access reviews. Reviews completed late, missing systems, or signed off without evidence of actual review.
• Change management. Changes deployed without documented approval, or emergency changes not reviewed after the fact.
• Onboarding. Security training or background checks completed late or not documented.
• Vulnerability management. Critical vulnerabilities not remediated within the policy service level.

For each, ask whether the control can be automated, whether someone is checking it monthly during the period, and whether the policy timeframe matches what your team can realistically achieve. A policy that promises one business day for something that routinely takes three is an exception generator.

What if my report already came back with exceptions or a qualified opinion?

If your report already came back with exceptions or a qualified opinion, the priority is to communicate clearly with customers, fix root causes quickly, and make sure the next period produces evidence that the fixes work. You cannot change the current report, but you control what the next one says.

Ledger Audits' Evidence Engine is a monthly retainer that monitors operating effectiveness across the full audit window, keeps an evidence repository with chain of custody, runs a mock fieldwork dry run before your auditor arrives, and liaises directly with your auditor. For companies dealing with a difficult report now, our audit rescue support helps prepare customer communication and a remediation plan that holds up in the next period. Talk to us about audit rescue.

Related reading

• How to Verify a SOC 2 Report: An 8-Point Auditor's Check
• SOC 2 Sample Sizes: What Your Auditor Will Actually Pull
• Complementary User Entity Controls: What DC Section 200 Actually Requires
• How to Choose a SOC 2 Auditor: 12 Checks Before You Sign

Frequently asked questions

What is the difference between a SOC 2 exception and a qualified opinion?

A SOC 2 exception is an individual test result showing a control did not operate as described in a specific sample. A qualified opinion is the auditor's overall conclusion that the report's subject matter is fairly stated except for a specific material, but not pervasive, matter. Exceptions appear in the test results; the opinion appears in the auditor's report. A report can have exceptions and still carry a clean opinion.

Can a SOC 2 report have exceptions and a clean opinion?

Yes. A SOC 2 report can list exceptions and still carry an unmodified (clean) opinion when the auditor concludes that, despite the exceptions, the controls provided reasonable assurance that the relevant criteria were met. This is common, especially when exceptions are isolated or mitigated by other controls.

Is a qualified SOC 2 opinion bad?

A qualified SOC 2 opinion is a significant finding but not automatically disqualifying. It means a material matter affected part of the report. Many buyers will escalate the review and require a written vendor response explaining the matter, its impact, and remediation before proceeding. An adverse opinion or a disclaimer is more serious, because neither provides assurance a buyer can rely on.

Can you fail a SOC 2 audit?

There is no pass or fail grade in a SOC 2 examination. The auditor issues an opinion: unmodified, qualified, adverse, or disclaimer. In practice, an adverse opinion or disclaimer functions as a failure for buyers, while a qualified opinion requires explanation.

Where are management responses in a SOC 2 report?

Management responses to exceptions usually appear in a section titled "Other Information Provided by the Service Organization," commonly Section 5. The auditor does not audit this section or express an opinion on it.

Who writes the management response to SOC 2 exceptions?

Management writes the response. The service auditor must remain independent and does not draft management's statements, though the auditor reads the other information for material inconsistencies with the rest of the report.

How many exceptions are acceptable in a SOC 2 report?

There is no acceptable number. Buyers and auditors look at what the exceptions are, which criteria they affect, whether other controls mitigated the risk, and whether the exceptions repeat from prior years. One unmitigated exception in a key access control can matter more than several minor timing exceptions.

How do I explain SOC 2 exceptions to a customer?

Send a short cover note with your report that lists each exception, summarizes the root cause and remediation, and offers a call. Be factual, avoid defensive language, do not overstate what remediation achieves, and offer evidence of the fix if available.

---