What is an audit exception?

How exceptions are found

In a SOC 2 Type II audit, the auditor tests each control by selecting a sample from the period and checking the evidence. When an item in the sample shows the control did not run as described, the auditor records an exception against that test, with the details.

The causes are usually ordinary: a quarterly access review done weeks late, a joiner whose background check was not recorded before they started, a change released without the second approval the policy requires, or a missing training record.

• Operating exceptions. The control is well designed but was missed or done late on some occasions.
• Design problems. The control, as described, would not meet the criterion even if it always ran.
• Description errors. The system description says a control exists, or works a certain way, and it does not.

Exceptions and the auditor’s opinion

A SOC 2 report has no pass mark. The auditor decides whether the exceptions, taken together, mean a criterion was not met. If they do, the opinion is qualified, which is a far more serious result than a list of exceptions under an unmodified opinion.

Buyers read the exceptions closely. One late access review in a year draws less concern than repeated failures in the same control, or an exception in a control that matters to the buyer’s own risk.

Responding to an exception

When an auditor raises a possible exception, check the facts first: whether the evidence exists somewhere else, or whether the sample item was really in scope. If the exception stands, find the cause, fix it and record the corrective action with an owner and a date.

Management can include a written response in the report explaining the cause and what was done. The auditor does not give an opinion on that response, but readers look for it. In the next period, show that the fix held, because a repeated exception in the same control is much harder to explain.

Related terms

SOC 2 Type II

A SOC 2 report on whether controls operated effectively over an observation period. The report most enterprise buyers eventually ask for.

Attestation report

An independent auditor’s written opinion on whether an organisation’s controls are designed, and in a Type II report operating, as described. A SOC 2 report is an attestation, not a certificate.

Nonconformity

An ISO audit finding that a requirement is not met. A minor nonconformity needs a corrective action plan; a major one must be resolved before a certificate is issued.

CAPA

Corrective and preventive action: the plan, owner and due date attached to an audit finding or incident, tracked until the fix is confirmed and the cause addressed.

Evidence

Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.