Short answer: A SOC 2 examination is not graded pass or fail. The auditor issues an opinion on your report: unqualified (clean), qualified, adverse or disclaimer. A qualified opinion means the auditor found one or more issues serious enough that part of your system description or controls did not meet the criteria. It is a setback, not the end of the road.
Few moments in a compliance project are as stressful as hearing that the auditor found exceptions. Teams search for answers like “did we fail?” and “will customers still accept our report?” The honest answer to both depends on what the exceptions were, how widespread they were and how you respond.
This guide explains what each opinion type means, how exceptions differ from a qualified opinion, how buyers usually react, and a practical plan for recovering.
Can you fail a SOC 2 audit?
Not in the sense of receiving a failing grade. A SOC 2 report is an attestation by an independent CPA firm. The auditor tests your controls, records what they found and expresses an opinion. There is no pass mark. What you can receive is an opinion that tells readers your report contains significant problems.
Before that point, an unprepared company may also see the engagement paused or postponed. If the auditor concludes during fieldwork that controls are too immature to test meaningfully, they can ask you to remediate and return rather than issue a heavily qualified report. That is one reason a SOC 2 readiness assessment before fieldwork is worth the effort.
The four SOC 2 opinion types
| Opinion | What it means | How buyers read it |
|---|---|---|
| Unqualified | The description is fairly presented and the controls were suitably designed and, for Type II, operated effectively. Often called a clean opinion. | The outcome they want to see. Exceptions may still appear in the test results. |
| Qualified | The report is acceptable except for specific matters, such as a criterion not met or a control that failed. | Read closely. Acceptability depends on which criteria are affected. |
| Adverse | The issues are material and pervasive. The description or controls do not meet the criteria overall. | Usually unacceptable for vendor approval. |
| Disclaimer | The auditor could not obtain enough evidence to form an opinion. | Treated as no usable report. |
Exceptions and qualified opinions are not the same thing
An exception is a deviation the auditor notes when testing a control. For example, a sample of 25 new hires shows that two did not complete security training on time. The exception appears in the test results section of the report, along with the auditor’s description of what went wrong.
A report can have exceptions and still carry an unqualified opinion. The auditor considers whether the exception means the related criterion was not met. If one missed training is an isolated lapse and other controls compensate, the opinion may stay clean. If a control failed in so many instances that the criterion was not achieved, the opinion becomes qualified.
Three common sources of exceptions
- Design deficiency. The control as written would not achieve its purpose, for example a backup process with no restore testing.
- Operating deficiency. The control is well designed but was not performed as intended, such as access reviews that were skipped in a quarter.
- Description issues. The system description omits or misstates something, often after a system change that nobody updated.
What causes qualified opinions
Most trace back to a short list of patterns. Our article on common SOC 2 audit mistakes covers many of them, and the shorter piece on why companies struggle in SOC 2 audits adds more. The recurring culprits are:
- Controls that exist on paper but were not run consistently across the period.
- Missing or late evidence, so the auditor cannot confirm the control operated.
- Access and offboarding gaps, such as former staff retaining access.
- Change management done informally, with no approval trail.
- Vendor reviews that were never completed.
- Incident response plans that were never tested.
How buyers react
Reactions vary, and it helps to know the range:
- Some accept it with an explanation. A narrow qualification on a criterion they do not rely on may not block the deal.
- Some request a remediation plan. They want to see what you fixed and when the next report will show it.
- Some will not proceed. Strict vendor risk policies can require an unqualified opinion.
What does the most damage is not the issue itself but surprise. A customer who learns about an exception from the report, rather than from you, trusts you less. Our guide on how customers evaluate SOC 2 explains what reviewers look for.
What to do if you receive a qualified opinion
- Read the findings carefully. Identify which criteria and controls were affected, how many samples failed, and over what part of the period.
- Find the root cause. Ask why the control failed. A skipped review might reflect an owner who left, a missing reminder or an unclear process.
- Agree what is reportable. You can discuss factual accuracy with your auditor, but you cannot negotiate away an exception that the evidence supports.
- Write a management response. Many reports include a section where management provides additional information. Use it to state what happened, the risk, any compensating controls and your corrective action.
- Brief affected customers. Tell your key accounts before they read it, with the remediation plan in hand.
- Fix the control and start collecting clean evidence. A fix made after the exception does not remove it from that period’s report. It shows up as improvement in the next period.
- Plan the next examination. Schedule a new period promptly so the clean evidence can be tested. The guide to the SOC 2 observation period helps you pick its length.
A short example of a management response
During the period, two of 25 sampled new hires did not complete security awareness training within 30 days. Management identified that training reminders were not triggered for contractors. We corrected the onboarding workflow, enrolled both individuals, and added an automated reminder and a monthly review. The control has operated without exceptions since the correction date.
How to avoid exceptions in the first place
- Test yourself before the auditor does. Run an internal check of key controls a few months before the period ends. A SOC 2 gap analysis catches design problems early.
- Assign a named owner for each recurring control. Shared responsibility usually means no responsibility.
- Automate reminders and evidence capture. Reviews tied to a ticket or calendar rarely get missed.
- Update the system description with each change. A migration or new vendor should trigger a description review.
- Monitor continuously. The practice described in continuous compliance surfaces drift while it can still be fixed.
Business implications
A qualified opinion can delay a sales cycle by a quarter or more because you must remediate, re-run a period and wait for a new report. It can also make you more credible if you handle it transparently. Companies that explain the cause, show the fix and return with a clean report often keep the customer. If you want help planning the recovery, SOC2.in offers SOC 2 Type I and Type II audit support.
For the standards context, see the AICPA’s page on the SOC suite of services.
A monthly control health check to prevent exceptions
Most exceptions are not dramatic failures. They are small lapses that nobody noticed in time: a missed quarterly review, a terminated contractor whose account lingered, a change merged without the required approval. A short monthly check catches these while they are still fixable.
| Check | What to look at | Owner |
|---|---|---|
| Access removals | Every departure this month has a closed offboarding ticket and no active accounts | IT / HR |
| Change approvals | Sample merged changes for review and approval records | Engineering |
| Scheduled reviews | Access, vendor and policy reviews due this quarter are on track | Compliance lead |
| Security alerts | Alerts have tickets showing triage and closure | Security |
| Backups and scans | Jobs ran and failures were followed up | DevOps |
| Training | New hires completed required training on time | HR |
Writing a strong management response
If an exception does appear in the report, the management response matters. Keep it factual: what happened, what the cause was, what you changed and the date the fix took effect. Avoid defensive language or blaming individuals. Buyers read these responses closely, and a clear, specific one often reassures them more than a clean report that says nothing. For related context, read how customers evaluate SOC 2 reports.
Frequently asked questions
What is a qualified opinion in a SOC 2 report?
It is an auditor’s opinion that the report is acceptable except for specific matters, usually a criterion that was not met or a control that did not operate effectively.
Is a qualified SOC 2 report a failed audit?
SOC 2 has no pass or fail result. A qualified opinion is a negative finding on part of the report, and its impact depends on which areas are affected and how buyers react.
What is the difference between an exception and a qualified opinion?
An exception is a deviation noted when testing a control. A qualified opinion is reached when exceptions or other issues mean a criterion was not met. A report can contain exceptions and still have a clean opinion.
Can you fix an exception after the audit period?
You can fix the control, but the exception stays in that period’s report. The improvement can then be tested in the next period.
Will customers accept a SOC 2 report with exceptions?
Many will if the exceptions are minor, explained and paired with a remediation plan. Others require a clean opinion. Ask each customer for their policy.
What is an adverse or disclaimer opinion?
An adverse opinion means problems are material and pervasive. A disclaimer means the auditor could not gather enough evidence to give an opinion. Both are typically unusable for vendor approval.
Conclusion
A qualified SOC 2 opinion is a serious result, but not a final one. Understand exactly which criteria were affected, find the root cause, communicate with customers before they discover it, and use the next period to show clean operation. Preparation and continuous monitoring are what keep the next report clean.
