Two words, except for, turn a clean SOC opinion into a qualified one.

Most SOC reports end with a clean opinion. When the auditor finds a problem that matters but does not spoil everything, the opinion says the system was fine except for that problem. That is a qualified opinion.

A buyer's security reviewer reads the opinion paragraph first. A qualified opinion is not a failure, but it tells the reader that something material went wrong and points them to it. Some buyers accept it with a remediation plan; others escalate it to their own risk team. For the company, the qualification usually traces back to one of three things: a control that stopped working for part of the period, a description that left out something important, or evidence the auditor was unable to obtain. Knowing which one caused it tells you what to fix before the next period. It also shapes the assertion: management may need to revise what it claims.

Section 1, the opinion paragraph

A separate basis paragraph explains the matter, and the opinion then uses except-for wording.

Section 4 test results

The deviations that led to the qualification are listed against the affected control.

Management's response

Many reports carry a short response from the company on what it has done about the exception.

A vendor review at a customer

A buyer's third-party risk team flags the qualification and asks for the remediation status.

Exception

An exception is a single test deviation. Many reports list exceptions and still carry an unmodified opinion; only material ones lead to a qualification.

Adverse opinion

Here the failings are so widespread that the system as a whole misses the criteria. With a qualified opinion the problem stays contained.

Disclaimer of opinion

A disclaimer means the auditor could not gather enough evidence to give any opinion at all.

• Read the basis paragraph to see whether the cause was the description, the design or the operation of a control.
• Fix the cause and keep evidence of the fix running well before the next period starts.
• Prepare a short note for customers explaining the matter and the remediation, in plain words.
• Review whether the management assertion needs to be revised before the report is issued.

• GuideOpinions & exceptionsThe path from one failed sample up to the opinion a report carries.
• GuideA scorecard for a vendor's SOC 2 reportTen checks that tell a useful report from a thin one.
• GuideSampling & deviationsPopulations first, how samples are picked, and what one miss means.

Sources: AICPA SSAE 18, AT-C section 205 (examination engagements, modified opinions) and AT-C section 320; AICPA SOC 2 guide.