Opinions & exceptions
From one failed sample to the auditor's verdict.
A SOC 2 report records findings at two heights. Low down, in the test tables, sit exceptions, also called deviations: single items that failed a single test. At the top sits the opinion, one conclusion about the whole system. This page follows the path between the two, so you can tell a footnote from a warning.
Back to SOC 2 services01 · Sample to opinion
The path a deviation travels
Every step upward is a judgment, not a sum.
- Item: one ticket, one access removal or one backup log fails its test.
- Control: the firm asks whether the control still worked, given how many items failed and why.
- Criterion: if the control fell short, did other controls still achieve the criterion it supports?
- Opinion: only a criterion left unmet, to a material degree, changes the wording at the top.
02 · Four forms
The four forms the verdict can take
You can tell the form from one paragraph in the CPA firm's report.
| Opinion | What to look for | What it tells a buyer | Sensible next step |
|---|---|---|---|
| Unmodified | No basis paragraph; the conclusion is stated plainly | Assurance across everything in scope, at the level of materiality | Read the deviations that touch your use |
| Qualified | A basis paragraph and the words except for | A material problem, confined to named criteria or controls | Check whether the named area touches your data; ask for proof of the fix |
| Adverse | A basis paragraph stating the description or controls fail | The problems are material and pervasive | Treat the vendor as having no usable assurance and escalate |
| Disclaimer | A statement that the firm expresses no opinion | The firm could not gather enough evidence to conclude | In practice the same as adverse; ask why evidence was missing |
Under the attestation standards, a qualification means a matter is material but not pervasive. Once its effect spreads across the subject matter, the firm moves to an adverse opinion, or to a disclaimer when the obstacle was missing evidence.
03 · Weighing
What the auditor weighs before a deviation moves up
These are the reasons most deviations stay local.
- CauseA step missed by one person on leave reads differently from a process nobody owns.
- RateHow many items failed against the sample size, compared with the rate the firm was prepared to tolerate when it planned the test.
- ReachWhether the failed item touched in-scope systems or data in a way that mattered.
- CoverWhether another control, such as a monitoring alert or a later review, caught or would have caught the same risk.
- Criterion met?Whether the criterion the control supports was still achieved over the period. If so, the opinion usually stays clean.
So the tally of deviations says little on its own. Ten small slips spread over many controls can sit beneath a clean opinion, while one design gap in logical access can qualify it.
04 · Worked example
Illustrative: three deviations in one report
One report, three different outcomes.
| Deviation (illustrative) | What the firm found next | Effect on the opinion |
|---|---|---|
| 1 of 25 sampled production changes went live without recorded approval | A low-risk configuration fix; a second engineer's review was logged in the code repository | None; listed in the test results only |
| One quarterly access review was skipped | Leavers were still removed on time through the HR-triggered process | None; another control met the criterion |
| No backup was restored or tested during the period, with Availability in scope | Nothing else showed that recovery would work | Could lead to a qualification on the related availability criterion |
The company and figures are invented. The pattern is what matters: each time the firm climbs from the item to the criterion, and only the third lapse leaves a criterion uncovered.
05 · As a buyer
Reading the outcome as a customer
Relevance to your use decides how much a finding weighs.
- Map each deviation to your data. Mark the deviations that involve systems storing, processing or reaching your data. Glance at the rest and move on.
- Set it beside last year's report. A deviation that shows up in two reports in a row suggests the fix did not hold.
- Read any response the vendor added. Responses sit in the unaudited section. Look for a cause, a change and a date.
- Ask for proof on a qualified area. If the qualification touches your service, request evidence the control now runs, such as recent tickets or logs.
- Suspend reliance on adverse or disclaimed reports. Neither gives assurance. Treat the vendor as one with no report until a later period comes back clean.
06 · As the vendor
When your own fieldwork turns up a deviation
Candour and a dated fix serve you better than argument.
- Disputing the sample. Asking the firm to swap a failed item for a better one. The auditor chooses the sample and what gets disclosed.
- Leaving the response blank. Readers fill silence with their worst guess. A short cause, fix and date costs little.
- Fixing the policy, not the system. The document changes but the process does not, and the same item fails next period.
- Producing a compensating control too late. If another control covered the risk, show it with evidence during fieldwork, not after the report is issued.
- Waiting for customers to ask. When an opinion is qualified, send affected customers your remediation evidence first.
Sources: AICPA AT-C section 205 (examination engagements), on modified opinions; AICPA guide, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, on tests of controls and deviations; AICPA TSP section 100, Trust Services Criteria.
07 · Go deeper
Go deeper
Dedicated pages on topics this guide only touches.
Questions about verdicts and deviations
Does a qualified opinion mean we should stop using the vendor?
Not automatically. Check what the qualification covers.
A qualified opinion fences off named criteria or controls; the rest of the report still stands. If the fenced-off area has nothing to do with your service, the impact may be small. If it covers access to your data, ask for remediation evidence before renewing.
Can a vendor have a deviation removed from its report?
No. The CPA firm decides what is reported.
Test results belong to the service auditor. Management can show a compensating control during fieldwork and can add context in the unaudited section, but it cannot edit the firm's findings.
Why does every row in some reports say no exceptions noted?
A tight scope, well-automated controls, or both.
A spotless table is possible when controls run automatically and capture their own evidence. It shows that the sampled items passed the tests chosen, nothing more. Check that the tests went beyond inquiry of staff.
Is a disclaimer better or worse than an adverse opinion?
For a buyer, neither offers anything to rely on.
An adverse opinion says the firm found broad failure. A disclaimer says it could not gather enough evidence to decide. Either way that report gives you no usable assurance.
Find the weak samples before the auditor does.
A SOC 2 readiness assessment samples your controls the way a CPA firm will, while there is still time to fix what fails.