SOC 2 Audit Failure: Qualified Opinions Explained
You cannot fail a SOC 2 audit, because SOC 2 is not a pass or fail test. It is an examination, and the output is an auditor’s opinion. What you can receive is a qualified opinion, which means the auditor found one or more exceptions: controls that did not operate exactly as you described them. A qualified SOC 2 report is still a real report, most customers still accept it, and the usual fix is a clear explanation plus a remediation date.
What follows is what each opinion type actually means, what an exception looks like in practice, and what to do in the ninety days after one lands.
Can you fail a SOC 2 audit?
No, not in the sense of a grade. SOC 2 is an attestation examination performed under standards set by the American Institute of Certified Public Accountants, and the deliverable is a report containing the auditor’s opinion on whether your controls were suitably designed and, in a Type 2, operated effectively over a period. There is no score and no pass mark.
What people usually mean by failing is receiving an opinion that is not clean. That is a real outcome with real commercial consequences, so the distinction is not just semantics, but it is also far less final than the word failure suggests. A qualified report tells a reader exactly what went wrong and leaves them to judge whether it matters to them. Many of them decide it does not.
What are the four SOC 2 audit opinions?
A SOC 2 auditor can issue one of four opinions. Knowing where your report sits tells you how worried to be.
Most Australian companies that prepare properly receive an unqualified opinion. Qualified opinions are uncommon but far from rare, particularly on a first Type 2 where the control environment was still settling during the observation period. Adverse opinions and disclaimers are genuinely unusual, and both indicate problems well beyond a single control.
The AICPA’s SOC suite of services sets the standards these opinions are issued under, if you want the authoritative framing rather than a vendor summary.
What is a SOC 2 exception?
A SOC 2 exception is an instance where the auditor tested a control and found it did not operate as described. Exceptions are recorded in the testing section of the report with the control, the testing performed, and what the auditor found. Not every exception qualifies the opinion. A small number of isolated instances may be noted without changing the overall conclusion.
| Common exception | What the auditor found | How serious |
|---|---|---|
| Access reviews not performed | Quarterly review evidence missing for one or more quarters | High, it is a core control and easy to evidence |
| Offboarding delays | Access remained active days or weeks after a leaver’s last day | High, especially if the account was privileged |
| Change management gaps | Deployments without recorded approval or review | Medium to high, depends on how many |
| Missing vendor reviews | No documented review of a critical sub-processor | Medium, often the easiest to remediate |
| Backup restoration not tested | Backups ran but restoration was never verified | Medium, and a common first-year finding |
| Security awareness training gaps | A proportion of staff did not complete training in the period | Low to medium, usually a tracking problem |
The pattern across that table is worth noticing. Almost none of these are failures of security capability. They are failures of operating discipline: a control that exists, works, and simply was not performed on schedule or was not evidenced when it was. That is why a SOC 2 readiness assessment before the observation period is worth the money.
What does a qualified SOC 2 opinion do to your sales cycle?
This is the part that generic guidance skips, and it is usually the reason an Australian company is searching for answers at eleven at night. A qualified SOC 2 report does not automatically lose you a deal. How you handle it very often decides whether it does.
- Most buyers read the opinion, then the exceptions. A security reviewer will look for the qualification, read what it was, and form a view. A single late access review reads very differently to systemic change management failure.
- Procurement usually wants a remediation statement. A short written note saying what happened, what changed, when it changed and when the next report will cover it resolves most queries.
- Existing customers matter more than new ones. Customers with the report in a contractual obligation may have notification clauses. Check them.
- Silence is what costs deals. A buyer who discovers a qualification themselves, after you sent the report without comment, reasonably wonders what else you did not mention.
If you are on the other side of this and assessing a supplier’s report, how to vet a supplier’s SOC 2 report covers what to look for.
What should you do in the first 90 days after a SOC 2 exception?
The response to a SOC 2 exception has a natural sequence, and the order matters more than the speed. Fixing the control before you understand the exception usually means fixing the wrong thing.
Understand the exception precisely
Get the exact wording from the auditor, the population they tested, and how many instances failed. One failure in a sample of forty is a different conversation to twelve in a sample of twenty five. Ask the auditor directly what would have satisfied them, because their answer shapes what you build next.
Brief your customers before they read it
Write a short remediation statement and send it with the report rather than waiting to be asked. Name the exception, state the root cause plainly, state what changed, give the date it changed, and say which future report will cover the fixed control. Two paragraphs is usually enough, and it converts an awkward discovery into evidence that you manage your control environment seriously.
Fix the process, not the evidence
The instinct after an evidence exception is to improve the record keeping. That is half the answer. If quarterly access reviews were missed, the fix is a scheduled owner, a calendar commitment and an escalation if it slips, not a better spreadsheet to record reviews that still might not happen. Auditors test the control, and the evidence is a by-product of the control actually running.
Rebuild the evidence record
A remediated control needs to operate long enough for the next observation period to demonstrate it. If you fixed an access review process in March and your next period ends in June, you have one quarter of evidence, which may be thin. Talk to your auditor about the period dates before you set them. A SOC 2 bridge letter can cover the gap between reports while you rebuild.
Common questions about SOC 2 audit outcomes
Can you fail a SOC 2 audit?
Not in the pass or fail sense. SOC 2 produces an opinion, not a grade. The nearest equivalent to failure is an adverse opinion, where the auditor concludes controls were not effective, or a disclaimer, where they could not gather enough evidence to conclude anything. Both are rare. A qualified opinion, which is what most people mean, is a usable report with identified exceptions.
How long does a SOC 2 audit take?
The fieldwork itself usually runs two to six weeks, with the report issued four to eight weeks after that. The longer number that matters is the observation period for a Type 2, commonly three to twelve months, during which your controls must actually operate. Preparing for a SOC 2 audit covers the full sequence.
How often are SOC 2 audits done?
Annually. A SOC 2 Type 2 report covers a defined period, and customers expect continuous coverage from one period to the next with no gaps. If your reporting periods leave a gap, a bridge letter from you covers the interval, though it is your assertion rather than an auditor’s opinion.
What does a SOC 2 audit include?
An auditor examines the controls you have described against the Trust Services Criteria you selected. Security is always in scope, and availability, confidentiality, processing integrity and privacy are optional additions. For a Type 2 the auditor samples evidence across the observation period rather than checking a point in time. Which Trust Services Criteria apply covers choosing scope.
Does a qualified SOC 2 report expire sooner?
No. A qualified report covers the same period and has the same shelf life as an unqualified one, typically treated by buyers as current for about twelve months from the period end. What changes is how much explanation it needs. The practical pressure is commercial rather than technical: you will want the next report clean, which means the remediated control running well before the next period starts.
Avoiding a qualified SOC 2 opinion next time
Most qualified opinions trace back to the same root cause: a control that was described in the system description more ambitiously than the business could sustain. Describing quarterly access reviews when you can realistically manage them twice a year creates an exception that was avoidable at the drafting stage.
Before the next observation period, re-read your system description and ask one question of each control: will this still be happening in month nine, when the person who set it up is busy? Where the honest answer is no, change the control description or change the resourcing. Auditors test what you claimed, so claim what you can run.
Siege Cyber helps Australian companies get audit ready, close findings and keep controls running between periods. See our SOC 2 services or get in touch to talk through where your report stands.