Not automatically. First work out whether the issue affects the service you need and whether it leaves a risk you can accept. Counting exceptions is not a useful way to compare vendors.
An exception means the auditor found a problem in a control or its operation. It does not automatically produce a qualified opinion. Read both the opinion and the detailed findings.
Ask four questions
- What happened? Read the actual finding. Was a task missed, a control poorly designed, or evidence unavailable?
- Does it affect our use? Check the relevant service and period. Do not dismiss a shared access-control issue just because the example names a different team.
- How wide was the problem? Ask about affected systems and dates. A sample finding may require more investigation to understand its reach.
- What has changed? Ask what was corrected and what evidence shows the correction works.
A late access removal is worth understanding
Suppose the report says a former employee’s account stayed enabled longer than the vendor’s policy allowed. Ask which systems it could reach and how long access remained. Also ask whether the vendor checked for use after departure.
Removing that account fixes the immediate access issue. It does not by itself show that the offboarding process will work next time. Look for evidence that the process was corrected too.
A management response is not an audit retest
The vendor may explain the fix in an additional-information section of the report. Check the section’s status. Management’s explanation can be useful, but it may be outside the auditor’s opinion.
Keep the original finding separate from later evidence. “We fixed it” and “an independent reviewer tested the fix” are different claims.
Make the decision explicit
Your decision might be to proceed, proceed with conditions, delay onboarding or choose another provider. Record the reason and who approved it. If you need more evidence, give that follow-up an owner and date.
For a serious finding outside your expertise, involve your security or risk specialist before approval. Do not let a clean overall opinion replace that judgment.
For the rest of the review, use our supplier SOC report review steps.
Sources
Schellman explains the distinction between testing exceptions and qualified opinions and which report sections contain management’s unaudited information. The questions above are practical buyer guidance, not a universal vendor-acceptance rule.
One Response