FAQ: How should we handle a control exception during the audit?

Keep the facts specific: what happened, when, which control was involved, and how many items may be affected. Identify the cause, assess the risk, and document corrective action with an owner and due date. Share supporting records with the auditor and distinguish the original issue from later remediation. Fixing a process does not erase what happened during the reporting period. An exception does not automatically determine the opinion; its significance depends on the circumstances and the auditor's evaluation. Focus the discussion on evidence and impact rather than trying to rename the issue to avoid an uncomfortable conversation.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA SOC 2 reporting guide overview; NIST control-assessment guidance.

Additional FAQs

Can we scope SOC 2 to one product rather than the whole company?

Often, yes, provided the scope accurately describes the service and the systems supporting it. Start with the customer-facing product, then trace its data, infrastructure, people, and supporting processes. Shared identity

What is a SOC 2?

SOC 2 is an independent CPA examination of a service organization’s described system and controls against the applicable Trust Services Criteria. SOC stands for System and Organization Controls. A Type

How do we decide which trust services categories belong in our SOC 2?

Begin with what you promise customers and how the service could fail to meet those promises. Security is the foundation; discuss additional categories with the auditor based on the system,

What should we ask before commissioning an AI audit?

Ask what decision the audit is supposed to support. Name the system, use case, version, users, and risks to be examined. Then clarify the criteria, evaluator's qualifications and independence, evidence,

What work should a third-party risk tool help us do?

Start with the work your team struggles to complete. A third-party risk tool should help you: Check that it retains the evidence and reasoning behind decisions. A score alone will

How much review does a low-risk vendor need?

A low-risk vendor may need only a brief documented assessment. First, check: A supplier with no system access and little operational impact may need limited review. A low-cost service with

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide