A problem in an audit sample needs investigation. It does not automatically mean the whole SOC 2 examination has failed. It also cannot be erased by finding more examples that went well.
This guide covers operating-effectiveness testing for a SOC 2 Type 2 report. It explains what your team should do when the auditor selects records or asks for more.
How does the auditor choose what to test?
The auditor decides whether sampling is appropriate and selects the items. The method considers the control, its frequency and the population being tested. Risk and expected deviations matter too. Random selection is one approach. Testing every item may be more appropriate in some cases.
Start with a complete population: the full set of relevant items for the requested period. Do not prepare a list containing only successful examples.
Ask these questions before collecting records:
- Which control and period does this request cover?
- What belongs in the population?
- Which source should we use for the list?
- What records should we provide for each selected item?
- How should we report a list error or missing record?
Why is there no universal sample number?
There is no single count that suits every control. A daily manual task is different from an annual review or an automated check. Do not treat a sample table found online as the testing plan for your engagement.
Your team can clarify the facts and raise practical access issues. It should not negotiate the selection toward records that are easier to produce.
What does a failed item mean?
A deviation means the control did not operate as expected. The auditor evaluates its cause and significance. A missing record needs investigation too: it may indicate missed work or an inability to establish what happened.
Keep three things separate:
- The observed issue: What the record does or does not show.
- The explanation: What you have established about the cause.
- The correction: What you changed afterward.
Do not mark an explanation as confirmed before checking it. “The approver was probably on leave” is a lead to investigate, not evidence.
Will the auditor expand the sample?
Possibly. Additional work may test more items or other controls. It depends on the evidence needed, not an automatic rule to double every sample after one failure.
A larger sample does not delete the original deviation. The auditor considers both the numbers and the nature of the problem. Correcting the process helps going forward but does not rewrite earlier results.
An example: approval missing from a release
Suppose the auditor selects a software release. Your process requires approval before deployment, but the ticket has no approval record.
A useful response from the team would be:
- Confirm the selected release and its actual deployment time.
- Look for existing approval evidence in the systems used at that time.
- Check whether approval was missing or simply stored elsewhere.
- Identify whether other releases used the same broken process.
- Record the cause and fix once established.
- Give the auditor the facts and supporting records.
Do not create an approval today and present it as yesterday’s. Do not send a different release instead. If there is a valid contemporaneous record elsewhere, explain where it came from. The auditor decides whether it supports the test.
The next request may be broader because the first issue raised a new question. Ask what that question is so the team can provide the right evidence.
Does one exception mean a qualified opinion?
No. A testing exception and the overall opinion are different. The effect depends on the significance of the problem and the other evidence. Do not promise a clean opinion because later tests passed.
Schellman explains the difference between testing exceptions and qualified opinions. If you are reviewing a supplier rather than undergoing your own audit, use our vendor exceptions guide.
What to do now
- Keep the original request and selected-item list.
- Assign one owner to coordinate the response.
- Provide facts and records without hiding gaps.
- Correct real problems promptly.
- Ask what remains unresolved before calling the issue closed.
Technical reference: The AICPA SOC 2 guide addresses sampling in 3.157–3.161, evaluating deviations in 3.182–3.183 and 3.216–3.217, and reporting deviations in 4.19. The release example is illustrative, not a prescribed test or a prediction of an auditor’s conclusion.