FAQ: How should we handle a control exception during the audit?

Keep the facts specific: what happened, when, which control was involved, and how many items may be affected. Identify the cause, assess the risk, and document corrective action with an owner and due date. Share supporting records with the auditor and distinguish the original issue from later remediation. Fixing a process does not erase what happened during the reporting period. An exception does not automatically determine the opinion; its significance depends on the circumstances and the auditor's evaluation. Focus the discussion on evidence and impact rather than trying to rename the issue to avoid an uncomfortable conversation.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA SOC 2 reporting guide overview; NIST control-assessment guidance.

Additional FAQs

What if we change a major system during the SOC 2 period?

Tell the auditor early and keep a dated change record. Explain what changed, which controls were affected, when the new process began, and where evidence from both versions is stored.

How do we know when spreadsheets are no longer enough?

Look for repeated failures in coordination, not just team size. Warning signs include broken evidence links, unclear ownership, conflicting versions, missed reviews, and excessive time reconciling records. Measure where the

Which SOC 2 tasks should we automate first?

Start with repetitive collection or reminders where the inputs and expected result are well understood. Examples include scheduling evidence requests, exporting an approved report, or flagging an overdue review. Document

How do we decide which trust services categories belong in our SOC 2?

Begin with what you promise customers and how the service could fail to meet those promises. Security is the foundation; discuss additional categories with the auditor based on the system,

Can we manage SOC 2 with spreadsheets and shared folders?

Yes, if the workflow is reliable and the records support the controls. Start with a control register, an evidence index, a calendar, and a restricted folder structure. Assign owners and

SOC1 vs SOC2: Differences?

SOC 1 examines service-organization controls relevant to customers’ internal control over financial reporting. SOC 2 examines controls against the applicable Trust Services Criteria for the system and categories in scope.

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide