FAQ: How should we handle a control exception during the audit?

Keep the facts specific: what happened, when, which control was involved, and how many items may be affected. Identify the cause, assess the risk, and document corrective action with an owner and due date. Share supporting records with the auditor and distinguish the original issue from later remediation. Fixing a process does not erase what happened during the reporting period. An exception does not automatically determine the opinion; its significance depends on the circumstances and the auditor's evaluation. Focus the discussion on evidence and impact rather than trying to rename the issue to avoid an uncomfortable conversation.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA SOC 2 reporting guide overview; NIST control-assessment guidance.

Additional FAQs

How should we review an AI vendor beyond its SOC 2 report?

Read the report's actual scope, then evaluate the AI service you plan to use. Ask about the data path, model providers, retention controls, training use, important configuration choices, and changes

Does a green automated check prove the control is working?

Not by itself. It provides evidence only about what the check measures, and only if its data and logic are reliable. Ask which systems are included, when the check last

Are the proposed 2027 SOC 2 criteria final requirements?

No. As of October 30, 2026, the AICPA's proposed 2027 Trust Services Criteria and Description Criteria are exposure drafts, not final requirements. The announced comment deadline is January 15, 2027.

What should we check before changing compliance platforms?

Export your evidence, control mapping, review history, issues, and ownership records before ending the old contract. Check whether the export includes attachments and timestamps, not just a summary spreadsheet. Plan

What is AIUC-1, and how does it relate to SOC 2?

AIUC-1 is an AI-focused standard maintained by the Artificial Intelligence Underwriting Company. Its published scope addresses data and privacy, security, safety, reliability, accountability, and societal risks. It is separate from

How should AI-related mistakes fit into incident response?

Use the existing reporting route, but make sure it recognizes AI-specific problems such as unintended disclosure, unsupported customer-facing statements, or an agent taking an unauthorized action. Record the use case,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide