If our SOC 2 examination finds an exception, then how do we respond?

Start

Our SOC 2 examination has found an exception

An exception is a test result in which a control did not operate as described for a sampled occurrence. The CPA firm decides how it is reported, and management records the cause and its response. A gap found by your own readiness work before the period is a finding, not an exception. Keep every version of the record.

• Then: Record it when found, and never remove it

Step

Record it when found, and never remove it

Enter the control, the date found, the kind and the status Open, and keep the record as long as the evidence is kept. Never delete an exception or change its date found, and do not reach a zero count by deleting rows. A later fix does not take the exception out of the period.

• Then: Tell the CPA firm and ask how it will report it

Step

Tell the CPA firm and ask how it will report it

If the firm found it, the firm has told you. If you found it yourself in the period, tell the firm. Ask whether and where the report prints management's response, and what wording separates it from the firm's own opinion. Practice varies, and the firm decides. An exception does not by itself decide the opinion: some leave it unqualified and some lead the firm to qualify it. The opinion is the firm's judgement.

• Then: Do we agree the occurrence was an exception?

Decision

Do we agree the occurrence was an exception?

If management does not agree, it says so and gives the facts. The CPA firm decides. Do not argue in the response: give the evidence. Record the exception in either case.

• Yes: Name the kind of exception, EK-1 to EK-5
• No, or not sure: Give the firm the facts and let it decide

Step

Give the firm the facts and let it decide

Put the evidence in writing, such as the record that shows the control ran. Do not restate the exception in kinder words, and do not move a due date after the fact to make an occurrence on time. A changed control is a change to record.

• Then: Name the kind of exception, EK-1 to EK-5

Step

Name the kind of exception, EK-1 to EK-5

The kind tells you what the response must say: control not performed, performed late, performed without evidence, performed by the wrong person, or control changed in the period. If the control was redesigned, also record it as a significant change and tell the CPA firm.

• Then: Find the main cause in how the control was set up

Step

Find the main cause in how the control was set up

State why it happened in plain words and without blame: a deputy never named, a due date nobody tracked, a record field that was not required. Name the main cause, and others only if they are real. Many exceptions of one kind point to one cause.

• Then: Do we know it had no effect on customers or commitments?

Decision

Do we know it had no effect on customers or commitments?

Do not write that there was no effect without a basis: say what you checked, such as logs or the accounts reviewed. If a commitment to customers was affected, record the incident of the period and tell the CPA firm. Whom to notify, and when, follows the incident documents unchanged.

• Yes: Write the management response
• No, or not known: Check what it touched and record any incident too

Step

Check what it touched and record any incident too

Find what the exception reached. If a commitment to customers was affected, record the incident, tell the CPA firm which incident it was, and follow the incident plan for who is told and when. This pack states no notification time.

• Then: Write the management response

Step

Write the management response

A response is a short document, usually a page, with eight sections: the exception as found, cause, effect, what management did, what it will do with one owner and a date, when it will be retested and by whom, the status and the executive's approval. Write it when the exception is found. The calendar flags an exception that stays Open longer than the checkpoint interval.

• Then: Will management fix the control?

Decision

Will management fix the control?

A gap is fixed, not hidden. Where a fix cannot be made in a useful time, management may accept the gap with the approval the risk process sets, and the description then says what is and is not done. Accepting a gap to save a date is a risk, because the firm tests what is written.

• Yes, or not decided: Fix the control with one owner and a date
• No, we accept the gap: Accept it with the approval the risk process sets

Step

Fix the control with one owner and a date

Name one owner and a date the owner agreed, not a team. Track the gap to a retest in the deficiency tracker. The status is Management response agreed while the work is under way, or done but not yet retested. The fix does not remove the exception from the period.

• Then: Has the fixed control run enough times to retest?

Step

Accept it with the approval the risk process sets

Record the acceptance with the approval your risk process sets, so the approver depends on how you are governed. Have the description say what is and is not done. The status is Accepted and described, and the exception stays in the evidence.

• Then: Accepted and described: keep the approval and the description

Decision

Has the fixed control run enough times to retest?

A fixed control is retested only after it has operated for a while. The pack's default is at least 2 occurrences, or one for an annual or automated control. A control fixed yesterday has not yet shown that it works, so do not set the retest for the day after the fix.

• Yes: Have someone other than the owner retest it
• No, or not known: Keep it open and call the control fixed, not yet operated

Step

Keep it open and call the control fixed, not yet operated

The exception stays open as Management response agreed. In every report call the control fixed and not yet operated. Put the retest date in the response, and review the position at each management checkpoint.

• Then: Has the fixed control run enough times to retest? (back to an earlier step)

Step

Have someone other than the owner retest it

Nobody tests their own control. The retest looks at occurrences after the fix, by someone who does not perform the control, such as a colleague from another function, internal audit or a contracted tester. Record the result in the tracker and on the exception.

• Then: Did the retest find no gap?

Decision

Did the retest find no gap?

A closed exception needs a retest that finds no gap. If the retest finds a gap, record the finding again with a new date, plan the next fix and keep the exception open.

• Yes: Fixed and retested: keep every version of the record
• No, or not known: Fix the control with one owner and a date (back to an earlier step)

Outcome

Fixed and retested: keep every version of the record

Set the status to Fixed and retested and enter the date closed. Keep every version of the response. The exception stays in the evidence for the period and the CPA firm decides how it is reported. If a bridge letter follows the report, state the exception's status in the four status words.

Outcome

Accepted and described: keep the approval and the description

Keep the approval and the description's wording with the exception record. The exception stays in the evidence. If a bridge letter follows the report, state the status in the four status words.