Exception (SOC 2)

An instance where a control did not operate as described during the auditor's testing: a new joiner without an approved access request, a quarterly review done late. The auditor lists exceptions in Section 4 with management's response, and decides whether they are serious enough to qualify the opinion. A report with a few exceptions and a clean opinion is normal; read the exceptions, not just the opinion.