How to Address a Testing Exception in Your SOC Report

Ugh, it’s happened—during your SOC examination, your service auditor identified a deviation from your intended process, and that resulted in a testing exception. Given that your customers (and other stakeholders) are relying on your SOC report for reassurance regarding the effectiveness of your controls, you need to address that deviation—but how?

What should you do when a testing exception is identified in your SOC report? As a leading provider of SOC services, we’re here to leverage our two decades of experience performing these audits to help you move past these deviations.

In this article, we’ll provide a chronological guide to help you address testing exceptions in SOC reports so that you can take care of any that occur promptly and comprehensively.

What to Do When a Testing Exception is Identified in Your SOC Report

Should your auditor discover a testing exception, we recommend progressing through the following six steps to ensure you resolve the issue—both for your report’s sake and that of your security.

1. Collaborate with Your Service Auditor

Your first step is working with your service auditor to validate the correct information was provided when they identified the testing exception—i.e., did they understand the technology & process flow accurately and was the most accurate and complete information provided?

At Schellman, our SOC teams prioritize raising these concerns to our stakeholders as quickly as possible to ensure:

• There’s a clear understanding of the exception;
• Any report implications are understood; and
• You have an opportunity to address the finding(s).

2. Identify Risk Mitigating Practices

Once you’ve confirmed the deviation, you should identify any mitigating practices that were in place during the audit period.

For example, if the exception was related to system users with excessive access privileges, you may have used a periodic user entitlement review to detect unauthorized or excessive access privileges on a monthly or quarterly basis—this detective procedure can help demonstrate that, despite the exception, your controls were effective in mitigating the overall access risks, and that in turn can help with the final opinion your auditor issues in your report.

3. Correct the Issue

With that done, it’s time to actually take the steps to correct the deviation from established processes, which may involve:

• Investigating the matter for root cause analysis (more on this later)
• Specifically correcting the misconfiguration, lack of documentation or relevant oversight
• Updating policies and procedures;
• Implementing additional controls; or
• Providing training to employees.

In correcting our prior example regarding unauthorized access, this would require you to revoke the unnecessary access privileges, assess any activities or modifications performed by the account, and carry forward as necessary.

4. Identify Root Cause

But solving the isolated problem will not be enough—it'd be prudent to also identify the root cause of the deviation to prevent it from occurring in the future.

To do so, consider conducting a thorough review of the affected processes and associated control activities to identify any underlying issues that contributed to the exception as this process can reveal other, potentially systemic or pervasive issues, such as:

• Segregation of duties;
• Lack of adequate policy; or
• System misconfigurations.

5. Form a Greater Remediation Plan

Based on that root cause analysis, you can then form a remediation plan to address the identified source issues, including:

• The specific steps to be taken;
• The responsible parties;
• Timelines;
• Milestones for completion with the ultimate goal of preventing the recurrence of the deviation; and
• Internal assessment before your next audit to ensure the controls are operating as intended.

6. Respond to the Testing Exception

An organization should respond to findings within its SOC report in almost every case. It’s an extremely common practice, as it’s largely expected by your stakeholders and readers of your report who naturally care about the safekeeping of their data—just like you, they have their own risks to manage, including the responsibilities of their subservice organizations.

If and when you do respond, you can include any relevant details you wish as long as you provide enough context to assure stakeholders that the exception is being addressed appropriately. Though your responses will not be evaluated by your auditor, in our extensive experience, we’ve commonly seen organizations provide the following:

• The circumstances surrounding the exception;
• Root cause;
• Remediation plan to prevent future occurrences; and
• Timeline of remediation, and more.

Moving Forward with Your Next SOC Examination

While a testing exception is never ideal, they are common—we are human, after all. But in reality, if found during your SOC examination, they just present an opportunity for your organization to demonstrate its commitment to continuous improvement. By following these steps, you can effectively address these deviations and strengthen your processes.

As you continue on your SOC journey, make sure to check out these specific articles that can help streamline your progress:

• How to Streamline Your Next SOC Examination: 3 Easy Tips
• How to Bridge From SOC 1 to SOC 2
• How to Perform a SOC 2 Risk Assessment

And if you’re considering a switch in assessor and want to learn more about Schellman’s experience, contact us today to speak with our SOC team who will be happy to discuss if our expertise is a fit for your organization.