Audit Exception vs Control Deficiency: How a Failed Test Becomes a Finding

A single failed sample in a control test is not automatically a control deficiency, and treating every exception as a finding, or none of them, is how organisations end up surprised by their audit report. An exception (auditors also say deviation) is an observed fact: one leaver whose account stayed active, one quarterly review signed late. A control deficiency is a judgement that the control, as designed or as operated, does not meet its objective. Between the two sits an evaluation of sample results, cause, compensating controls and severity. This guide explains that path for SOC 2, SOX IT general controls and internal audit, using the definitions in PCAOB AS 2201 and AS 2315, SEC interpretive guidance and the GAO Green Book, and applies them to the identity controls that generate the most exceptions. It is for control owners, GRC teams and IT audit leads who need to respond to exceptions before they harden into deficiencies.

Key takeaways

• An exception is evidence, a deficiency is a conclusion. The auditor first counts and explains deviations in a sample, then decides whether they show the control failing its objective.
• Sample results are compared with a tolerable rate. PCAOB AS 2315 describes tolerable deviation rates of about 5 percent or less where reliance is high, and treats untestable items as deviations.
• Cause matters as much as count. AS 2315 directs auditors to the nature and cause of each deviation; one deliberate override weighs more than several clerical slips.
• Severity runs from deficiency to material weakness. AS 2201 grades by likelihood and magnitude, regardless of whether any misstatement actually occurred, and credits compensating controls only if precise enough.
• Identity controls produce recurring exceptions. Late deprovisioning and rubber-stamped access reviews are the classic pair; fixing the process, not the single sample, is what stops a repeat.

The short answer

The live How to Read a SOC 2 Report Guide covers exceptions from the report reader's side. This page covers the auditee's side: how exceptions are evaluated and how to keep them from becoming deficiencies.

From test to exception: sampling mechanics

Most operating effectiveness tests use samples. AS 2315 sets out the logic for tests of controls that auditors in both SOX and attestation work recognise.

• Tolerable rate of deviation: the maximum rate the auditor would accept without changing their planned reliance. AS 2315 paragraph .34 says a low planned control risk with high reliance on the sample may call for a tolerable rate of about 5 percent or less; more reliance on other tests may support 10 percent or more.
• Evaluating the result: the sample deviation rate is the best estimate of the population rate, but the auditor must also allow for sampling risk. Paragraph .41 gives the example that, with a 5 percent tolerable rate, zero deviations in 60 items may indicate acceptably low sampling risk, while two or more may not.
• Items that cannot be tested: paragraph .40 says an item where the planned procedure cannot be applied (for example, no evidence of the approval exists) is ordinarily treated as a deviation. Missing evidence is an exception, not a neutral gap.
• Nature and cause: paragraph .42 requires the auditor to consider qualitative aspects, including whether a deviation is an error or an irregularity, a misunderstanding of instructions or carelessness. An irregularity calls for a broader review.
• Consequence: paragraph .43 says that when results do not support the planned reliance, the auditor changes the nature, timing and extent of other procedures. In practice, expect expanded samples or additional testing.

Sample sizes are set by the audit firm's methodology, usually scaled to control frequency (annual, quarterly, monthly, weekly, daily, many times a day) and to whether the control is automated. An automated control backed by effective change management and IT general controls is often tested with a single instance; a manual daily control needs many more items. AS 2315 was amended with changes to paragraph .11 effective 15 December 2026, so confirm with your auditor which version applies to your period.

What auditors do after an exception

1. Confirm the fact: re-perform, check the evidence, and give management a chance to supply missing support.
2. Ask for the cause: one-off human error, process gap, system failure, or override.
3. Decide whether to extend: many methodologies allow an expanded sample after a single exception in a small sample; a second exception usually ends that route.
4. Look for compensating controls: a detective control that would have caught the failure in time.
5. Conclude: isolated exception with no deficiency, deficiency in operation, or (if the cause is structural) deficiency in design.
6. Report: in SOC 2, the exception is described in the test results whatever the conclusion; in SOX, deficiencies are graded and communicated.

Exception, deficiency, significant deficiency, material weakness

The vocabulary is most precise in US financial reporting, and IT audit borrows it widely.

SOC 2 does not use the significant deficiency or material weakness grades. There, the service auditor decides whether the controls were suitably designed and operated effectively to meet the trust services criteria. Exceptions that do not prevent a criterion being met are listed with an unmodified opinion; exceptions that do lead to a qualified opinion for the affected criteria. Internal audit functions usually apply their own rating scale (for example low, medium, high, critical) defined in the audit charter or methodology. The Internal Audit vs External Audit guide explains how those scales relate.

How severity is judged

• Likelihood and magnitude: AS 2201 paragraph .63 asks whether there is a reasonable possibility the controls will fail to prevent or detect a misstatement, and how large it could be.
• Actual outcome does not decide it: paragraph .64 states that severity does not depend on whether a misstatement actually occurred. "Nothing bad happened" is not a mitigation argument.
• Risk factors: paragraph .65 lists the nature of the accounts, susceptibility to loss or fraud, subjectivity, interaction with other controls, interaction among deficiencies and possible future consequences.
• Compensating controls: paragraph .68 credits them only if they operate at a level of precision that would prevent or detect a material misstatement. A quarterly access review does not compensate for a leaver who can act on day one.
• Aggregation: deficiencies are evaluated individually and in combination. The Green Book also asks management to consider correlation between deficiencies.
• Indicators of a material weakness: paragraph .69 includes fraud by senior management, restatement for a material misstatement, a material misstatement found by the auditor that controls missed, and ineffective audit committee oversight.

For IT general controls, SEC Release 33-8810 notes that ITGCs alone ordinarily do not address financial reporting risk directly, but automated controls depend on them. An ITGC deficiency is therefore evaluated through its effect on the application controls and reports that rely on it. See the SOX IT General Controls (ITGC) Guide.

Recurring identity control exceptions

Access controls generate more exceptions than any other ITGC family because they run continuously, depend on HR feeds and involve many people. The patterns below are the ones that most often turn exceptions into deficiencies.

Deprovisioning in depth: auditors typically sample terminations from the HR system and compare the termination date with the account disable date in each in-scope application. A single late removal with no activity after termination is often judged isolated. A late removal with a login after termination changes the question from timeliness to whether unauthorised access occurred, and may draw in other procedures. The Ledger Connect Kit npm compromise began with a former employee's npm publishing access that had not been revoked, a reminder that applications outside the identity provider are where leaver controls fail. See the Joiner-Mover-Leaver Guide and SaaS deprovisioning.

Access reviews in depth: the exception auditors increasingly raise is not lateness but precision. If a reviewer certified 2,000 entitlements in four minutes, or certified an account that belonged to a leaver, the auditor may conclude the review is not designed to detect inappropriate access, which is a design deficiency affecting every quarter tested. The Access Reviews Guide covers review design; the evidence an auditor needs is what the reviewer saw, what they changed and that removals were carried out.

Non-human identities: service accounts, API keys and tokens frequently fall outside both the leaver process and the review population, so they surface as completeness exceptions. The Coupang signing key breach involved a token signing key that was not revoked or rotated after the engineer who held it left. See How to Run an Access Review for Service Accounts.

Management responses that work

A management response is the organisation's written reply to an exception or deficiency. In SOC 2 reports it may appear in an optional section of other information from management, which the service auditor does not opine on. In SOX and internal audit it becomes the remediation commitment.

1. State the fact without arguing it: confirm the exception and the dates. Disputing evidence after the fieldwork rarely helps.
2. Give the root cause: name the process step that failed (HR feed delay, a manual ticket queue, a report filter), not "human error" alone.
3. Show the extent: run a full-population check, not just the sample. For deprovisioning, compare every termination in the period with every in-scope account and report all late or missing removals and any post-termination activity.
4. Name compensating controls honestly: only those that would have caught this failure in time, with evidence they ran.
5. Commit to remediation with an owner and date: fix the process, then allow enough operating time to be retested. A control fixed in the last month of the period may not have enough instances to show it operates.
6. Retest before the auditor does: internal testing of the remediated control on a fresh sample, with evidence retained.

Remediation mechanics, tracking and closure evidence are covered in the Audit Finding Remediation Guide.

Decision guidance: when to escalate an exception yourself

• Treat as isolated when the cause is a single human slip, the full-population check finds no other instances, there was no activity or impact, and a detective control would have caught it.
• Treat as a deficiency in operation when the full-population check finds more instances, the cause is a process step that will recur, or the person performing the control lacked authority.
• Treat as a deficiency in design when the control could not have met its objective even if run perfectly: incomplete population, a review without the information needed to judge access, or no control at all for a class of accounts.
• Escalate to the audit committee or risk committee when the deficiency affects privileged access to in-scope systems, involves an override or possible fraud, or combines with other deficiencies on the same system.
• Small vs large organisations: small teams with few terminations per year have tiny populations, so one exception is a high rate; compensate with automation (identity provider driven deprovisioning) rather than more manual checks. Large organisations face completeness risk across hundreds of applications; invest in population reconciliation first.

Detection and measurement

Find exceptions before the auditor does by monitoring the same attributes they test.

• Leaver removal time: median and maximum hours from HR termination to account disable, per in-scope application. Alert on any breach of the agreed window.
• Post-termination activity: count of authentications by accounts after their owner's termination date. Target zero.
• Review precision: percentage of review items revoked or modified, and time spent per item. A revocation rate near zero over several cycles is a warning sign, not a success.
• Population reconciliation: percentage of in-scope applications whose account lists reconcile to the identity source each month.
• Self-identified exceptions: share of exceptions found by internal testing before external fieldwork. Rising is good.
• Repeat exceptions: exceptions on the same control in consecutive periods, the strongest predictor that an auditor will conclude a deficiency.

Framework mapping

See the SOC 2 CC6 Logical Access Guide for the access criteria in detail.

Common failure patterns

• Arguing the sample instead of fixing the population: management disputes one exception while a full-population check would have revealed ten more. The auditor finds them later and the conclusion hardens.
• Missing evidence treated as no exception: approvals given verbally or in chat that cannot be produced. Under AS 2315 the item is ordinarily a deviation.
• Compensating control that is not precise: offering a quarterly review as cover for a leaver window of one day.
• Remediation too late in the period: a fix in month eleven that leaves too few instances to retest, so the deficiency stands for the whole period.
• Non-human accounts outside scope: service accounts and API keys excluded from leaver and review populations, surfacing as a completeness deficiency.
• Counting exceptions instead of weighing them: internal reporting that shows "3 exceptions" without distinguishing a late training record from a terminated administrator with live access.

Practitioner checklist

• Agree with your auditor in advance how sample sizes, expanded samples and exception evaluation work in their methodology.
• For every key control, define the population source and prove completeness before testing starts.
• Run your own test of leaver removal and access reviews before fieldwork, on a full population where possible.
• For any exception, document fact, cause, extent (full population), compensating controls and remediation in one record.
• Classify each confirmed issue as isolated, operation deficiency or design deficiency using the criteria above.
• Include service accounts, API keys and SaaS accounts in leaver and review populations.
• Track remediation to retest with enough operating time left in the period.
• Report repeat exceptions and precision metrics, not exception counts alone, to the risk or audit committee.

Standards and references

• PCAOB: AS 2201 An Audit of Internal Control Over Financial Reporting
• PCAOB: AS 2315 Audit Sampling
• SEC: Release 33-8810 Management's Report on Internal Control Over Financial Reporting (interpretive guidance)
• GAO: Standards for Internal Control in the Federal Government (Green Book, 2025)
• AICPA: 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
• NIST: SP 800-53A Rev. 5 Assessing Security and Privacy Controls

Related NHI Mgmt Group resources: SOC 2 Guide · Top 10 Identity Audit Findings · Security Control Testing Plan Template · SOX ITGCs vs SOC 1