What happens when a company cannot show evidence that its SOC 2 controls are operating effectively?

What the evidence gap means for a SOC 2 opinion

In SOC 2, the auditor is not judging whether controls merely exist on paper. They are assessing whether the controls were designed appropriately and operated effectively over the review period, with evidence sufficient to support that conclusion. If the company cannot produce that evidence, the auditor may be unable to rely on the control set as represented in the report.

That shift is important because the opinion is about assurance, not intent. A control that cannot be demonstrated through logs, tickets, configurations, approvals, monitoring output, or other audit evidence is treated as unproven, even if teams believe it was followed informally.

How the opinion can change

When evidence is incomplete, the outcome depends on scope and severity. A limited gap may lead to a qualified opinion if the auditor can still conclude on most controls, while broader or more serious gaps can lead to an adverse opinion or a disclaimer of opinion if the auditor cannot obtain enough appropriate evidence to support any reliable conclusion.

The practical distinction is whether the missing evidence affects a narrow control exception or undermines confidence in the whole control environment. If the gap is systemic, the auditor may conclude that the service organisation has not demonstrated reliable operation across the Trust Services Criteria that matter to customers.

Why the trust impact is wider than the audit result

A weak or negative SOC 2 result does more than change a report label. It signals that the organisation may not be able to substantiate claims about security, availability, confidentiality, processing integrity, or privacy, which can affect procurement decisions, renewals, and third-party risk reviews.

For buyers, the issue is often not the existence of one failed test, but whether the company can show a repeatable control system. That is why evidence quality, retention, and traceability matter as much as the control design itself. The relevant control criteria are published by the SOC 2 Trust Services Criteria (AICPA), which define the assurance baseline auditors are testing against.

Risk and Threat Considerations

The risk is not only an audit qualification, it is the possibility that undetected control failure already exists. If a company cannot show evidence, it may also be unable to prove that access reviews, logging, change control, incident handling, or backup checks actually happened as required, which increases the chance that a real weakness is hiding behind a paper process.

Failure mechanism: Missing or weak evidence prevents the auditor from validating operating effectiveness, so controls that appear present may be treated as unverified, inconsistent, or ineffective across the audit period.

Impact: The report may be qualified, adverse, or disclaimed, and the organisation may lose customer trust because it cannot substantiate claims about control reliability or service assurance.

Practitioner Guidance

What to verify: Confirm that each key control has an evidence trail that is time-bound, attributable, and retained for the full review period. For operating effectiveness, the strongest evidence usually shows the control happened consistently, not just that a policy exists.

Common mistake: Treating screenshots, policy PDFs, or one-time attestations as sufficient proof of operation. Auditors usually want evidence of execution, exception handling, and follow-through, especially for controls tied to access, monitoring, and change management.

Decision rule: If a control cannot be evidenced reliably, treat it as an audit readiness problem, not a documentation problem. The right response is to close the evidence gap and retest the process before the next assurance cycle.

Practitioner takeaway: In SOC 2, the burden is not to argue that controls probably worked, but to show they operated consistently enough that an independent auditor can rely on them.

Related resources from NHI Mgmt Group

• What happens when organisations rely on SOC 2 or ISO 27001 evidence but do not address CMMC-specific controls?
• What happens when an ICT company cannot show meaningful progress in implementing GNI Principles?
• What happens when a breach occurs and the organisation cannot show concrete data security controls?
• How should security teams govern non-human identities for SOC 2 compliance?