You cannot literally "fail" SOC 2 — the audit produces an opinion. A clean (unqualified) opinion means controls were suitably designed and operating; a qualified opinion means the auditor noted one or more exceptions. The report still issues, but customers see the exceptions. A very common contributor is a missing or inadequate penetration test, because the Trust Services Criteria expect ongoing evaluation of control effectiveness — the CC4.1 point of focus explicitly names penetration testing, and CC7.1 covers vulnerability detection. To recover: remediate the specific exceptions, gather evidence the fixed controls operate, and demonstrate that over a follow-up window. If a pentest gap was involved, commission one, fix the findings, and keep the report and retest as evidence for next time.
// 01 What does "failing" a SOC 2 audit actually mean?
SOC 2 is not a pass/fail exam, which is the first thing worth internalising when a report comes back badly. A SOC 2 audit ends in the auditor's opinion on whether your controls meet the Trust Services Criteria. An unqualified opinion is the clean result everyone wants. A qualified opinion means the auditor identified one or more exceptions — controls that were not suitably designed, or not operating effectively, during the audit period. There are also adverse and disclaimer opinions in rarer, more serious cases.
Colloquially, a qualified opinion is what people mean by "failing" SOC 2. The important nuance is that the report still issues and can still be shared — but the exceptions are visible in it, and your customers' security teams will read them. So the goal is not to hide the result; it is to remediate cleanly and get to an unqualified opinion at the next window.
// 02 Why SOC 2 reports get exceptions
Exceptions cluster around a familiar set of gaps. Recognising which one you hit tells you where to focus.
Missing or inconsistent evidence
The control existed but you could not prove it operated consistently across the whole audit period — the classic Type II failure.
No penetration test
Nothing demonstrating you evaluate control effectiveness through independent testing — a frequent contributor, tied to CC4.1.
Access-management gaps
Orphaned accounts, missing access reviews, or offboarding that did not remove access promptly.
Incomplete monitoring
Gaps in logging, alerting or vulnerability management that undermine CC7.1.
// 03 Where penetration testing fits (and why it's often the gap)
SOC 2 does not name a mandatory annual penetration test — but it expects evidence that you evaluate whether your controls actually work, and a pentest is the standard way to provide it. The connection is explicit in the criteria themselves. The AICPA point of focus under CC4.1 (monitoring activities) states that management uses "a variety of different types of ongoing and separate evaluations, including penetration testing, independent certifications made against established specifications… and internal audit assessments." Separately, CC7.1 requires detection procedures to identify new vulnerabilities and configuration changes — where vulnerability scanning provides evidence.
The practical upshot: a vulnerability scan speaks to CC7.1, and a penetration test speaks to CC4.1, and auditors increasingly expect both. If your programme had neither, or only an automated scan presented as a pentest, an auditor may conclude they cannot verify that your monitoring and vulnerability controls operate effectively — and that conclusion becomes an exception. This is why a missing or inadequate pentest is one of the most common threads behind a qualified SOC 2 opinion.
// 04 How to recover — step by step
Recovery is methodical, not dramatic. Work the exceptions the auditor actually named, in order.
Read the exceptions precisely
Understand exactly which controls and criteria were flagged. Do not guess — the auditor's wording is your remediation checklist.
Remediate the root cause
Fix the underlying control, not just the symptom — and if a missing pentest was cited, commission an independent one.
Gather operating evidence
Collect proof the fixed control now operates: logs, tickets, the pentest report and its retest.
Run the follow-up window
For a Type II, the control must operate over a period. Agree the window with your auditor and evidence it.
Re-audit for a clean opinion
Return to the auditor with the remediated controls and evidence to secure an unqualified opinion.
// 05 How to avoid it next time
The organisations that sail through SOC 2 treat it as continuous, not annual. Run an independent penetration test aligned to your audit period so CC4.1 evidence is fresh; maintain regular vulnerability assessment for CC7.1; keep access reviews and monitoring evidence current throughout the year rather than scrambling before the window; and make sure whatever you present as a "penetration test" is a genuine manual test, not a scan — because auditors, like customers, increasingly know the difference. Our SOC 2 framework guide covers how testing maps to the criteria in detail.
// 06 Frequently asked questions
Can you fail a SOC 2 audit?
Not in a pass/fail sense. A qualified opinion means the auditor noted exceptions; the report still issues but shows them. People call that "failing."
Why did our report have exceptions?
Common causes: inconsistent evidence, control gaps, access issues, incomplete monitoring, and a missing penetration test.
Does SOC 2 require a pentest?
Not explicitly, but it is expected evidence — CC4.1's point of focus names penetration testing, and CC7.1 covers vulnerability detection.
How do we fix a qualified opinion?
Remediate the named exceptions, gather evidence the fixed controls operate, demonstrate over a follow-up window, and re-audit.
// 07 References
- AICPA Trust Services Criteria (2017, with 2022 revised points of focus) — CC4.1 (monitoring activities; penetration testing named in its point of focus) and CC7.1 (vulnerability detection).
- See our SOC 2 framework guide for how penetration testing maps to the criteria.