Audit and compliance
Exception
Also called: audit exception, control deviation
In a SOC 2 report, an exception is an instance where a control did not operate as described during the observation window. Exceptions appear in the report with management's response, and a report containing them is not a failed report.
Buyers read exceptions more carefully than anything else in the document. One exception with a clear cause and a documented fix reads better than a report that appears too clean to be true.
See also
Testing, with the report an auditor can actually use
A fixed price, a date, and a report that states scope, method and closure. No discovery call required to get a number.