Schellman becomes The First ISO 42001 ANAB Accredited Certification Body!

Services
Services
SOC & Attestations
SOC & Attestations
Payment Card Assessments
Payment Card Assessments
ISO Certifications
ISO Certifications
Privacy Assessments
Privacy Assessments
Federal Assessments
Federal Assessments
Healthcare Assessments
Healthcare Assessments
Penetration Testing
Penetration Testing
Cybersecurity Assessments
Cybersecurity Assessments
Crypto and Digital Trust
Crypto and Digital Trust
Schellman Training
Schellman Training
ESG & Sustainability
ESG & Sustainability
AI Services
AI Services
Industry Solutions
Industry Solutions
Cloud Computing & Data Centers
Cloud Computing & Data Centers
Financial Services & Fintech
Financial Services & Fintech
Healthcare
Healthcare
Payment Card Processing
Payment Card Processing
US Government
US Government
Higher Education & Research Laboratories
Higher Education & Research Laboratories
About Us
About Us
Leadership Team
Leadership Team
Careers
Careers
Corporate Social Responsibility
Corporate Social Responsibility
Strategic Partnerships
Strategic Partnerships

How to Address a Testing Exception in Your SOC Report

SOC Examinations

Ugh, it’s happened—during your SOC examination, your service auditor identified a deviation from your intended process, and that resulted in a testing exception. Given that your customers (and other stakeholders) are relying on your SOC report for reassurance regarding the effectiveness of your controls, you need to address that deviation—but how?

What should you do when a testing exception is identified in your SOC report? As a leading provider of SOC services, we’re here to leverage our two decades of experience performing these audits to help you move past these deviations.

In this article, we’ll provide a chronological guide to help you address testing exceptions in SOC reports so that you can take care of any that occur promptly and comprehensively.

What to Do When a Testing Exception is Identified in Your SOC Report

Should your auditor discover a testing exception, we recommend progressing through the following six steps to ensure you resolve the issue—both for your report’s sake and that of your security.

1. Collaborate with Your Service Auditor

 

Your first step is working with your service auditor to validate the correct information was provided when they identified the testing exception—i.e., did they understand the technology & process flow accurately and was the most accurate and complete information provided?

At Schellman, our SOC teams prioritize raising these concerns to our stakeholders as quickly as possible to ensure:

  • There’s a clear understanding of the exception;
  • Any report implications are understood; and
  • You have an opportunity to address the finding(s).

2. Identify Risk Mitigating Practices

 

Once you’ve confirmed the deviation, you should identify any mitigating practices that were in place during the audit period.

For example, if the exception was related to system users with excessive access privileges, you may have used a periodic user entitlement review to detect unauthorized or excessive access privileges on a monthly or quarterly basis—this detective procedure can help demonstrate that, despite the exception, your controls were effective in mitigating the overall access risks, and that in turn can help with the final opinion your auditor issues in your report.

3. Correct the Issue

 

With that done, it’s time to actually take the steps to correct the deviation from established processes, which may involve:

  • Investigating the matter for root cause analysis (more on this later)
  • Specifically correcting the misconfiguration, lack of documentation or relevant oversight
  • Updating policies and procedures;
  • Implementing additional controls; or
  • Providing training to employees.

In correcting our prior example regarding unauthorized access, this would require you to revoke the unnecessary access privileges, assess any activities or modifications performed by the account, and carry forward as necessary.

4. Identify Root Cause

 

But solving the isolated problem will not be enough—it'd be prudent to also identify the root cause of the deviation to prevent it from occurring in the future.

To do so, consider conducting a thorough review of the affected processes and associated control activities to identify any underlying issues that contributed to the exception as this process can reveal other, potentially systemic or pervasive issues, such as:

  • Segregation of duties;
  • Lack of adequate policy; or
  • System misconfigurations.

5. Form a Greater Remediation Plan

 

Based on that root cause analysis, you can then form a remediation plan to address the identified source issues, including:

  • The specific steps to be taken;
  • The responsible parties;
  • Timelines;
  • Milestones for completion with the ultimate goal of preventing the recurrence of the deviation; and
  • Internal assessment before your next audit to ensure the controls are operating as intended.

6. Respond to the Testing Exception

 

An organization should respond to findings within its SOC report in almost every case. It’s an extremely common practice, as it’s largely expected by your stakeholders and readers of your report who naturally care about the safekeeping of their data—just like you, they have their own risks to manage, including the responsibilities of their subservice organizations.

If and when you do respond, you can include any relevant details you wish as long as you provide enough context to assure stakeholders that the exception is being addressed appropriately. Though your responses will not be evaluated by your auditor, in our extensive experience, we’ve commonly seen organizations provide the following:

  • The circumstances surrounding the exception;
  • Root cause;
  • Remediation plan to prevent future occurrences; and
  • Timeline of remediation, and more.

Moving Forward with Your Next SOC Examination

 

While a testing exception is never ideal, they are common—we are human, after all. But in reality, if found during your SOC examination, they just present an opportunity for your organization to demonstrate its commitment to continuous improvement. By following these steps, you can effectively address these deviations and strengthen your processes.

As you continue on your SOC journey, make sure to check out these specific articles that can help streamline your progress:

And if you’re considering a switch in assessor and want to learn more about Schellman’s experience, contact us today to speak with our SOC team who will be happy to discuss if our expertise is a fit for your organization.

About COLLIN VARNER

Collin is a Senior Manager with Schellman Compliance, LLC based in Denver, Colorado. Collin is focused primarily on specializing in IT attestation, audit, and compliance activities as they relate to numerous standards including SOC, HIPAA, CMMC, and a suite of ISO standards. Prior to joining Schellman, Collin held roles tasked with planning, organizing, and managing multiple facets of information technology and security reviews including cybersecurity assessments, risk management, internal and external audit, system implementations, and customized attestation reporting.