During a SOC 2 Type II engagement, an auditor finds that a daily backup failed 3 times out of 365 days. The backups were successfully retried the next day. How should the auditor handle this?

Answer options:

Issue an Adverse Opinion.

Hide the exceptions since they were retried.

List the exceptions in Section IV but conclude the control operated effectively if the objective was met.

Switch to a Type I report.

How to approach this question

Auditors must report facts (exceptions) but use judgment for the opinion.

Full Answer

C.List the exceptions in Section IV but conclude the control operated effectively if the objective was met.✓ Correct

Exceptions must be noted in the testing results (Section IV). However, if the failure didn't prevent the system from meeting its objectives (e.g., data was recoverable), it may not result in a modified opinion.

Common mistakes

Thinking any exception = Adverse opinion.

Question 72 All questions Question 74

Practice the full CPA ISC Practice Exam 5

82 questions · hints · full answers · grading

More questions from this exam

Q01A service organization provides a cloud-based payroll processing application to its user entities...Medium Q02An auditor is reviewing the shared responsibility model for a client using an Infrastructure as a...Hard Q03A financial institution requires a cloud deployment model that offers the highest level of contro...Medium Q04During an IT audit, you observe that a company uses a 'Hybrid Cloud' architecture. Which scenario...Medium Q05Which component of IT architecture is primarily responsible for translating domain names (like ww...Easy

View all 82 questions →