The Vendor Who Passed the Audit
You lead internal audit at a payments processor. Your team has just issued an unqualified opinion on the vendor-management process. Two weeks later, a routine reconciliation reveals that a critical cloud vendor's SOC 2 report had a 'qualified' opinion - the exception was buried in an appendix your auditor read but did not escalate. The vendor has access to cardholder data. There is no evidence of a breach, but the control gap (incomplete access reviews) existed for the whole audit period. Your audit committee meets in ten days. The engagement partner who signed the opinion is a respected 12-year veteran and a personal friend.
1. Assess the professional and standards implications of the missed exception, and decide what you must do before the committee meeting.
Read the worked answer
The core issue is audit quality, not the vendor. An unqualified opinion was issued on a process where a known control exception existed and was not evaluated. That is a deficiency in the audit itself.
Implications:
- The opinion may be unsupported for the vendor-management scope. Under IIA-style standards, the chief audit executive must ensure work is properly supervised and that significant findings are communicated.
- The exception was available - the auditor read it - so this is a failure to evaluate evidence, not an information gap.
- The friendship is irrelevant to the technical conclusion but relevant to how you manage the review (avoid the appearance of a whitewash).
Before the meeting:
- Re-perform a targeted review of the vendor-management workpapers.
- Determine whether the exception is material to the opinion - if yes, the opinion needs re-issuing or withdrawing.
- Discuss with the engagement partner factually, with the workpapers open, and document the conversation.
- Prepare a candid paper for the audit committee: what happened, root cause (supervision/evaluation failure, not bad faith), remediation, and whether the opinion changes.
Do not soften the paper because of the friendship. Disclose the relationship to the committee chair and let them decide whether you should recuse from any disciplinary recommendation.
2. How should the finding be communicated, and what remediation would you propose?
Read the worked answer
Communication:
- Audit committee: written, factual, unminimised. State the exception, the period affected, the fact the opinion did not reflect it, and the proposed correction. Include the root cause.
- Management: the vendor-management owner needs the control gap fixed regardless of the audit issue.
- The vendor: request a remediation plan for access reviews and evidence of completion; consider a contract clause on timely disclosure of SOC exceptions.
Remediation (audit function):
- Add a mandatory escalation step for any qualified SOC report - a checklist item that cannot be closed without CAE sign-off.
- Introduce second-level review on opinions touching third-party risk.
- Update the audit programme to require evaluation, not just reading, of vendor assurance reports.
- Track the re-issued opinion through to closure.
Judgement point: the temptation is to frame this as a vendor problem. The exam tests whether you own the audit failure, correct the opinion, and fix the process - while handling the personal relationship without letting it distort the report.