The SOC 2 With Exceptions

Renew with conditions, plus a documented exit plan.

Reasoning:

• Inherent risk is high. Payroll data is a direct-fraud dataset: SSNs, bank accounts, salaries. A breach triggers state breach-notification law, potentially GDPR for non-US staff, financial loss, and reputational damage.
• Residual risk after compensating controls is tolerable for 12 months. The exceptions are process failures - missed access reviews and slow deprovisioning - not a broken control environment. Both are observable and testable from your side.
• Exit is not credible in 30 days. Four months and seven figures, plus a mid-year payroll migration, creates more operational and data-integrity risk than the vendor's exceptions.
• The undisclosed subprocessor is the more serious item. Offshore tier-1 support often means unescorted access to employee records, and you learned about it from a bridge letter.

Conditions:

• Your own quarterly access attestation, run against a full export (users, roles, last login, termination dates). You stop relying on their review process.
• SCIM included at no charge, so deprovisioning is driven by your HR system rather than their ticket queue. If they refuse, price it and buy it - it directly fixes the second exception.
• Contract: security addendum, breach notification in 72 hours or less, annual right to audit or current SOC 2 plus pen-test summary, subprocessor notice and objection rights, data return and deletion terms, termination assistance, and a named security contact rather than a sales address.
• Phishing-resistant MFA on their admin consoles, confirmed in writing.
• A written exit plan with a target migration decision at month nine so renewal does not happen by inertia.

Who decides: not the analyst. You present the assessment; the CISO or a named business owner with budget authority accepts residual risk in writing, with an owner, a date, and a review trigger.

(a) Transfer - partially appropriate. Insurance moves financial loss, not the breach: notification costs, regulatory exposure, and employee trust stay with you. Useful as a layer, never as the primary response to a control gap. Verify the policy actually covers social-engineering and payroll-diversion fraud, since many exclude it under a crime/fraud sublimit.

(b) Avoid - appropriate to consider, correctly rejected here. Eliminating the outsourced dependency removes the vendor risk but substitutes your own operating risk; most organizations cannot run payroll at better control than a specialist. Rejected on feasibility, not because the risk is acceptable.

(c) Mitigate - most appropriate. Reduces likelihood and impact directly and fixes the specific exceptions observed, while improving your ability to detect a recurrence.

(d) Accept - done improperly. Acceptance is legitimate only when it is knowing, made by someone with authority, documented, and given a review date. 'Switching is expensive' is a cost argument that may support renew-with-conditions; it is not a risk acceptance. Unrecorded acceptance is precisely what auditors write up.

These are not mutually exclusive. The realistic answer is (c) as the primary response, (a) as a financial backstop, and a signed, dated acceptance of what remains.

Metrics that are observable and hard to game:

• Access review completion, quarter by quarter, with evidence you can sample - not 'performed: yes' but reviewers, dates, and decisions.
• Deprovisioning latency: median and 95th percentile days from HR termination to account disabled, pulled from their export and compared against your HR feed. Target one day or less; the current exception was 45.
• Exception count and severity in the next SOC 2, plus whether prior-year exceptions recurred. Recurrence is the real signal; a fresh exception is a different problem from a repeat one.
• Subprocessor inventory: complete list, notice lead time, and whether you were notified before rather than after.
• Your own attestation findings: count of inappropriate entitlements your check found that their process missed. This measures their control, not their paperwork.
• Incident notification timeliness, measured on any event during the year, however minor - it predicts behavior in a real breach.
• Contract deliverables met: SCIM live by a stated date, pen-test summary delivered, security contact responsive.

Set the decision rule now, not later: if deprovisioning latency is still above seven days at the nine-month checkpoint, or the same access-review exception appears again, the exit plan becomes the plan. Record that in the committee minutes so next year's review is a test with a defined outcome rather than a conversation.