Part IV · Chapter 7 · The Audit · lesson 10

When the opinion comes back with a qualification in it

12 min

Builds on An exception is a sentence in a report, not a verdict

Somebody forwards you an email from a buyer's security team. Their report came back qualified, it says, so we are pausing the renewal.

There is a reasonable chance that the report in question carries an unmodified opinion and has two exceptions in a table on page sixty-one. Those are not the same thing, and almost nobody uses the words as though they were different.

This lesson is vocabulary. It is worth the twelve minutes because the words are precise, the documents use them precisely, and the conversations around them mostly do not.

Four forms the opinion at the front of a period report can take.

Unmodified. The conclusion is given without exclusion. Commonly called unqualified, or clean.

Qualified. The opinion is modified: except for a specified matter, the conclusion holds. The matter is judged significant but bounded.

Adverse. The matter is judged significant and far-reaching enough that the conclusion does not hold.

Disclaimer. The practitioner was unable to obtain enough evidence of the right kind and therefore expresses no opinion.

The last three are all modified opinions, and only the second is qualified. A fifth thing — a report with an unmodified opinion and exceptions listed in its testing section — is not on this list at all, and it is what people usually mean.

The distinction that gets collapsed

Not the same thing

A qualified opinion

The opinion paragraph itself is modified. It states that except for a named matter, the conclusion holds.

Measured in: The wording of the opinion, at the front of the report — specifically the presence of an exclusion and what it names
For example: An opinion given on the basis that, except for one control that did not operate throughout the period, the described controls were suitably designed and operated as described.
Chase it alone and: Treating any modification as equivalent to a failed audit, when a qualification names a bounded matter and the remainder of the conclusion still stands as given.

A clean opinion with exceptions in the testing section

The opinion is unmodified, and the detailed results describe instances that did not operate as described, each with a management response.

Measured in: A count of deviations in the results tables, which sit dozens of pages behind the opinion and are what most readers never reach
For example: An unmodified opinion in a report whose results section records one of four quarterly reviews with no evidence available, and four sentences from management beside it.
Chase it alone and: Saying 'the report is qualified' because exceptions exist. It overstates what the document says, and it is the most common vocabulary error in this field.

Which is which? Put each one on a side.

The opinion paragraph excludes one named control from its conclusion and gives the conclusion for everything else.
Page 61 records three deviations out of twenty-five instances tested. The opinion on page 3 is given without exclusion.
A buyer's security team writes that the report came back qualified, because they searched the document for the word 'exception' and found two.
The practitioner concludes that one control was not suitably designed for any part of the period, and words the opinion to set it aside.

Three things that are not qualifications

A carve-out. Where part of your system is run by a supplier and their controls are excluded from your description, the report says so, in the description and in the opinion's framing. That is a stated boundary, not a modification — and it is the thing a buyer most needs to read, because the excluded part may be exactly the part they depend on.

A scope limitation that you chose. A narrow boundary produces a narrow opinion. A narrow opinion is still an unmodified opinion about a narrow thing, which is lesson one of this track in one sentence.

A short period. Three months of coverage is three months of coverage. There is nothing modified about it; there is just less of it, and the next buyer will notice.

And none of this vocabulary transfers

The ISO side has no opinion in it at all. There is a certificate, issued against a management system, and findings raised during an audit are classified — commonly as major and minor nonconformities, though the exact words and thresholds are the certification body's. A major nonconformity typically has to be addressed before certification proceeds; a certificate can be suspended or withdrawn. There is no such object as a qualified certificate.

Which means we are certified and we have an unmodified opinion for the twelve months to June are claims of different shapes, about different things, with different expiry behaviour, and a questionnaire that asks for "your SOC 2 or ISO certificate" is asking one question about two documents.

Check

A buyer asks you to confirm that your report is 'not qualified'. Your opinion is unmodified and your results section records two deviations with management responses. What is the accurate answer?

Yes — the opinion is unmodified; the results section records two deviations, on pages 58 and 61, with our responses beside themYes, it is unmodifiedNo — there are exceptions, so technically it is qualifiedThe question is malformed, so ask them to clarify what they mean

Thin evidence

Two things in this lesson are genuinely unsettled and worth flagging rather than glossing.

What buyers do with a modified opinion varies enormously and is not documented anywhere reliable. Some security teams have a written policy; many read the opinion page and nothing else; some escalate any modification to legal. There is no published distribution of buyer behaviour, so anyone describing the typical response is generalising from the handful of deals they personally saw.

The nonconformity vocabulary is close to standard but not uniform. Major and minor are the words most certification bodies use, and the thresholds, the remediation windows and the consequences are set by each body against accreditation rules that differ by scheme and by country. Read your own certification body's documentation rather than a general description of it, including this one.

Worth remembering

An opinion is unmodified, qualified, adverse, or disclaimed; the last three are all modified and only one of them is qualified.
A qualified opinion excludes a named matter and gives the conclusion for the rest, which is why the exclusion is the useful part to read.
An unmodified opinion with deviations listed in the testing section is a different and far more common object, and it is what people usually mean by 'qualified'.
A supplier carve-out, a narrow boundary and a short period are not modifications — they are stated limits, and the carve-out is often the most important page for a buyer.
A design problem cannot be cured by additional instances: a control that could not achieve its purpose as described does not improve by running more often.
ISO certification has no opinion at all — it has a certificate and classified nonconformities — so none of this vocabulary transfers between the two documents.