From time to time my clients ask what an unqualified opinion means when discussing the opinion being issued for an attestation engagement such as a SOC 1 or SOC 2 report. It is a funny-sounding term used for attestation engagements (engagements where the auditor is issuing an opinion over the audit performed of the identified criteria) falling under the AICPA guidance Statement on Standards for Attestation Engagements No. 21 (SSAE No. 21).
Let’s first identify the different types of opinions that may be issued for attestation engagements falling under the AICPA guidance, of which an unqualified report is one of them:
- Unqualified opinion
- Qualified opinion
- Adverse opinion
- Disclaimer of opinion
Types of Opinions for Attestation Engagements
SSAE No. 21 defines the different opinions that may be issued.
An unqualified opinion, also called a clean report, is one where the auditor has performed the identified audit procedures and obtained reasonable assurance about whether:
- The subject matter agrees with the defined criteria in all material aspects.
- The responsible party has fairly stated their management assertion.
- The auditor believes the evidence obtained is sufficient and appropriate to provide a reasonable basis for the report opinion.
There is no modification to the overall report opinion with an unqualified opinion.
Understanding Modified Audit Opinions
Opinions other than unqualified are defined in SSAE No. 21 as the following:
- Qualified opinion, paragraph .72: “The service auditor expresses a qualified opinion in the following circumstances:
- The practitioner, having obtained sufficient appropriate evidence, concludes that misstatements, individually or in the aggregate, are material, but not pervasive to the subject matter.
- The practitioner is unable to obtain sufficient appropriate evidence on which to base the opinion, but the practitioner concludes that the possible effects on the subject matter of undetected misstatements, if any, could be material but not pervasive.”
- Adverse opinion, paragraph .74: “The practitioner should express an adverse opinion when the practitioner, having obtained sufficient appropriate evidence, concludes that misstatements, individually or in the aggregate, are both material and pervasive to the subject matter.”
- Disclaimer of opinion, paragraph .77: “The practitioner should disclaim an opinion when the practitioner is unable to obtain sufficient appropriate evidence on which to base the opinion, and the practitioner concludes that the possible effects on the subject matter of undetected misstatements, if any, could be both material and pervasive.” This is a scope limitation.
A modification to the audit report opinion occurs with each of the three opinions defined above.
Significance of an Unqualified Opinion
The unqualified, or clean, opinion is the opinion that auditees strive to reach and is the gold standard of opinions to obtain with an attestation engagement. An unqualified opinion will provide readers of report confidence in relying on the completeness and accuracy of the services performed by the auditee for its clients subscribing to the services covered by the audit scope for a SOC 1 or SOC 2 engagement. Readers of the report are normally those clients utilizing the services of the auditee or prospective users of the auditee’s services.
Can an Unqualified Opinion be Issued Even If There Are Exceptions Disclosed in the Report?
The short answer is yes. Circumstances will arise in an audit where exceptions are identified during the testing. The auditor must assess these exceptions individually or in combination to determine if they rise to the level where an unqualified opinion cannot be issued. In this case, the auditor would determine if a qualified or an adverse opinion against the impacted subject matter is required.
The instances where an unqualified opinion may be issued even when exceptions are identified against certain controls greatly vary and are based on the specific circumstances related to that client and the audit engagement. Thus, there is no hard and fast rule on what circumstances result in an opinion other than unqualified. The decision is based on an auditor’s judgment of the particulars for that audit.
Considerations to be made when assessing an exception or the exception’s impact on the report opinion include:
- Number of controls having an exception and the relationship of these controls to each other.
- The overall impact of an exception by itself or in combination with other exceptions on a defined control or controls, and the report in totality.
- The compensating control(s) that may mitigate the impact of the identified exception(s)
An example of an exception that might be found in a SOC 2 report that would not result in a modification of the overall report opinion might be one related to AICPA Trust Services criteria CC2.2, “The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.” In this case, security awareness training required to be completed by all company personnel is one of the controls tested to meet criteria CC2.2.
When testing is performed during fieldwork, the auditor discovers that one of 25 individuals selected to test did not complete the required security awareness training. The auditor expands testing to an additional sample of 15 individuals and does not find an additional error. In this case, there is an exception disclosed in the report that would go against criteria CC2.2. However, this exception is not of the magnitude or pervasiveness to cause a qualification on the overall report opinion. An unqualified opinion is still issued.
It is quite common to have an unqualified opinion and an exception – or exceptions – defined within the report.
Key Takeaways on Unqualified Audit Opinions
An attestation engagement, as defined by SSAE No. 21, provides four different types of potential audit opinions:
- Unqualified opinion
- Qualified opinion
- Adverse opinion
- Disclaimer of opinion
The unqualified opinion is the only one that provides a “clean” or unmodified opinion. The other three potential opinions are modifications from the unqualified opinion due to different circumstances identified during, and as a result of, the audit procedures. An unqualified audit opinion is considered to be the gold standard when it comes to attestation engagements governed by the AICPA.
If you are considering having a SOC 1 audit, SOC 2 audit, or other attestation engagement performed, please see the audit services listing of Linford and Co or contact us.
Lois started with Linford & Co., LLP in 2020. She began her career in 1990 and has spent her career working in public accounting at Ernst & Young and in the industry focusing on SOC 1 and SOC 2 and other audit activities, ethics & compliance, governance, and privacy. At Linford, Lois specializes in SOC 1, SOC 2, HIPAA, ISO, and CMMC audits. Lois’ goal is to collaboratively serve her clients to provide a valuable and accurate product that meets the needs of her clients and their customers all while adhering to professional standards.