What happens if I fail a SOC 2 audit?

SOC 2 doesn't have a binary pass/fail outcome. The auditor issues one of four opinions:

Unqualified: your controls are designed (Type 1) or operating (Type 2) effectively across the criteria in scope. This is the 'pass' most companies aim for.

Qualified: certain controls have exceptions, but the overall system is fundamentally sound. Most first-time Type 2 reports carry one or two qualifications. Enterprise buyers will usually accept a qualified report if the exceptions are narrow, isolated to specific criteria, and paired with a remediation plan.

Adverse: the auditor concludes that the controls do not achieve the criteria. This is rare and effectively unusable for enterprise sales until remediated and re-audited.

Disclaimer: the auditor couldn't collect sufficient evidence to form an opinion. Usually caused by scope confusion or missing evidence — not by control failure.

If you're heading toward a qualified opinion, the best move is to catch it during the readiness assessment phase — before the audit is engaged. Scarlet Comply flags likely qualifications during evidence collection so you can remediate before the auditor sees them.

If a qualified report is already in hand, treat it like a punch list: remediate the specific exceptions, capture evidence, and re-audit at the next window. Enterprise buyers understand this pattern — the mistake is hiding the report or letting the qualifications persist across two cycles.