Qualified opinion
Also known as: "Except for" opinion, Modified opinion
A qualified opinion is issued when an auditor concludes that a subject—such as financial statements or security controls—is presented fairly in all material respects, except for specific identified issues. It indicates that while the overall system is functioning, there are certain exceptions or limitations that prevent a completely clean report. This means the findings are generally positive but contain significant caveats.
In practice
An auditor may issue this opinion if an organization meets almost all SOC 2 requirements but fails to provide evidence for one specific control, such as quarterly access reviews. The final report will state that the controls are effective "except for" the absence of those reviews.