Sooner or later, a control fails during an audit period. A quarterly access review slips past the quarter. Branch protection is switched off for a migration and nobody switches it back. A leaver's account stays active for two weeks because the HR ticket never reached IT.
The instinct is to fix it quietly and hope the sample misses it. That instinct is wrong for practical reasons as well as ethical ones. This article sets out what to do instead, in order, and what the failure is likely to mean for your report or certification.
First, fix the control and contain the effect
Restore the control before anything else. Re-enable the setting, run the missed review, disable the account. Record when you did it and who did it, because the time of the fix becomes part of the record.
Then deal with what the failure may have allowed. This step is separate from restoring the control, and teams skip it.
If branch protection was off, review every change merged in that window and confirm each was legitimate.
If a leaver kept access, check the account's activity logs for the period it stayed active.
If a review was late, complete it now and act on what it finds.
If the containment work turns up something worse, such as unauthorized access to data, the control failure has become a possible security incident. Follow your incident response process. Depending on the data involved and your jurisdiction, notification obligations may apply, such as GDPR's 72-hour deadline for notifying the supervisory authority of a qualifying personal data breach. Confirm with counsel what applies.
Measure the extent
The auditor will want to know how far the failure reached, so establish it before you are asked.
When did it start? The date the setting changed, the date the review was due, the date of the termination. Use system records rather than memory.
When did it end? The date of the fix.
Which instances fell inside that window? The changes merged, the accounts affected, the reviews missed.
Is it one failure or a pattern? Check other instances of the same control across the period. A single late deprovisioning is different from a process that has been missing leavers since the period began.
The answers matter because of how testing works. As covered in how auditors sample controls, the auditor selects items from the whole period. A failure confined to a few days may or may not be selected. A pattern almost certainly will be.
Find the cause, not the culprit
The record of a control failure is more useful, and more credible to an auditor, when it explains why it happened. "The engineer forgot" is rarely the real cause. Ask what made forgetting possible.
The review relied on one person's calendar, and that person was on leave.
The migration runbook had no step to restore branch protection.
The HR system's termination notice went to a shared inbox that nobody owned.
Each of those points to a fix in the design: a backup reviewer, a runbook step, an automated ticket. A fix to the design is what stops the same failure next quarter, and it is what an auditor looks for when they ask what you changed.
Never repair the record
There is a clear line between fixing a control and fixing the evidence.
You may complete a missed review late, as long as it is dated when you actually did it. You may not date it to the quarter it should have happened in. You may document what happened after the fact. You may not create records that make the failure look like it never happened.
Tell your auditor, and when
Disclose the failure to your auditor. Most firms would rather hear early, and practice on timing varies, so ask at kickoff how they want to be told about issues during the period.
Early disclosure helps you in concrete ways.
The auditor can plan around it. They may test the control in the periods before and after the failure separately, or test the remediated design from the fix date.
Your explanation arrives with the facts. A failure you describe, with its extent, cause and fix already documented, reads differently from one the auditor discovers in a sample and has to ask about.
It protects the relationship. Auditors exercise professional skepticism. Learning that a client knew about a failure and did not mention it tends to increase the scrutiny everywhere else.
Bring a short written summary: what failed, when, the extent, the cause, the containment, and the design change. That summary also becomes the basis for the formal exception record.
What the failure means for your report
In a SOC 2 Type II
If the failure affects items the auditor tests, it is reported as a deviation in the section of the report describing tests and results. That section is read by your customers, so expect questions.
A deviation does not automatically produce a qualified opinion. The auditor evaluates whether, despite the deviation, the relevant criteria were met. That can depend on whether other controls addressed the same risk. A quarterly access review that caught the late deprovisioning is a detective control working, and that context matters. Many reports also carry management's response to each exception, although where it appears and whether the auditor reports on it varies by firm.
In an ISO 27001 audit
ISO 27001 expects things to go wrong. Clause 10.2 requires that when a nonconformity occurs, the organization reacts, evaluates the need to eliminate its cause, implements corrective action, reviews its effectiveness, and keeps documented information as evidence. A failure you found, recorded and corrected through that process is evidence the management system works. The ISO 27001 framework page covers the clause structure.
The same failure found by the auditor, with no corrective action record, is likely to be raised as a nonconformity. How it is graded depends on the auditor's judgment of its effect on the ISMS.
Stop it happening again
The best outcome from a mid-period failure is a control that cannot fail the same way. Look for the step that depended on memory and automate it, or add a check that would have caught the failure within days. A failure caught the next morning by monitoring is a minor note in the record. A failure found by an auditor months later is a finding.
Then look sideways. A failure in one control often reveals a weakness that others share. If the migration runbook had no step to restore branch protection, other runbooks may be missing steps to restore other settings. If the termination notice reached an unowned inbox, other HR notifications may go there too. Checking the neighbors costs an afternoon and can prevent the next deviation before the auditor samples it. If the gap is in the original design, revisit it with the same discipline described in fixing gaps before the observation period starts.
How TrustLynce helps
Continuous monitoring checks controls on a schedule and routes failures to their owners, so a disabled setting or an overdue review is found in days rather than at fieldwork. Findings and the evidence of each fix sit in the auditor portal, ready for the conversation with your auditor.