If a control fails during a Type 2 period, fix it right away, record what happened, and tell your auditor early. A single lapse often becomes an exception in the report rather than the end of the audit. How it is treated depends on scale, cause and how you respond.
A lapse is not always a disaster
Type 2 reports describe how controls operated over time. Auditors expect some organizations to have exceptions. Readers of the report look at how large the exception is, whether it was isolated, and what management did about it.
A report with a small exception and a clear remediation can serve a buyer better than a report that looks too clean to believe.
First 48 hours
Contain the issue. If a quarterly access review was missed, run it now. If a leaver kept access, remove it and check what was used. Capture the facts: what control, which dates, who was affected, what the cause was.
Do not backdate anything. A late review done today is labeled with today's date and a note explaining it covers the earlier period.
Tell the auditor early
Raise it before sampling reaches it. Auditors react better to a disclosed lapse with a fix in progress than to one they find. Share the root cause and the corrective action. The auditor decides how it is reported.
Fix the cause, not the instance
Ask why it failed. Common causes are an owner who left, a task with no reminder, or a tool that stopped producing a report. Then change the process: assign a backup owner, add a recurring ticket, alert on missing output.
Management response
If an exception is reported, the report may include management's response. Write it plainly: what happened, what you changed, and when it was done. Avoid blame and avoid vague promises.
An example write up
Control: quarterly review of production access. Period affected: second quarter review was completed 19 days after the planned date. Cause: the owner was on leave and no backup was assigned. Impact: no unauthorized access was found when the review was run. Correction: review completed, evidence attached. Prevention: backup owner named and a calendar reminder added for both people.
A write up like this gives the auditor what they need. It also gives your customers confidence if they read the report and see the response.
Keep perspective
Controls run by humans fail sometimes. What buyers look for is whether you notice, fix and learn. A pattern of repeated failures in the same control is more worrying than a single lapse with a solid fix, so make sure the fix is real.
Decide who communicates
Pick one person to talk to the auditor about the lapse so the story stays consistent. If customers are asking about it, agree the wording with leadership first and stick to facts: what happened, the period, and what you changed.
Quick check
Can we extend the window to get past the lapse?
Changing the period to avoid a known failure is a conversation for your auditor, and it may not be appropriate. Be open about the reason.
Last reviewed: 19 October 2026.
