Failing a compliance audit rarely means losing a certificate outright. It usually means major nonconformities you must close, typically within 90 days, before certification is granted or an existing certificate is suspended. The real costs are the stalled enterprise deals waiting on your report, remediation consulting, and re-audit fees. Prevention is almost always cheaper than that sum.
What does "failing" actually look like?
Certification audits don't end with a pass or fail stamp. They end with a list of findings, graded by severity. A minor nonconformity is an isolated lapse: the control exists and mostly operates, but the auditor's sample turned up a gap. A major is the absence or systemic breakdown of a required control, and majors are what people mean when they say they failed. (Auditors sample, by the way. They never read everything, which cuts both ways.)
The consequences differ sharply. Minors get a corrective action plan and are usually verified at the next surveillance audit. Majors block certification at an initial audit. Found at a surveillance audit, they start a clock, because certification body rules typically give you roughly 90 days to fix the problem and produce evidence. Miss the window and the body can suspend your certificate, then withdraw it.
SOC 2 works differently, since there is no certificate to suspend. You receive a report, and every control exception the auditor found is written into it. Failing a SOC 2 audit means receiving an opinion or exception list your buyers won't accept, which commercially amounts to the same thing. If you're weighing the two frameworks, see our guide to choosing between ISO 27001 and SOC 2.
Either way, the audit fee you already paid is sunk. What a bad audit actually costs starts the day the findings land.
What do the delays cost commercially?
The direct fees (remediation consulting, the auditor's follow-up work at standard day rates) are usually the smallest line. The expensive part is what a 90-day closure window does to deals that were waiting on your certificate or report.
The numbers below are illustrative. The mechanics are real.
Say you sell workforce software at an average of A$180,000 a year per enterprise customer. Two deals are sitting in security review, an ASX-listed insurer and a state government agency, both conditional on your ISO 27001 certificate. Then your stage 2 audit surfaces one major nonconformity. Closure eats most of the 90-day window: root-cause analysis, a corrective action plan, fresh evidence, a follow-up review before the certification decision.
Both deals slip a quarter. That defers roughly A$90,000 of revenue in the current year, and it assumes both buyers wait. The insurer's procurement team has a certified competitor in the same tender. If they don't wait, you lose the full A$180,000 a year, and that loss compounds for as long as the logo would have stayed.
Then add the internal cost. Closing a major pulls your engineering lead and whoever owns the failed control into remediation for weeks. That work displaces roadmap. The displaced roadmap has a cost too, even if it never appears on an invoice.
What if the failure becomes a breach?
An audit finding is a control failing in a controlled setting. The expensive version is the same control failing in production. IBM's Cost of a Data Breach 2025 report puts the global average cost of a breach at US$4.4 million, a different order of magnitude from any re-audit fee.
For an Australian organisation the breach scenario carries extras. Notification under the Privacy Act's Notifiable Data Breaches scheme brings the regulator into the room, and meanwhile your enterprise customers are re-reading the security questionnaire you completed during procurement. A breach traced back to a control an auditor had already flagged is the worst version of this story, because the finding becomes evidence that you knew.
Seen this way, an audit failure is cheap intelligence. You paid a certification body to find the broken control before an attacker did. The finding stings. It is also the discounted price of the same information.
What are the most common audit failures?
Across frameworks the same families of findings recur: stale access reviews, unmanaged vendors, and evidence gaps. None of them are exotic. They are maintenance work that slipped, which is also why each has a plain fix.
- Access reviews that never happened, or happened without a record. The policy says quarterly; the auditor asks for the last four and gets one, undated. Fix it by scheduling reviews as recurring tasks with a named owner and recording who reviewed, when, and what they decided. The sign-off record is the control.
- Leavers with live accounts. A sampled ex-employee still holds credentials weeks after departure. Tie deprovisioning to the HR offboarding trigger rather than to memory, and hunt for orphaned accounts in every access review.
- Vendor management that stops at signing. Critical suppliers sit on the books with no due diligence on file and no reassessment since onboarding. Keep a vendor register with risk tiers, and put critical vendors on an annual reassessment cycle with the evidence attached.
- Evidence gaps. The control genuinely operated (backups ran, patches shipped) but nobody kept proof, and reconstructing proof during audit week fails. Capture evidence at the moment a control operates, filed against the control it belongs to, not in a folder built the fortnight before the audit.
- Corrective actions from the last audit left open. Nothing irritates an auditor faster than last year's findings, untouched. Track every finding to closure with an owner and a due date, and review the list monthly.
Most of these fixes are the same discipline wearing different clothes. Know your controls and who owns each one; collect the evidence as you go. That is the job a compliance register like Zavior's does year-round, so audit week becomes a retrieval exercise instead of a reconstruction.
Frequently asked questions
Can you lose an existing certificate?
Yes, but not overnight. Under certification body rules an unresolved major nonconformity typically leads first to suspension once the closure window of roughly 90 days passes without adequate corrective action, and withdrawal follows only if the suspension itself is never resolved. Outright withdrawal is rare, because you get clear chances to fix the problem first.
Do buyers see audit findings?
Often, yes. A SOC 2 report lists every exception the auditor found; buyers receive it under NDA during security review, and procurement teams read it closely. ISO 27001 findings are not published with the certificate, but sophisticated buyers frequently ask for your latest audit summary or nonconformity status during due diligence.
How fast can you re-audit?
Once your corrective actions are done and evidenced, the certification body verifies closure. For many findings that is a desk review of the evidence; only systemic failures need another on-site visit. In practice the constraint is your remediation speed plus the body's scheduling, which is why the delay tends to run weeks to a few months rather than days.
Zavior · Cyber Security
For a startup, the stalled deal in this article is the real bill. Zavior keeps the compliance evidence, security questionnaires and vulnerability assessments enterprise procurement asks for always current, so a surveillance finding is a desk-review fix rather than a major that freezes an ASX-listed buyer mid-review. The audit stops being the thing your pipeline waits on.
Book a free 30-minute startup assessment →This is general information, not legal advice.