An exception audit trail should let a stranger replay the decision from the record alone: who requested it, what evidence they gave, who approved and when, every change since, and how it ended. Entries should be time-stamped, attributable to a person and hard to alter after the fact.
The test: can someone replay it?
Pick one exception at random. Can you answer, from the record only, these questions? Why was it needed? Who decided? What did they see? What conditions applied? Did anything change? Is it still valid today? If you must ask a person, the trail has gaps.
Events to capture
| Event | Fields |
|---|---|
| Request created | Requester, finding, asset, reason, proposed term |
| Evidence added | What, by whom, when, a link or hash |
| Review | Reviewer, outcome, comments |
| Approval or rejection | Approver, timestamp, conditions |
| Change | What changed, old and new value, who, why |
| Control retest | Date, result, tester |
| Renewal | New term, new approver, updated facts |
| Revocation or expiry | Trigger, time, new status |
| Closure | Reason, such as fix merged, with a link |
Properties that matter
- Attribution. Every entry maps to an individual account, not a shared login.
- Timestamps from the system, not typed by hand.
- Append only. Corrections are new entries. Earlier ones stay.
- Completeness. Rejections and expired items are kept too, since they show the process works.
- Retention. Keep records at least as long as your policy and any audit needs. See how long to keep audit evidence.
- Exportable. An auditor should be able to receive a sample without screen sharing.
Evidence that holds up
Auditors sample, check the policy was followed and look for gaps. Evidence from the system is stronger than a document someone wrote later. The ideas in system-generated reports as audit evidence and compliance evidence hash, not screenshot apply directly.
Common gaps
- Approval granted in chat, then transcribed.
- Edits that overwrite the old expiry date.
- No record of who changed the status.
- A closed ticket that does not say how.
This post is general guidance. It does not imply any audit result or certification for anyone.
Where Safeguard fits
Safeguard offers compliance and evidence automation, with policies and gates that record approvals, so exception history can be exported as supporting evidence.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one piece of evidence maps to several compliance requirements.
Quick check
Is a screenshot of the approval enough?
It is weak. A system record with an account, a timestamp and a change history is stronger and easier to verify.
Should rejected requests be kept?
Yes. They show the approver applies the policy and does not approve everything.
Last reviewed: 19 October 2026.
