Auditors typically ask for the complete population of exceptions in the audit period, choose a sample from it, and test each sampled item for the same attributes: who approved it, whether the scope and reason were recorded, whether it expired or was renewed on time, and whether anyone followed up. How they sample is the auditor's call, so ask early.
That means the list itself is the first thing under test. If the list is incomplete, every sampled item is a side issue.
Step 1: Produce a complete population
The auditor needs every exception that was active at any point in the period, including ones that expired or were revoked. A common failure is exporting only the currently active ones. Pull closed and expired records too, with start date, end date, and status.
Sanity check the population before handing it over. Compare it with your scanner's accepted or suppressed findings. If the scanner shows 60 suppressions and your register shows 22 records, you have a gap to explain, and you want to find it first.
Step 2: Know the attributes they will test
Expect the test to look like a checklist. For each sampled exception, can you show:
| Attribute | Typical evidence |
|---|---|
| Request made before the deviation | Ticket creation date earlier than the effective date |
| Approved by an authorized person | Approver name, role, timestamp |
| Approver independent of requester | Two different identities |
| Scope recorded | Asset, component, version |
| Reason and compensating controls recorded | Free text plus any linked evidence |
| Expiry set and enforced | End date, plus what happened on that date |
| Closed out | Fix commit, or renewal with fresh review |
Gaps in any column become observations. The most common ones are approval after the fact, no expiry, and an expired record that stayed open.
Step 3: Make retrieval boring
During the audit, a sampled item should take minutes to explain, not days. Give each record a stable ID, link the ticket to the scanner finding, and keep approvals in the same system as the request. Screenshots pasted into a shared drive age badly. An export with timestamps ages well.
Step 4: Rehearse with your own sample
Pick five records at random, using any random number generator, and walk each through the table above as if you were the auditor. Fix whatever you cannot answer. Do it again next quarter. NIST SP 800-30 describes risk assessment as the information leaders use to choose a course of action. An exception record is that choice written down, and a sample puts it under a microscope.
What not to do
Do not edit old records to make them look cleaner. Add a dated note instead. Auditors care about the integrity of the trail more than a perfect trail, and a dated correction reads as a working control.
Where Safeguard fits
Safeguard keeps exceptions tied to findings, assets and components, and its compliance and evidence automation can export the records an auditor asks for. Whether that satisfies your auditor's sampling depends on how you configure the process.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how evidence is organized against control requirements, and think about which record you would hand over for each.
Quick check
Do auditors test every exception?
Usually not. They commonly test a sample, but the sample comes from your full list, so the full list must be complete.
Should expired exceptions stay in the export?
Yes. Anything active during the audit period belongs in the population, even if it ended months ago.
Sources
Last reviewed: 19 October 2026.
