Pull a random sample of five to ten exceptions, test each against the same attributes an auditor would, write down every gap, fix what you can, and keep the test notes. A dry run costs an afternoon and finds the problems that otherwise appear as audit observations.
It also shows whether the process works as written, which is a question your own team rarely asks.
Step 1: Build the full population
List every exception active at any point in the review period, including expired and revoked ones. Compare the list with the scanner's accepted and suppressed findings. Any suppression without a matching record is already a finding, so log it.
Step 2: Sample at random
Use a random number generator, not your memory. Pick 5 to 10 records, or about 10 percent of a small register. Include at least one expired, one renewed, and one emergency record if they exist, since those lifecycle events fail most often.
Step 3: Test six attributes
| Attribute | Pass looks like |
|---|---|
| Request before deviation | Request date earlier than the effective date |
| Authorized approval | Named approver with the right role |
| Independence | Approver and requester are different people |
| Scope | Single asset and version stated |
| Controls and reason | Written, specific, checkable |
| Expiry handled | Ended, renewed with review, or fixed on time |
Mark each cell pass, fail or partial. Add a note for every non-pass.
Step 4: Group the failures
Patterns matter more than individual misses. If four of eight records lack an approver timestamp, the cause is probably the template or tool. If expired records stay open, the cause is the lack of an expiry trigger. Fix the cause, not each record.
Step 5: Repair honestly
For records that can be corrected with real information, add a dated note. Never rewrite history or backdate approvals. For gaps that cannot be corrected, document them and the corrective action. A self-found, documented, corrected gap is stronger evidence of a working control than a pristine register that nobody checked.
Step 6: Keep the test
Save the sample, the results table and the fixes in your evidence folder with the date. Repeat each quarter or half year. Over time the record shows a control that monitors itself, which is more persuasive to an auditor than one clean snapshot.
Who should run it
Someone outside the approval chain is ideal, such as an engineer from another team or an internal audit function if you have one. If you are too small, rotate the job so the person testing did not approve the records under test.
NIST SP 800-30 frames risk assessment as input to decisions. Checking that exceptions follow your own rules is the same discipline applied to your process.
Where Safeguard fits
Safeguard's compliance and evidence automation can collect exception records and timestamps in one export, which makes building the population in step 1 faster.
Quick check
How often should we self-test?
Quarterly if volume is high, twice a year otherwise, and always before an audit window opens.
Does a self-test count as evidence?
It can support your monitoring story. Keep the sample, results and fixes with dates, and let your auditor decide how to weigh them.
Sources
Last reviewed: 19 October 2026.
