Auditors usually ask who approved an exception, on what evidence, for how long, what happened at expiry and whether the approver was independent. A good answer is a short statement plus a record you can open. Prepare these ten answers before the request list arrives.
Why preparation helps
Auditors sample. They pick a few exceptions and test each against your written policy. Your goal is not to impress them, it is to make each sample easy to verify. The questions below are common themes, not a fixed list from any one standard, so adapt them to your framework and ask your auditor for theirs.
The ten questions
1. Is there a documented exception policy? Show the policy, its owner, version and last review date.
2. Who can approve, and does it depend on severity? Show the approval matrix. See who can approve a vulnerability exception by severity.
3. Was the approver independent of the requester? Show that they are different people, and what happens when the usual approver is the requester.
4. What evidence supported the decision? Open the record and show attached proof. See what evidence supports each exception reason.
5. How long was it approved for? Show start and expiry timestamps and the maximum term in policy.
6. What happened at expiry? Show the notification, the renewal or closure and the gate behaviour.
7. Were compensating controls tested? Show test results with dates.
8. Is the population complete? Show that the export contains active, closed, expired and denied items, with generation details.
9. How do you know builds respected the exceptions? Show the gate log joining build IDs to exception IDs.
10. What did you do about exceptions that were too long or never closed? Show the aging report and the actions taken.
Answer format that works
| Part | Example |
|---|---|
| Direct answer | "Exceptions over 30 days need a director" |
| Policy reference | Section and version |
| Record | Link or export row |
| Exception to the rule | Any deviation, with explanation |
Be honest about gaps. An auditor who finds a gap you disclosed and have a plan for reacts differently from one who finds it alone. Never describe controls you do not run. Compare with soc 2 audit exceptions: what they are and how to avoid them, which uses the word in a different sense, an auditor's finding.
A dry run
Two weeks before an audit, pick ten exceptions at random and answer all ten questions for each from records alone. Time how long it takes. Anything that needs a Slack search is a gap.
What to fix first
Most teams find the same gaps: missing evidence links, approver not recorded, expired items with no closure and an incomplete export. Fix those and most of the questions answer themselves.
Safeguard's compliance and evidence automation is meant to collect records and map them to framework controls, and its policies and gates produce the enforcement logs that tie builds to decisions. Nothing here implies any certification, which depends on an independent auditor's work.
Try it yourself
Click through it at your own pace, or open it full screen.
See how controls connect to evidence, which is how an auditor reads your records.
Quick check
Do all auditors ask the same questions?
No. Themes repeat, but scope and wording differ. Ask for the request list early.
Should we show denied requests?
Yes. They demonstrate the approval step is a real decision.
Last reviewed: 19 October 2026.
