Keep the working record where the finding lives, usually the scanner or security platform, so gates can read it and enforce expiry. Link it to a ticket for the fix work and to your risk register for reporting. A spreadsheet or a ticket alone cannot block a build.
The three places
| Location | Strength | Weakness |
|---|---|---|
| Scanner or security platform | Gates read it, status updates automatically, expiry can be enforced | Weak for business context and leadership reporting |
| Ticket system | Familiar workflow, comments, assignment | Does not stop a build, easy to leave open or closed wrongly |
| GRC or risk register | Fits audit and board reporting, shows risk owners | Slow to update, disconnected from findings |
What each should hold
Scanner record, the system of record. Finding ID, component and version, asset, status, approver, expiry, link to evidence. This is what a gate evaluates.
Ticket, the work. The fix plan, tasks, discussion and who is doing what. When the fix merges, the ticket closes and the exception ends.
Risk register, the summary. Only exceptions above a threshold, with residual risk, owner and review date. See exception register vs risk register for the split, and dependency vulnerabilities in your risk register.
Rules that keep them in sync
- One record is the source of truth for status and expiry. Pick it.
- The others carry links, not copies. Copies drift.
- Closing the fix ticket should close the exception, or at least prompt a review.
- Changes to approval or expiry happen in the source of truth only.
- A monthly reconciliation compares the three and flags mismatches.
What goes wrong
- Spreadsheet as the register. It cannot enforce anything, and edits are hard to trace.
- Exception in a chat message. There is no structure, expiry or audit trail.
- Ticket marked "won't fix" as the exception. It lacks a reviewer and an end date. Read stale security tickets: close, fix or accept.
- Three live copies. Each shows a different expiry.
Auditor view
An auditor wants to see the policy, a sample of exceptions with approvals and dates, and proof the process runs. A single source of truth with a clear history makes that quick to show.
Where Safeguard fits
Safeguard keeps findings, policies and gates together and supports compliance and evidence automation, so the approval record and the exported evidence come from the same place.
Quick check
Can Jira alone serve as the exception register?
It can hold the discussion, but it will not enforce a gate or expiry on its own. Pair it with a record in the system that evaluates findings.
Do all exceptions belong in the risk register?
No. Put those above a set threshold there, and keep routine low-risk ones in the working system.
Last reviewed: 19 October 2026.
