GRC & Audit Support · Lesson 7 of 8
Writing findings and exceptions
A finding should be specific enough to fix and fair enough to defend. An exception is a recorded decision to depart from an expectation under defined conditions.
A finding and an exception are different records
Fictional offboarding review.
- Finding
Two sampled leavers retained access past the required deadline. Record the criterion, evidence, impact, and correction owner.
- Exception
An authorized, documented departure from a requirement. Record scope, justification, safeguards, approval, and expiry or review date.
Read the visualWhat if a team asks you to label the finding “accepted” without a decision record?
Keep the finding accurate and route any acceptance request to the authorized decision-maker.
Describe the gap
State the expectation, observed condition, and supporting evidence. Avoid blaming individuals.
Make remediation actionable
Identify an owner, due date, and verification step. Explain the practical consequence of the gap.
Bound exceptions
Record scope, justification, safeguards, approver, and expiry. A permanent undocumented exception undermines review.
Put it in context
Two sampled leavers retained access beyond the stated deadline. Your finding lists the ticket references and requests process correction plus verification of those accounts.
A useful finding connects evidence to a specific corrective action.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.