What belongs in a policy exception register—and what does not
Registers swell when every workaround is logged as an exception. Here is a practical boundary for internal audit teams in Taiwan.
Field notes
Notes from exception reviews
Short pieces on register hygiene, committee preparation, and compensating controls that survive re-performance.
Ageing exceptions before audit committee week
A short sequence internal audit can run two weeks before committee packs are locked.
Compensating controls that actually hold up in testing
Vague promises of “extra review” fail sampling. Concrete control language that survives re-performance.
Preparing evidence packs for an exception review
How control owners can assemble files so the review week stays on schedule.