Ageing exceptions before audit committee week

Committee week is a poor time to discover that half your open exceptions lack owners. Two weeks earlier, pull a cut of the register sorted by days open and by residual risk rating.

Send each owner a one-page ask: confirm status, attach the latest compensating-control evidence, or request a formal extension with a new expiry. Silence after three business days becomes an open finding in your summary, not a polite follow-up forever.

Separate “awaiting evidence” from “accepted risk.” Many packs blur the two, which invites the committee to treat documentation delays as risk acceptance.

If Digi Auto Hub has already reviewed your register, reuse the same severity labels so historical comparisons hold. Changing rating scales mid-year makes trend charts look better than they are.

Finally, include one paragraph on concentration: which business unit or policy holds most of the aged items. Concentration often matters more than the raw count.