What belongs on a policy exception register

Audit committees lose patience when registers mix genuine policy breaches with every late invoice stamp. The first discipline in policy exception reporting is deciding what earns a row.

Start from the clause

If you cannot point to a sentence in the finance or treasury manual, it is not yet an exception — it may be a control weakness to note elsewhere, or a training issue. Registers that cite “general best practice” invite rewrite requests.

Separate waivers from silent breaches

An approved waiver that followed the manual’s waiver path is still worth listing when the committee wants visibility, but it should carry a different status from a payment that never sought approval. Collapsing both into “exceptions” hides whether management is using the waiver process or ignoring it.

Drop timing noise carefully

A journal posted one day after the stated cut-off may be a breach of the cut-off policy or a documented period-end practice. Read the manual before the sample. Hong Kong groups with multi-entity closes often have written timing exceptions that junior testers misread as failures.

Keep aged items visible

Open exceptions without owners are what chairs ask about first. If remediation slipped, say so on the register; do not archive the row to tidy the pack.

When we run policy exception reporting engagements, classification rules are agreed in week one so the draft workshop is not a debate about vocabulary.