Part IV · Chapter 7 · The Audit · lesson 5

An exception is a sentence in a report, not a verdict

11 min

Builds on The control that ran twice in a period that wanted four

Twelve instances tested. Eleven had a dated record with an approver. One, the one from March, did not happen.

Most people's first thought is that the whole thing is over. It is worth sitting with what the document actually does with that row, because the gap between the fear and the object is enormous.

What it does is describe it. The control, the period, how many instances were examined, how many did not operate as described, and what management says about it. Four or five sentences, in a table, several dozen pages in — next to the other controls, most of which have nothing in that column.

An exception is a sentence in a report. It is not a verdict and it is not a grade.

In a report covering a period, the detailed results section exists specifically to hold observations like this: the control tested, the number of instances examined, the number that did not operate as described, and the response from the organisation. Reports carrying no exceptions at all exist and are less common than people assume, particularly in a first period.

What an exception does to the opinion at the front of the report is a separate judgement, made by somebody else, about how significant the matter is and how far it reaches. That judgement is not something anybody can predict for you — not the vendor who sold you a platform, not a course, and not a consultant. What you can control is the account that sits beside it.

Something people say

“One missed control instance means you have failed the audit.”

Why it spreads: The word audit carries a school examination attached to it, and an examination has a pass mark. Nobody who has not read a report knows there is a long section whose entire purpose is to describe things that did not go to plan, so the only mental model available is pass or fail.
The part that is true: The fear is not baseless, and this is the half worth taking seriously. Exceptions do sometimes change the opinion at the front — significance and reach are real considerations, and a control that did not operate at all, all period, is a different object from one instance out of twelve. So 'exceptions are nothing' would be the opposite error.

Which of these is the thing most within your control once the instance is already missing?

What turns it into something worse

Almost always the response rather than the event. Four shapes, in rough order of how much damage they do.

Nothing. The exception stands alone with no explanation. A reader with no account in front of them constructs one, and the one they construct is generic: this organisation does not do this reliably. The specific version — one month, one person on leave, nobody covering, now reassigned — is strictly better and costs twenty minutes.

Two accounts. One person says the review happened and was not recorded; another says it was skipped because the quarter was quiet. Both are said in good faith by people with different fragments. Now there is a question about your record-keeping sitting on top of the original row, and it is the kind that widens a sample rather than closing one.

Denial without an artefact. Asserting the review happened, with nothing that shows it. This converts a bounded observation about one instance into an open question about everything else you have asserted, which is a much more expensive object.

An artefact produced later and offered as though it were contemporaneous. This is a different category from the other three and it gets its own lesson, three along. It is the one move that turns a describable gap into a misrepresentation, and it is the one people reach for under deadline.

What keeps it small

Name the cause, specifically. Not a process gap. The named person was on leave in March, the control had no documented backup performer, and nobody was assigned.

Bound the scope yourself. Which instances, over which months, for which systems. An unbounded exception invites the question of how far it reaches, and you are better placed to answer that than anybody.

Say what has changed, with a date. A named backup performer, effective from a date, visible in the calendar and the description. A change with no date in it is an intention.

Do not decorate it. Compensating facts are worth stating if they are facts — the system had four users that quarter, all four were in the team, and the export shows no additions. They are worth stating as facts, not as a reason the gap does not count. The moment the account starts arguing, it stops being an account.

Check

Your Q1 review did not happen. You have a dated export from 31 March showing the group membership was unchanged for the whole quarter. How should that export be used?

As the Q1 review record, since it shows the same thing a review would have shownAs a fact beside the exception: the population did not move in the quarter the review was missedIt should not be mentioned, because it was not produced by the controlAs proof that the control was unnecessary that quarter

Worth remembering

An exception is a described observation in the detailed results of a report: the control, the instances tested, the instances that deviated, and your response.
What an exception does to the opinion is a judgement about significance and reach made by somebody else, and nobody can predict it for you.
The account beside the exception is the part entirely within your control, and it is usually the part left thin.
The response makes it worse in four recognisable ways: silence, two conflicting accounts, denial with no artefact, and an artefact produced later and offered as contemporaneous.
A small exception names its cause specifically, bounds its own scope, and attaches a change with a date.
Facts that bound the consequence are worth stating as facts; the moment the account starts arguing that the gap does not count, it stops being an account.