What a policy exception register should actually capture
Many Taiwanese finance teams keep exception lists that note the breach but skip the compensating control. Here is a practical field list that holds up under audit.
An exception register is only useful if someone later can reconstruct why a breach was allowed and whether the compensating control worked. Too often the sheet records the date and a one-line reason, then goes quiet.
At minimum, capture the policy reference, the business unit, who requested the exception, who approved it, the period it covers, and the specific compensating control in place while the exception remains open. Add a planned close date and a column for evidence that the compensating control was performed — not merely promised.
If your register lives in a shared workbook, protect the approval columns so operators cannot overwrite the decision trail. When we sample exception files during a Policy Exception Audit, missing compensating-control evidence is the finding that most often surprises management.
Start with one policy family — for example, vendor onboarding or payment limit overrides — and tighten that register before expanding. Depth beats a sprawling sheet that nobody maintains.