I'm setting up our Secureframe instance and trying to keep the main control list clean. We have a few systems that need temporary exceptions or are out of scope, but I don't want them to hide the important gaps.
What's the best practice here? Should I use tags, a custom field, or a separate policy document? I'm worried about exceptions getting lost or forgotten if they're not right in the platform.
I manage our Secureframe deployment for a 200-person fintech, handling exception workflows for both audit prep and daily compliance monitoring.
The best way to handle exceptions is to use a **custom field on the control requirement itself**. Here's the breakdown of options:
* **Cleanliness of Main View:** Custom fields win. Add a field like `Exception Status` with options like "Temporary Exception - Expires [Date]", "Out of Scope - Justification", and "Compensating Control". Filter or sort the main control list on this field. It keeps exceptions visible but separate from standard "Fail/Pass" states.
* **Audit Trail & Accountability:** Tags are insufficient. A custom field can be made required when a certain status is selected, forcing documentation of an owner, JIRA ticket, and review date directly on the control record. This is critical for auditors.
* **Avoiding Alert Fatigue:** Integration effort is low with custom fields. You can build automated Slack or email alerts in Secureframe that trigger *only* when the `Exception Status` is set, or when an exception's review date is approaching, preventing you from being spammed by known issues.
* **The Honest Limitation:** This doesn't scale for dozens of permanent exceptions. If you have more than 10-15 recurring out-of-scope items, you need a separate policy document referenced from the custom field. The platform UI will get cluttered again.
My pick is the custom field approach. It's the best blend of visibility and structure without leaving the platform. To be sure, tell us how many systems need exceptions and if your auditors require a separate, formal exceptions register.
garbage in, garbage out
Great point about custom fields for the audit trail, that's crucial. I've seen teams try to manage exceptions in separate spreadsheets and it always leads to a scramble before the audit.
One extra tip, building on your automated alerts idea: set those alerts to go to a compliance *channel* in Slack or a *distro list* in email, not just the control owner. It creates a natural oversight loop so nothing slips through the cracks when someone is OOO.
What do you do about exceptions that become permanent? Do you eventually convert them to an "out of scope" status or document them in a separate policy annex?
automate the boring stuff
Your worry about exceptions getting lost is the key thing. That's exactly why a separate policy doc or spreadsheet is risky, it becomes out of sight, out of mind.
A custom field is the right path to keep them *in* the platform but *out* of the main pass/fail counts. The trick is setting a mandatory review date on any 'Temporary Exception' status. Secureframe can flag it when that date passes, so you can't just set and forget.
I'd also add a simple 'Exception' tag to all of them, on top of the custom field. That gives you a one-click filter to review *all* exceptions, regardless of their specific status, during a compliance check-in.
Spreadsheets > marketing slides.