- Exception reference, origin, category, and detection
- Creates one stable record linked to the source report, department, process, control, date, detector, duplicate screening, and related incidents, variances, issues, or actions.
- Severity, exposure, impact, and confidence
- Separates verified loss, estimated exposure, operational impact, guest impact, compliance relevance, likelihood, materiality, urgency, and confidence instead of combining them into one vague priority.
- Evidence, preservation, and known limitation
- Records documents, system logs, video, transactions, statements, data extracts, retention holds, access restrictions, missing sources, contradictions, and what the current record cannot establish.
- Temporary control and residual risk
- Documents immediate containment, authority, start time, affected scope, effectiveness check, side effects, review frequency, expiry, and remaining exposure while the exception is unresolved.