An exception report is a management document that lists only the transactions, employees, accounts, or events that fell outside a pre-set normal range during a review period. Instead of reading every line of activity, you see a filtered list of items that crossed a threshold you defined in advance, so you can investigate the outliers and leave the rest alone. That filtering is the entire point of the exception report: it puts a manager’s attention on what’s abnormal and keeps routine data out of the way.
How the Mechanics Work
Every exception report starts with two numbers. The first is the expected figure, which is your baseline: a budget line, a staffing target, a reorder quantity, a contract price, or any other benchmark the organization tracks. The second is the actual result collected during the period. The gap between them is the variance, and when the variance breaks a rule you set, the item lands on the report.
Most organizations produce these reports out of their enterprise resource planning or accounting software rather than assembling them by hand. The system pulls the relevant date range, department, and transaction or employee identifier automatically and returns a clean list of items that need a human decision. Everything running as expected stays off the page.
Setting Thresholds That Actually Help
The rules you build determine whether the report earns its place in a manager’s morning or gets ignored. Two approaches are common. Percentage rules flag any result that deviates from the baseline by more than a set margin, such as expenses running 10% over budget. Fixed-dollar rules flag any single transaction above a specific amount, such as a purchase order exceeding $5,000. Many organizations layer both so a low-dollar line item with a large percentage swing still surfaces.
Set the limits too low and the report fills with minor fluctuations no one has time to chase. Set them too high and genuinely concerning items slip past. Either way, reviewers stop trusting the report and start rubber-stamping it. That’s alert fatigue, and the fix is periodic recalibration. If a large share of flagged items keep closing with no corrective action needed, the thresholds are too sensitive. Adjusting them at least annually keeps the list focused on items that genuinely warrant investigation.
Where Exception Reports Get Used
Financial Controls
Finance teams use exception reports to catch unauthorized spending, duplicate payments, and budget overruns before they compound. A typical setup flags any disbursement missing the required approval chain or any expense category that exceeds its quarterly allocation. For publicly traded companies, this work also carries a legal weight. Section 404 of the Sarbanes-Oxley Act requires management to assess and report on the effectiveness of internal controls over financial reporting each year, and an independent auditor must attest to that assessment.1U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control Over Financial Reporting Requirements Exception reports are one of the main tools companies use to show those controls are working.
Inventory
Warehouse and supply chain teams use exception reports to flag stock that has dropped below a predetermined reorder point. The system surfaces only the items at risk of stocking out, rather than making a buyer scan thousands of line items each morning. The reverse case matters too: an unexpected inventory spike for a slow-moving product can signal a receiving error or a demand forecast that needs updating.
Overtime and Labor Costs
In HR, exception reports commonly track hours. Federal law requires overtime pay for any hours worked beyond 40 in a single workweek, at a rate of at least one and a half times the employee’s regular pay.2U.S. Department of Labor. Fact Sheet 23 – Overtime Pay Requirements of the FLSA A report flagging employees approaching or crossing the 40-hour mark lets supervisors intervene before labor costs run. The consequences of missing this are real: employers who willfully or repeatedly violate federal overtime rules face civil penalties of up to $2,515 per violation, plus back wages and potentially an equal amount in liquidated damages.3eCFR. 29 CFR Part 578 – Tip Retention, Minimum Wage, and Overtime Violations
Vendor Billing
Procurement teams use exception reports to catch discrepancies between what a vendor’s contract promises and what the vendor actually bills. Typical triggers are outdated pricing applied instead of negotiated discounts, duplicate charges for the same deliverable, and fees for services never specified in the contract. Individual invoices often look reasonable in isolation, so the pattern only becomes visible when the report aggregates it.
IT Security
Security teams generate exception reports from system audit logs, flagging events like repeated failed login attempts, access requests outside normal hours, or users reading data outside their permission set. The National Institute of Standards and Technology recommends that organizations log security-relevant events and regularly review those logs for signs of compromise.4National Institute of Standards and Technology. SP 800-53 Rev 5 – Security and Privacy Controls for Information Systems and Organizations The exception report is how that review happens at scale: analysts set rules for abnormal behavior and look at only the events matching them.
When the Report Is Effectively Required
Some industries operate under federal rules that require this kind of monitoring, even when the regulations don’t use the phrase “exception report.”
Banking
Financial institutions must file a Suspicious Activity Report whenever they detect a transaction of $5,000 or more that they suspect involves money laundering, fraud, or other illegal activity. Separately, any cash transaction over $10,000 triggers a Currency Transaction Report regardless of whether anything looks suspicious.5FinCEN. Notice to Customers – A CTR Reference Guide Banks meet these obligations with automated exception reports that scan transactions against the dollar thresholds and against behavioral patterns, such as a customer who suddenly starts making deposits just under $10,000. Institutions must keep copies of any SAR and its supporting documentation for at least five years from the filing date.6eCFR. 12 CFR 163.180 – Suspicious Activity Reports and Other Reports and Statements
Healthcare
Organizations covered by HIPAA must implement audit controls that record and examine activity in systems holding electronic protected health information. The HIPAA Security Rule requires regulated entities to review records tracking access to patient data and to detect security incidents.7HHS.gov. Summary of the HIPAA Security Rule Exception reports built from audit logs are the standard way covered entities carry that out.
Reviewing and Resolving What Gets Flagged
Producing the report is the easy part. The review is where an organization either builds a compliance record or creates liability. Once the system generates the list, it goes to a designated reviewer, usually a supervisor or compliance officer, who investigates each item and identifies the root cause.
Not every exception is a problem. A budget variance might reflect a legitimate one-time purchase that was properly authorized but fell outside normal parameters. When that’s the case, the reviewer documents the explanation and closes the item. What matters is that the investigation happened and the reasoning is on the record. An exception closed with a documented justification protects the organization far more than one that was never reviewed.
Segregation of Duties
One control principle trips up smaller organizations. The person who generated the transaction being flagged should not be the same person who reviews and resolves the exception. Segregation of duties means splitting the responsibilities for initiating, processing, reviewing, and approving transactions across different people. When one person handles all of those steps, errors go undetected and fraud becomes easier. If the team is too small to fully segregate every function, compensating controls like a secondary sign-off or a periodic external review can fill the gap.
Documentation
A finalized exception report should include the nature of the deviation, the root cause identified during investigation, the corrective action taken, who resolved it, and when. This is the record auditors and regulators will look at. Vague notes like “resolved” or “no issue” are essentially worthless in that context. The resolution entry should be specific enough that someone reading it two years later can understand what happened and why the reviewer considered it addressed.
How Long to Keep Them
Retention depends on the regime. Publicly traded companies subject to Sarbanes-Oxley must retain audit-related records, including workpapers and documents containing conclusions or financial analyses, for seven years after the audit or review concludes.8U.S. Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews Financial institutions under Bank Secrecy Act rules must keep SAR filings and supporting documentation for five years.6eCFR. 12 CFR 163.180 – Suspicious Activity Reports and Other Reports and Statements HIPAA-covered entities must retain security documentation for six years. The IRS separately requires businesses to keep employment tax records for at least four years after the tax is due or paid, whichever is later, which sweeps in any exception report documenting payroll anomalies or overtime flags.9Internal Revenue Service. Recordkeeping The safe practice is to align the retention schedule with the longest requirement that applies and treat that as a floor.