A consumer lender’s exception log can run to thousands of lines across underwriting overrides, disbursement holds, and collections escalations. Reading every line is neither useful nor how supervisory-style audits work.
We start by defining strata: high-value overrides, repeated borrower IDs, and items aged beyond the firm’s own policy clock. From each stratum we draw a sample sized to the risk claim the board has already endorsed—not to an arbitrary percentage that sounds rigorous.
Process owners should expect questions about why an override was approved and whether the approving role matches the policy matrix. Vague answers such as “the system allowed it” usually lead to a finding, because the control under review is human judgement, not the interface.
If your log cannot be filtered by age or value, fix that before fieldwork. Auditors can still sample, but the remediation list will open with evidence hygiene rather than credit decisions.