For SaaS GRC leads and CISOs
The exception queue is where good programs can quietly fail.
Your controls exist, and the tools are installed. The risk is in the backlog: items extended ninety days at a time, with no real owner and no real end date. Gruntworks makes that queue honest, then leaves you a process you can run without me.
Your call is with Glenn, author of The GRC Exception Handbook · CISSP, CISM, CISA
The problem I actually fix
Teams rarely fail SOC 2 audits because they lack a framework. They fail on exceptions: they accept the wrong risks and leave “we’ll get to it” items with no owner, no end date, and no public view of what’s aging.
That is not a documentation problem. It is an operating problem, so I look at the queue as it is, not as the policy says it should be.
What that looks like in practice
One issue opened three times, three ticket numbers, no one sure which record is true.
An action plan that restates the problem and names no owner.
A risk accepted for ninety days, then ninety more, for three years.
Chronic items never surface because the dashboard shows only this week’s opens.
Three ways to work with me
1. Exception Assessment: Start here
A fixed-fee look at your queue and the process around it. You get a findings report you own.
$6,500-$9,000 · 2-4 weeks
See what’s in the assessment →
2. Process Build
I design the lifecycle, documentation standard, review cadence, and aging view that make chronic items impossible to hide. Then I train the person who owns the queue. The deliverable is built to survive my absence.
Fixed fee - Scoped to findings
See how a build works →
3. Standing Review
Month-to-month senior judgment on the hard cases: what deserves an exception, for how long, and what is about to age into a finding. Audit prep included. No required tool.
Monthly rate depending on scope
See how a standing review works →