--- sourceDocument: Australia Impact sourceDocumentLink: https://www.servicenow.com/docs/r/australia/impact Release : - australia ft:locale : - en-US ft:publication_title : - Australia Impact ft:clusterId : - ipact bundleId : - ipact --- # Exception handling in Scan Engine # Exception handling in Scan Engine {#ariaid-title1} Release version: Australia Updated August 22, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Exception handling in Scan Engine Exception handling in the Scan Engine allows developers and administrators to manage scan findings that are out of scope, pre-existing, or represent acceptable risks. This feature supports enterprise approval workflows, predictable lifecycle management, and governance by enabling exceptions to findings so that they do not impact technical debt metrics or block critical workflows like Update Set closure. Show full answer Show less ## Key Features * **Exception Reasons:** Allow developers to submit requests to exclude specific findings from technical debt calculations and form blocking based on organizational rationale and approval. * **Exception Reason Scope:** Administrators configure which finding severity levels (Suggest, Review, Recommend, Act) allow exception submissions, tailoring exception handling to organizational risk policies. * **Approval Workflow:** Designated approval groups review and approve or reject exception requests. Administrators can enable auto-approval or require explicit approvals. * **Enforcement:** Rejected exception requests can enforce read-only status on affected objects until the issue is resolved or a new exception is submitted. * **Re-evaluation Controls:** Administrators determine if approved exceptions automatically apply to repeated findings in future scans or require re-approval, including handling changes like line number shifts in code. * **Finding Levels and Impact:** Findings are classified into four levels (Suggest, Review, Recommend, Act) with exception eligibility and blocking behavior configured per level to align with risk severity. ## Key Outcomes * **Unblock critical workflows:** Exceptions prevent out-of-scope or acceptable risk findings from blocking Update Set closure and other development processes. * **Accurate technical debt metrics:** Exclude pre-existing or non-actionable findings from technical debt calculations to maintain meaningful metrics. * **Governed approval process:** Maintain audit trails and organizational governance through configurable approval groups and workflows. * **Flexible organizational fit:** Customizable exception scopes and approval behaviors allow alignment with enterprise policies and risk tolerance. ## Practical Application for ServiceNow Customers ServiceNow customers can leverage Scan Engine exception handling to better manage security and quality findings by excluding known or acceptable issues from blocking development progress and skewing technical debt metrics. Administrators should configure exception scopes and approval workflows to match organizational policies. Developers can then submit exception requests with rationale, which approvers review to maintain governance. This process ensures that only relevant findings impact release readiness, improving development efficiency without compromising on security oversight. ## Next Steps * Configure exception approval behavior, including scopes, approval groups, and re-evaluation settings. * Train developers on submitting exception requests for findings that are reviewed and deemed acceptable. * Define roles and permissions clearly to separate responsibilities for submitting exceptions, approving requests, and configuring exception settings. Exception handling enables developers and administrators to manage findings that are out of scope, pre-existing, or acceptable risks. The Scan Engine exception model supports enterprise approval workflows, predictable lifecycle behavior, and reliable governance across all finding levels. ## What are exception reasons {#exception-handling-overview__what_are_exceptions} Exception reasons allow developers to request that findings be excluded from technical debt metrics and blocked workflows. When a finding is detected that an organization determines should not be considered an issue, developers can submit an exception request with supporting rationale. After approval by designated administrators, the finding is excluded from technical debt calculations and no longer blocks form submissions. Exception handling serves several key purposes: * Unblock Update Set closure when findings are out of scope or represent acceptable risks * Exclude pre-existing or non-blocking issues from technical debt metrics * Maintain audit trails showing which findings have been reviewed and approved * Support enterprise governance patterns where approvals follow organizational structures ## Exception reason scope {#exception-handling-overview__exception_scope_model} Exception reason scope controls which finding levels can have exception reasons submitted and approved. Administrators configure the scope to match organizational needs. Three scope options are available: {#exception-handling-overview__exception_scope_model__entry__2} | Scope Option | What it means | |-|-| | Recommend only (default) | Exception reasons can only be submitted for Recommend level findings. Suggest, Review, and Act level findings don't display exception submission options. | | Act and Recommend | Exception reasons can be submitted for both Act and Recommend level findings. Suggest and Review level findings don't display exception submission options. | | All levels | Exception reasons can be submitted for Suggest, Review, Recommend, and Act level findings. All four levels display exception submission options in the Findings panel. | [Table 1. Exception reason scope options] The exception scope you select determines the user experience in the Findings panel. When exception reasons are enabled for a finding level, developers see a Create exception button on the finding card. When exceptions aren't enabled for a finding level, the button won't appear. ## Approval and enforcement {#exception-handling-overview__approval_and_enforcement} After a developer submits an exception request, designated approval groups review the request and either approve or reject it. Approvers can be different from administrators who configured the exception settings. When an exception is approved, the finding is automatically excluded from technical debt metrics. Key approval behaviors include: Approval groups : Administrators assign one or more groups that receive exception requests and notifications. Approvers within these groups review and respond to requests. Auto approval : Administrators can configure exception requests to be automatically approved or to require explicit approval. Enforce rejected validations : When enabled, if an exception request is rejected, the linked object is set to read-only until the finding is resolved or a new exception is submitted. Re-evaluation on new findings : Administrators control whether approved exceptions automatically apply when the same issue is detected in a subsequent scan, or whether they require re-approval. Re-evaluation on line changes : Administrators control whether approved exceptions remain valid when the finding's line number changes in the code, for example after a refactor. ## Exception lifecycle {#exception-handling-overview__exception_lifecycle} ## Finding levels and exception eligibility {#exception-handling-overview__finding_levels} The Scan Engine classifies findings into four levels based on severity and risk: {#exception-handling-overview__finding_levels__entry__3} | Level | Severity | Form blocking and exception behavior | |-|-|-| | Suggest | Low | Doesn't block form submission. Exception reasons can be submitted if the scope is set to All levels. | | Review | Low-Medium | Doesn't block form submission. Exception reasons can be submitted if the scope is set to All levels. | | Recommend | Medium-High | Blocks form submission when real-time enforcement is enabled, unless an approved exception reason exists. Exception reasons can be submitted if the scope is set to Recommend only, Act and Recommend, or All levels. | | Act | Critical | Blocks form submission when real-time enforcement is enabled, unless an approved exception reason exists. Exception reasons can be submitted if the scope is set to Act and Recommend or All levels. | [Table 2. Finding levels and exception behavior] ## Common use cases {#exception-handling-overview__use_cases} Out-of-scope findings : A definition triggers on utility functions or platform code that your team intentionally excludes from scanning. Rather than disabling the definition, submit exceptions for out-of-scope matches so the definition remains active for other code contexts. Pre-existing issues : A finding identifies an issue that exists in legacy code. Rather than blocking Update Set closure, submit an exception with a plan to remediate in a future release. Acceptable risks : A finding identifies a pattern that your team has reviewed and determined is acceptable for your use case. Submit an exception to exclude it from technical debt and avoid form blocking. Update Set closure : An Update Set contains a finding at Act level that prevents closure. Developers submit an exception explaining why the change is necessary. Approvers review and approve, allowing the Update Set to proceed. ## Roles and permissions {#exception-handling-overview__roles_and_permissions} Exception handling requires specific roles and permissions. Developers can submit exceptions when they have developer roles. Administrators configure exception settings when they have admin or Scan Engine admin roles. Approvers can be any user assigned to an approval group. See [Roles installed with Impact](https://www.servicenow.com/docs/w6bGTgRNL_JzK97jQY2KWw "Impact offers many roles to assign to fit your business needs. When you log in to Impact, you’ll see a personalized view of your objectives, metrics, and recommendations tied directly to your role.") for detailed role descriptions, including roles that manage exception approvals. ## Related tasks {#exception-handling-overview__related_tasks} To implement exception handling in your organization, see: * [Configure exception approval behavior](https://www.servicenow.com/docs/ZRAVxTQt6DfHOVQH_llu4g "Configure how exception reasons are enforced, approved, and re-evaluated when findings are detected using the ServiceNow Scan Engine.") --- Configure the exception reason scope, approval groups, and re-evaluation behavior. * [Submit exceptions for Scan Engine findings](https://www.servicenow.com/docs/Z74L4vWv_WqdxPMevS6QwA "Developers can submit exception requests for Suggest, Review, Recommend, and Act level findings if they determine the finding should not be considered an issue to deter development. The availability of each finding level depends on the exception reason scope configured by your system administrator.") --- Submit exception requests for findings that your team has reviewed. * [Configure exception reason properties](https://www.servicenow.com/docs/k4b~I5SG5QnWft0pzNNTdA "When real-time enforcement, enforce_real_time_validation is set to true, Recommend level findings require an approved exception reason before the form can be saved.") --- Configure detailed exception reason settings including enforcement and technical debt exclusion.