When do audit analytics create too many exceptions to be useful?

Analytics create too many exceptions when the test is not tied tightly enough to the risk, criteria, and process logic. A broad outlier rule may flag thousands of items that are unusual but not control failures.

Before running the analytic, define the expected control behavior, data fields, inclusion rules, thresholds, and likely false positives. After running it, investigate exceptions and refine the logic only with documented rationale.

A large exception list is not a finding by itself. It is a prompt to understand whether the analytic is imprecise, the process is poorly controlled, or both.