Detection is a commodity. Every AI tool can surface policy violations. What regulated enterprises need is not a list of problems — it is an auditable record of every decision made in response to those problems: who accepted a risk, under which rule, with whose sign-off, and when that acceptance expires.

Quality Clouds Debt Manager is that record. It maintains a complete, line-item ledger of every policy violation across your ServiceNow and Salesforce instances — each finding linked directly to the configuration element that triggered it, the rule it violated, the team that owns it, and the time elapsed since detection. This is not a dashboard with aggregated scores. It is a ledger that an auditor can trace from any finding back to the rule, the artefact, the responsible team, and every governance decision made along the way.

Accepting a known violation is a governance decision. Debt Manager enforces that decision through a segregation-of-duties workflow: one person requests a write-off with a reason code and justification; a different person approves or rejects with their own documented rationale. Both identities and both timestamps are captured separately. Every exemption carries an expiration date — including an explicit "Never" option when permanent acceptance is the deliberate choice. No exemption exists without two distinct human decisions.

Every finding moves through a four-state lifecycle: Open → Pending Write Off → Written Off → Closed. No finding skips a state. The lifecycle is the audit trail.

The entire ledger exports to SARIF — the OASIS standard that DevSecOps pipelines, SIEM platforms, and audit tooling already consume. This transforms Quality Clouds from a governance tool into a governance signal: structured, machine-readable regulatory evidence that feeds directly into your DORA Article 9 evidence pack, your SOC 2 audit bundle, or your EU AI Act documentation set. XLS export is also available for compliance teams that need human-readable formats. Debt Manager runs on both ServiceNow and Salesforce — same workflow, same lifecycle, same export. One accountability record across both platforms.

Key benefits

• Complete line-item ledger of every policy violation — not an aggregated dashboard

• Segregation of duties: two distinct identities, two timestamps, documented justification for every exemption

• Four-state finding lifecycle: Open → Pending Write Off → Written Off → Closed — no finding skips a state

• Every exemption carries an expiration date — risk acceptance has a defined horizon, not an indefinite pass

• SARIF export: machine-readable governance data that feeds directly into DORA evidence packs, SOC 2 bundles, and EU AI Act documentation

• XLS export for human-readable compliance review

• Runs on ServiceNow and Salesforce — one accountability record across both platforms

• Produces governance data applicable to DORA Article 9, the EU AI Act, SOC 2, ISO 27001, and FCA documentation programmes