Identification
Project name, contract number, reviewer name, and effective date so the Exhibit is uniquely attributable.
A clear Exhibit reduces ambiguity about system expectations, creates an auditable record of findings and approvals, supports contractual compliance, and helps prevent scope creep or disagreements. It also establishes a timeline for corrective actions and preserves evidence for internal and external audits.
Typical preparers, reviewers, and recipients of the Exhibit vary by organization and contract role.
Use the Exhibit to align internal teams and external parties on findings, remedies, and signatures required for closure.
The Project Manager documents review results, confirms acceptance of recommended corrective actions, and attests that changes align with project baselines. They typically sign to acknowledge operational acceptance and to commit to remediation timelines in the Exhibit.
The Contracting Officer or authorized contract representative confirms whether the Exhibit satisfies contractual review requirements, approves any scope changes, and signs to create an enforceable acceptance or condition precedent under the contract.
Project name, contract number, reviewer name, and effective date so the Exhibit is uniquely attributable.
Clear description of systems, processes, dates, and exclusions to avoid ambiguity about what was assessed.
Referenced logs, reports, and attachments with file names and locations for reproducible verification.
Concise description of deviations, risks, and severity level tied to objective evidence.
Corrective actions, responsible party, and due dates for resolution and verification.
Names, titles, signature date fields, and any witness or notarization blocks if required.
| Field | Configuration |
|---|---|
| Field mapping | Map form fields to project metadata for tracking |
| Conditional fields | Show fields only when applicable |
| Authentication | Choose email, SMS code, or KBA |
| Retention | Set automatic archival after execution |
Consider file formats, signer authentication, and integrations before publishing the Exhibit.
Verify that the chosen platform preserves audit records, supports required authentication, and exports a tamper-evident final file.
Submit Exhibit within 30 days of review completion
Respond to findings within 14 calendar days
Corrective actions typically due in 30–90 days
Follow-up validation within 30 days of remediation
Project closeout records retained per retention rules
Initial findings compiled and evidence attached for review.
PMO or compliance approves draft prior to external circulation.
Client or contracting officer reviews and requests clarifications if needed.
Authorized signatories sign and file the executed Exhibit.
| Format | Electronic | Paper |
|---|---|---|
| Audit trail | limited | |
| Ease of distribution | high | low |
| Tamper evidence | strong | weak |
| Retention export | easy | manual |
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Varies by plan | Varies by plan | Varies by plan | Varies by plan |
| Bulk Send | Yes (Premium) | Yes | Yes | Yes | Varies by plan |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
| Envelope Cap | No envelope cap | 100 envelopes/user/year | Varies by plan | Varies by plan | Varies by plan |
A mid-size developer used the Exhibit to document system testing and close a lease conversion
A healthcare provider attached a HIPAA addendum to the Exhibit during an IT control review