AppSec folks, how does your org handle SCA exception/risk-acceptance requests?

Analyst at a large fintech. Our process: dev gets an SCA finding, writes up a Word doc claiming it's not exploitable, attaches screenshots along with messy explanations, submits via ServiceNow, and we review. Probably half come back for insufficient evidence and the cycle repeats. Curious what this looks like elsewhere. Structured form? Ticket template? Tribal knowledge? How do you track expirations/renewals? Trying to figure out if our process is normal or unusually painful.