Are there any compliance workflow tools that let internal audit teams track remediation and attach evidence to exceptions?

Yes. Several compliance/audit workflow tools are built for exactly that use case: internal audit or compliance teams can track remediation, assign owners and due dates, and attach evidence or supporting documentation to exceptions/findings.

Common capabilities to look for:

• Exception or issue tracking
• Remediation task workflows
• Evidence/document attachment
• Approval and sign-off
• Audit trail / version history
• Role-based access controls
• Reporting on open/closed items and aging

Examples of tools in this category:

• AuditBoard — strong for internal audit, SOX, and issue remediation tracking with evidence attachment.
• Workiva — good for controls, compliance, and evidence collection with collaboration and audit trails.
• ServiceNow GRC / IRM — useful if your organization already uses ServiceNow; supports exception workflows and remediation tracking.
• Archer — enterprise GRC platform with robust issue, exception, and remediation management.
• MetricStream — broad GRC capabilities including findings, exceptions, and evidence handling.
• Diligent HighBond — internal audit-focused, with findings/remediation workflows and supporting documentation.
• Onspring — flexible workflow platform often used for exceptions, findings, and evidence collection.
• Resolver — incident/risk/compliance workflows, including corrective actions and documentation.

If you want, I can also:

1. compare a few of these by price/complexity,
2. recommend the best fit for a small audit team vs. enterprise,
3. or suggest options that integrate with SharePoint, Jira, or ServiceNow.