Security patches through SCCM

We are deploying security patches through SCCM server. patches are getting deployed. Only concern is reporting part, in overall compliance report, few patches are not listed under Approved state but those are installed on client machine.

We want to know if those patches are not approved, how come those are installed on machines.

thanks