Policy Exception
Definition
A formal, time-bounded approval to deviate from a policy or standard requirement when the standard control is not achievable. Exceptions must be approved by the policy owner, document the residual risk, and include a compensating control and a remediation timeline.
- Nature
- Formal, time-bounded deviation approval
- Approver
- Policy owner
- Required elements
- Documented residual risk, compensating control, remediation timeline
Common questions
Why does a policy exception need a compensating control rather than simply being approved outright?+
The exception process exists to manage risk consciously, not eliminate the standard requirement's purpose, so a compensating control is required to reduce the residual exposure the deviation creates while the underlying gap is worked toward remediation.
What happens when a policy exception's remediation timeline expires without the standard being met?+
The exception should either be re-reviewed and formally renewed with updated justification, or the control gap escalated, since an expired exception left unaddressed effectively becomes an undocumented, unmanaged policy violation.
Related terms
- Document Control
- The systematic management of all procedural documents in a quality management system, ensuring that the current approved version is in use, all...
- Information Security Policy
- A high-level governance document that states what the organisation intends to achieve in protecting information, assigns accountability to roles, and sets the...
- Operating Effectiveness
- The assessment of whether a control has consistently functioned as designed over the audit period. Requires evidence of actual operation, such as...
- Procedure
- A step-by-step operational instruction that tells a specific role how to carry out a task in conformance with the relevant standard. Procedures...
- Standard
- A document that translates a policy requirement into specific, measurable criteria. For example, a password policy may require strong authentication; the accompanying...