What it means
A sound exception process separates the person requesting relief from the authority accepting the risk and requires enough evidence to understand scope, duration, affected assets, and conditions.
Why it matters
Without governance, exceptions become invisible permanent architecture and accepted risk accumulates beyond leadership's intent.
Practical focus
- Document requirement, reason, scope, owner, risk, and compensating controls
- Use approval authority aligned with risk
- Set expiration, review, and remediation milestones
- Track aggregate exception concentration and recurring root causes
Common mistakes
- Calling a control gap an exception without acceptance
- Approving indefinite waivers
- Using the same compensating control for every case
- Closing the record while the deviation remains
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: