Managing Risk Exceptions

You can requests exceptions for risks to capture the rationale, comments, and evidence to support the acceptance or rejection of a risk upon request. When creating a new exception, users can specify the reason for the exception. The exception will be sent to the approver assigned in the workflow stage. Risk exceptions provide flexibility when following policies exactly isn't feasible or beneficial. They allow organizations to adapt to specific circumstances while still managing potential risks.

Risk Exception Examples

Requesting an exceptions might be necessary when:

Reason for Exception

Description of Exception

The Treatment Plan is Not Feasible

  • The proposed mitigation is too costly, resource-intensive, or technically impractical.

  • Implementation would disrupt critical business operations.

The Risk is Acceptable

  • The residual risk (after partial treatment) is within the organization’s risk appetite or tolerance.

  • A cost-benefit analysis shows that the cost of mitigation outweighs the potential impact.

Alternative Controls Exist

  • Other compensating controls are in place that sufficiently reduce the risk.

  • The risk is already mitigated through other means not captured in the original plan.

Time Constraints

  • The treatment cannot be implemented within the required time-frame.

  • A temporary exception is needed until a long-term solution is in place.

Business Justifications

  • There is a strategic or business-critical reason to delay or avoid the treatment.

  • The risk is tied to a business opportunity that outweighs the potential downside.

Risk Exception Process

Requesting an exception on a risk differs slightly depending on the type of workflow you are using. The diagram below shows the high-level process when using the Default Risk Workflow and a custom risk workflow. For more information on the default workflow, see About the Default Risk Workflow.



To enable exception requests

The Allow exception requests setting must be enabled to allow users to request exceptions during specific workflow stages for custom and cloned default risk workflows. This setting is enabled on the Treatment stage of the Default Risk Workflow and cannot be edited.

  1. On the IT & Security Risk Management menu, select Setup > Workflows.

    The Workflows screen appears.

  2. Click the View button on the Risk Workflows tile.

    The Workflows list screen appears.

  3. Open a published workflow in which you'd like to enable exception requests. For more information on creating and publishing custom workflows, see Managing Risk Workflows.
  4. On the Workflow Details screen, select the stage you would like to allow exception requests.
  5. Enable the Allow exception requests setting on the Stage details tab.


    Field
    Description
    Allow Exception Requests

    Enable this setting to allow Risk Owners to request exceptions during this stage.

    When approved move to the following stage
    Choose the stage in the workflow the risk will move to if the exception is approved.
    Note:

    If the stage you would like to advance to has required attributes, the stage will not move unless the attributes are added to the risk record.

    Set approval requirements

    If you select Any, any approver for this stage can approve the exception and move the risk to the next stage.

    If you select All, all approvers for this stage must approve the exception to move the risk to the next stage.

    Approvers

    Select the approvers for this stage using existing system or user attributes. The users added here will be responsible for approving the exception.

  6. Complete the fields.
  7. Click the Save button.

    The Save Workflow modal appears.

  8. Click the Save button to update the stage details.

To request exceptions using the Default Risk Workflow

Risk Owners or users with the Submit Risk Treatment permission can request exceptions in the Treatment stage of the Default Risk Workflow.

  1. On the Risk Details screen, click the Request exception button.
    The Request exception modal appears.

  2. Enter the reason for the exception in the Comments field. You can use the text editor to format the comment as needed.
  3. Click the Submit button to send the Exception Requested email to the Risk Approver for review. The Risk Approver can choose to grant the exception or send it back. If sent back, you can request another exception.

To request exceptions using custom workflows

Risk Owners, Approvers, Managers, and users with the User Can Be Risk Admin permission can be the Risk Admin who can request exceptions when the risk enters an exception stage. Owners and approvers will only have access to request exceptions for the risks they are assigned.

  1. On the Risk Details screen, click the Request exception button.
    The Request an exception modal appears.

  2. Enter the reason for the exception in the Provide reasoning field. You can use the text editor to format the comment as needed.
  3. Click the Submit button to send the Exception Requested email is sent to the approver identified on the Stage Details tab of the Workflow Details screen. The approver can choose to accept or reject the exception. If rejected, you can request another exception.

To grant exceptions using the Default Risk Workflow

Risk Approvers have the ability to review the exceptions submitted by Risk Owners or users with the Submit Risk Treatment permission. Once the exception is submitted, the approver will receive the Exception Requested email notification. The Risk Approver must review and choose to grant the exception or send it back to the Risk Owner.

  1. On the Risk Details screen, review the risk record details and the Comments tab to help determine if the exception should be granted or sent back.
    Tip:

    The Comments and Activity tabs displays the exception request details.

  2. On the Risk Details screen, click the Grant Exception button.
    The Grant Exception modal appears.

    Field
    Description
    Result

    Select the result of the exception. The result helps to describe why the risk was granted an exception.

    Residual Risk Score

    Set the residual risk level for this risk, if applicable. The residual risk score is the level of risk remaining after an organization has mitigated the risk.

    Comments

    Enter a comment that describes the reason for granting the exception request. You can use the text editor to format the comment as needed.

  3. Click the Confirm button. To change the result of the exception, you can use the Change Review button.
Note:

Once the exception is granted, the risk will be closed and moved to the Monitoring stage. The user who requested the exception will be notified of the approval via email.

To approve exceptions using custom workflows

Exception approvers have the ability to review the exceptions submitted by Risk Owners, Approvers, Managers or users with the User Can Be Risk Admin permission. Once the exception is submitted, the approver will receive the Exception Requested email notification. The approver must review and choose to approve or reject the exception.

Tip:

The Review exception button will also appear for cloned Default Risk Workflows in the Treatment stage.

The required attribute modal does not appear when auto-advancing from the Treatment stage to the Monitoring stage in approval workflow stages for cloned workflows.

  1. On the Risk Details screen, review the risk record details and the Workflow and Approval tab to help determine if the exception should be approved or rejected.
    Tip:

    The Risk Review section of the Workflow and Approval tab displays the exception request details.

  2. Click the Review Exception button.
    The Review exception request modal appears.

    Field
    Description
    Result of Exception

    Select Approve for the result of the exception.

    Review Notes

    Enter notes that describe why this exception was approved. You can use the text editor to format the comment as needed.

  3. Click the Submit button. To change the result of the exception, you can use the Change Review button.
Note:

Once Approved, the risk will advance to the next stage identified on the Stage Details tab of the Workflow Details screen. The exception status and approver comments will be documented on the Workflow and Approval tab of the Risk Details screen. The user who requested the exception will be notified of the approval via email. If the stage you would like to advance to has required attributes, the stage will not move unless the attributes have been added to the risk record.

To send back exceptions using the Default Risk Workflow

Risk Approvers have the ability to review the exceptions submitted by Risk Owners or users with the Submit Risk Treatment permission. Once the exception is submitted, the approver will receive the Exception Requested email notification. The Risk Approver must review and choose to grant the exception or send it back to the Risk Owner.

  1. On the Risk Details screen, review the risk record details and the Comments tab to help determine if the exception should be granted or sent back.
    Tip:

    The Comments and Activity tabs displays the exception request details.

  2. Click the Send Back button.
    The Send Back Risk modal appears.

  3. Enter a comment that describes the reason for sending back the risk. You can use the text editor to format the comment as needed.
  4. Click the Confirm button.
  5. Click the Confirm button. To change the result of the exception, you can use the Change Review button.
Note:

Once the exception is sent back, the Treatment Status will be reset to In Progress and any comments left will be added to the Comments tab. The user who requested the exception will be notified that the risk has been sent back via email. They have the option to request another exception for review.

To reject exceptions using custom workflows

Exception approvers have the ability to review the exceptions submitted by Risk Owners, Approvers, Managers or users with the User Can Be Risk Admin permission. Once the exception is submitted, the approver will receive the Exception Requested email notification. The approver must review and choose to approve or reject the exception.

Tip:

The Review exception button will also appear for cloned Default Risk Workflows in the Treatment stage.

  1. On the Risk Details screen, review the risk record details and the Workflow and Approval tab to help determine if the exception should be approved or rejected.
    Tip:

    The Risk Review section of the Workflow and Approval tab displays the exception request details.

  2. Click the Review Exception button.
    The Review exception request modal appears.

    Field
    Description
    Result of Exception

    Select Reject as the result of the exception.

    Review Notes

    Enter notes that describe why this exception was rejected. You can use the text editor to format the comment as needed.

  3. Click the Submit button. To change the result of the exception, you can use the Change Review button.
Note:

Once Rejected, the risk will not advance to the next stage identified on the Stage Details tab of the Workflow Details screen. The exception status and approver comments will be documented on the Workflow and Approval tab of the Risk Details screen. The user who requested the exception will be notified of the rejection via email. They have the option to request another exception for review.