An exception is a consciously approved, time-limited deviation from a requirement, for example from a baseline check requirement, a policy or a requirement from a catalogue. Each exception is linked to a risk that must be accepted. This article is aimed at everyone who requests, approves or manages exceptions.

Before you start

  • You find exceptions under Assets › Exceptions. People with the corresponding permissions may create and edit them; by default, the ISMS managers for all assets and the protection object owners for their own. Without the permission to see all exceptions, the page is called My exceptions and only shows the ones you are responsible for.
  • Who approves an exception is set by the ISMS managers under ISMS settings › Assets › Approval of exceptions. The default is the functional role ISMS manager.
  • Exceptions are included in all plans.
  • Do not confuse: you record deviations from segregation of duties and the four-eyes principle under ISMS settings › Organisation & roles, not here.
  1. Responsible personsRecord and submit

    Justification, risk, responsible persons and “Valid until”.

  2. Approval workflowApprove

    Never the person who recorded or submitted it.

  3. Risk ownerAccept risk

    According to the risk acceptance criteria.

  4. ActiveUntil the “Valid until” date.
Rejected

The exception returns to draft with a justification.

From the exception to approval

The exception is recorded as a draft and submitted for approval with a risk, responsible persons and a validity date. The approvers in the approval workflow approve it, and the risk owner accepts the linked risk according to the risk acceptance criteria. Only when both are done is the exception active – until the Valid until date. If it is rejected, it returns to draft with a justification.

How to request an exception

  1. Open Assets › Exceptions and click New exception.
  2. Enter a Title and describe under Justification and compensating measures why the requirement cannot be met and what reduces the risk instead.
  3. Choose the Affected asset, if there is one.
  4. Under Risk, choose the risk that describes the deviation. If there is none yet, report or record it directly from the form.
  5. Under Responsibility, specify one or more people and mark exactly one as primary (star).
  6. Set Valid until. Exceptions are always time-limited; the date is required for submission.
  7. Attach a PDF if needed and save. The exception is now a draft.
  8. Open the exception and click Submit for approval.

Exceptions also arise in the baseline check: if a requirement is partially met or not met and this is to remain so, you create an exception there.

How to approve an exception

The approvers of the current step receive the task Approve exception. Check the justification, time limit and linked risk and click Approve, or Reject with a justification. Approvers of the same step sign in any order, the next step only afterwards. Whoever recorded or submitted the exception never signs themselves (four-eyes principle).

What happens next

  • The exception only becomes Active once all approvers have signed and the linked risk has been accepted. If the risk is treated instead, the exception remains approved but not active.
  • If no approval workflow is set, acceptance of the risk is sufficient. For low risk levels, the risk owner then approves alone, who has often requested the exception themselves.
  • 30 days before expiry, the responsible persons receive the task Exception expiring, after expiry Exception expired. The exception then shows the status Expired.
  • Exceptions are an input to the management review.

Frequently asked questions

How do I extend an exception?

Click Change or extend. The exception becomes a draft again, you adjust “Valid until” or other details and submit it again. The previous approval remains valid until it ends; in the meantime, the status reads Active · change in progress.

The deviation has been resolved. What now?

Click End exception and give a justification. The exception then no longer applies and cannot be reopened. Drafts that were never approved are deleted instead.

Why can't I submit?

Submitting requires a linked risk, at least one responsible person and a “Valid until” date from today. If nobody other than you could approve, submitting is locked, see Regulating approvals with the four-eyes principle.

Who decides who must accept the risk?

The risk acceptance criteria per risk level, see Setting the risk methodology and acceptance criteria.