Glossary
Control exception
A formal, temporary and documented authorisation to operate without meeting a specific control, with reason, owner and expiry date.
- Accepted deviation
- Risk acceptance
Exceptions are not a symptom of poor governance: a programme with no recorded exceptions usually means the exceptions exist but go unrecorded. What an auditor values is not their absence but their management.
A complete exception has five fields and none is optional: which control is not met, why, what compensating measures apply in the meantime, who authorised it — in a role with the authority to do so — and until when.
The fifth is the one that is almost always missing. An exception with no expiry stops being an exception and becomes an informal policy nobody approved. The practice that works best is reviewing all live exceptions in the same periodic session, so that renewing one means justifying it again in front of the same person who granted it.