Policy
Exception and Risk Acceptance Management Policy
This policy defines the organization-wide process for managing security, risk, compliance, and operational exceptions. It consolidates the former Exception Process, Risk Acceptance Memo Procedure, Temporary Waiver Procedure, and Exception Tracking Log into one cohesive governance artefact.
- Type
- Policy
- Version
- 1.5.10
- Date
- 2026-10-27
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Governance
- Review frequency
- Annual or as required by regulatory or framework changes
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Governance and accountability
- 4. Policy and control statements
- 5. References and framework alignment
- 6. Compliance mapping table
- 7. Definitions
Frameworks it maps to
- ISO/IEC 27001:2022
- ISO 31000:2018
- COBIT 2019
- Cloud Security Alliance (CSA)
- NIST SP 800-37 Rev. 2
- NIST SP 800-53 Rev. 5
- NIST AI RMF 1.0
- OECD AI Principles
Related documents
- Governance Library Chartergovernance
- Enterprise Governance and Risk Management Policyrisk
- Compliance, Audit, and CAPA Management Policycompliance
- Risk Acceptance Procedurerisk
Next
All Documents