If the same exception comes up for renewal a third time, then what?

Start

The same exception is up for renewal a third time

Two renewals have been used and the gap is still open. This is where exception processes usually fail: the date passes, someone extends it by email, and the exception becomes permanent. The pack's escalation is deliberately uncomfortable, so that a chronic exception becomes a management decision: fund the fix or, if the gap is to stay, change the rule first and then accept any remaining risk in the risk register.

• Then: Confirm the renewal count from your register

Step

Confirm the renewal count from your register

Check your register for the same requirement and systems. A repeat request on the same gap is a renewal, even under a new title or owner. The count runs over the exception's whole life. Re-scoring, a change of band or a new owner does not reset it.

• Then: Has the renewal been requested before the expiry date?

Decision

Has the renewal been requested before the expiry date?

A renewal is a new request made before the exception expires. If the date has already passed, the exception is expired and the requirement applies again in full, so the expiry rules come first.

• Yes: Score it again with fresh evidence and a progress report
• No: Handle it as an expired exception first

Outcome

Handle it as an expired exception first

Mark it Expired, report the gap as non-compliance, and resolve it within the grace period, which is 10 working days in the pack's defaults. A renewal may still be submitted in that time, as a late renewal, which is reported. It is decided at the level this flow describes.

Step

Score it again with fresh evidence and a progress report

The renewal is scored as a new request. It needs current evidence that the compensating control still works, progress against the remediation plan, the reason the fix is late, and the new date. In the pack's defaults, test evidence older than 30 days is refreshed before the control counts.

• Then: Which band does the new score fall in?

Decision

Which band does the new score fall in?

The new score sets the band, and with it the approver and the longest duration. Renewals already used still count after a band change. A Low exception that now scores High is past High's limit of one renewal as well as Low's limit of two.

• Low: Low: the Head of Information Security decides
• Medium: Medium: security head and accountable executive decide
• High: High: the top governing body decides
• Critical: Critical: the full board, or its equivalent, decides

Step

Low: the Head of Information Security decides

Low allows two renewals by the control owner. The third goes up a level, to the Head of Information Security. In the pack's defaults it may run at most 365 days from the renewal approval.

• Then: Does the gap leave a risk outside appetite, or Critical?

Step

Medium: security head and accountable executive decide

Medium allows two renewals by the Head of Information Security. The third goes up a level: the Head of Information Security together with the accountable executive as risk owner. In the pack's defaults it may run at most 180 days from the renewal approval.

• Then: Does the gap leave a risk outside appetite, or Critical?

Step

High: the top governing body decides

High allows one renewal. Every later renewal goes to the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management. In the pack's defaults it may run at most 90 days at a time.

• Then: Does the gap leave a risk outside appetite, or Critical?

Step

Critical: the full board, or its equivalent, decides

Critical allows one renewal by the body that approved it. Every later renewal goes a level higher: the full board, or its equivalent in your structure. In the pack's defaults it may run at most 30 days at a time, so by a third request the gap has run for months at the highest level of risk.

• Then: Does the gap leave a risk outside appetite, or Critical?

Decision

Does the gap leave a risk outside appetite, or Critical?

Check the risk behind the gap in your risk register. Where an exception leaves a risk outside appetite, or scored Critical, the approver your risk method requires for that position also signs the exception. The stricter of the two always applies. If you have not assessed the risk, take the cautious branch.

• Yes, or not known: Add the signature your risk method requires
• No: Ask the higher approver for a decision on the gap's future

Step

Add the signature your risk method requires

In the pack's risk method, a risk outside appetite adds executive management. Outside tolerance, which includes every Critical risk, only the top body may decide: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. The extra signature goes on the exception form with the risk's position noted beside it. A separate risk acceptance is not completed.

• Then: Ask the higher approver for a decision on the gap's future

Step

Ask the higher approver for a decision on the gap's future

State the exception reference, the requirement, the band and the dates, what was done since each renewal, and why the gap is still open. Ask for a decision: fix, renew, or accept at a higher level.

• Then: What does the higher approver decide?

Decision

What does the higher approver decide?

The approver may renew, shorten the period, add conditions or refuse. It may not approve for longer than the band allows. Each answer below leads somewhere different.

• Fund the fix: Renew only for the funded fix, then close with evidence
• Carry it one more period: Renewed at the higher level, and reported as chronic
• The rule should not apply: Change the requirement or its scope through policy review
• Refuse: Refused: the rule applies in full

Outcome

Renew only for the funded fix, then close with evidence

Renew for the time the funded fix needs and no longer; retiring or replacing the system also ends it. Keep the compensating control running and tested. The exception is chronic, and is named in every quarterly report until it is closed with evidence.

Outcome

Renewed at the higher level, and reported as chronic

The higher approver knowingly carries the gap for one more period, within the band's longest duration. It is scored again at each renewal and named in every quarterly report until closed. An exception still cannot run for ever: a gap the organisation means to keep permanently needs the rule changed.

Outcome

Change the requirement or its scope through policy review

If the rule should never apply here, revise the policy or standard through its normal review. The approved revision, with its effective date, is the evidence that closes the exception. Any risk that remains then belongs in your risk register, where its owner can accept it with the approvals your risk method requires.

Outcome

Refused: the rule applies in full

The requirement must be met, and any gap after expiry is reported as a breach. A refused exception cannot be turned into a risk acceptance: the acceptance form cannot be used to accept around it.