Is this a risk acceptance or a security exception?

Start

Someone wants to carry a security gap or risk for now

The two decisions look alike and use the same four-by-four scale and bands. They decide different things. An exception decides that a specific rule need not be met, in a stated scope, for a limited time. An acceptance decides that a residual risk in the register is kept, knowingly, rather than treated further.

• Then: Is a specific rule in a policy or standard not being met?

Decision

Is a specific rule in a policy or standard not being met?

Yes when a required control is missing, late or configured differently from the standard. That includes a remediation deadline that will be missed, a control that cannot be put on a system, a supplier that cannot meet a contractual security clause, and duties that cannot be separated. If both a broken rule and a wider risk are involved, answer yes: the exception comes first. If you are not sure, answer yes and let the rule's owner check.

• Yes, or not known: Is the rule a legal duty, or on your non-negotiable list?
• No, or no rule covers it: Score it in the register and weigh the other options

Decision

Is the rule a legal duty, or on your non-negotiable list?

An internal exception cannot waive the law, a regulatory obligation or a contractual obligation to a customer or regulator. Your standard may also list a few controls that are never excepted, such as multi-factor authentication for remote administrator access. If you don't know whether a legal duty sits behind the rule, answer yes and ask legal.

• Yes, or not known: Neither: take it to your compliance or legal escalation
• No: It is a security exception: request one, not an acceptance

Outcome

Neither: take it to your compliance or legal escalation

A legal or regulatory obligation that cannot be met is a compliance issue. It may need legal advice and a notification to a regulator. Your exception register can still hold a line for it, marked as not an exception, so it is not lost.

Step

It is a security exception: request one, not an acceptance

Record it under your exception standard, with the rule not met, the systems affected, the compensating controls and a remediation date. Signed by the risk owner, it is also the decision to carry the risk of the gap: do not complete an acceptance form as well. Link the exception from the risk it raises in the register. If the gap is meant to be permanent, change the rule or its scope first, then accept any remaining risk in the register. If you have no exception process, record it on the acceptance form with the rule noted, and use the shorter exception durations.

• Then: Does the gap leave a risk outside appetite, or Critical?

Decision

Does the gap leave a risk outside appetite, or Critical?

Score the risks that depend on the missing control as if that control were not there. If one of them lands outside appetite or at Critical, the exception needs a further signature. If you have not scored them, do that first; until then, answer yes.

• Yes, or not known: Add the signature the risk's position requires
• No: Is the exception approved?

Step

Add the signature the risk's position requires

The approver the risk method requires for that position also signs the exception: executive management outside appetite. Outside tolerance or Critical, it is the top of the organisation: the board or a board risk committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board. The stricter of the two approvals always applies. The signature goes on the exception form, with the risk's position noted beside it.

• Then: Is the exception approved?

Decision

Is the exception approved?

The approver may approve, refuse, shorten the duration or add conditions. A request not decided in time goes up a level; silence is never approval. Approval is never backdated.

• Yes: Carry the gap as a time-limited exception
• No: Refused: meet the rule; no acceptance around it

Outcome

Carry the gap as a time-limited exception

It runs to a fixed expiry date. In the pack's defaults the longest are 365 days for Low, 180 for Medium, 90 for High and 30 for Critical, with limited renewals. It lives in the exception register. Before it expires, the rule is met, or the exception is renewed on a fresh assessment.

Outcome

Refused: meet the rule; no acceptance around it

If the exception is refused, the rule must be met. The risk acceptance form cannot be used to accept around a refused exception. Plan the work to meet the rule, with a date.

Step

Score it in the register and weigh the other options

An acceptance starts from a risk in the register whose treatment has been chosen as Accept. Write it as a scenario, score it after existing controls, and weigh reducing, avoiding and transferring it first. If one of those wins, there is nothing to accept.

• Then: It is a risk acceptance: complete the acceptance form

Outcome

It is a risk acceptance: complete the acceptance form

Use it when every rule is met but the residual risk is more than the owner would choose, or no rule covers it. It is recorded against the risk in the register, signed at the level the band and position require, and reviewed by a date. In the pack's defaults that is 12 months for Low and Medium, 6 for High and 3 for Critical, renewed on a fresh score.