Exceptions

Governance → Policy Management → (a document) → Exceptions

An exception is a recorded, justified, time-boxed departure from a policy. It is what an organisation grants instead of pretending the policy is being followed — and the record of it is worth more to an assessor than a clean sheet that nobody believes.

The lifecycle

requested → in_review → approved → active → expired
                ↓                     ↓
            rejected              withdrawn

Status	Means
requested	Raised, awaiting triage
in_review	Being assessed by the approver — a manager who did not request it
approved	Granted — becomes active immediately
active	In force until its expiry date
expired	Its window has closed. Terminal
rejected	Refused. Terminal
withdrawn	Pulled by the requester. Terminal

approved and active are the same moment in practice: approval activates the exception in the same transaction, so there is no "approved but not yet in effect" limbo to forget about.

What an exception has to say

Field	Rule
Title	Required
Justification	Required. Why the policy cannot be met here
Compensating controls	Required before approval — at least 20 characters
Risk accepted	Optional statement of what is being taken on
Expiry date	Required to approve. In the future, and within two years
Linked risk	Optional link to a risk in the risk register

Approval is a manager's decision, and the requester never approves their own request, whatever their role. Three further gates are enforced at approval and cannot be waived:

1. An expiry date is mandatory. There is no permanent exception. A departure without an end date is not an exception, it is an undocumented policy change.
2. The window is capped at two years. Anything longer is refused. If a departure needs to outlive two years, the policy is wrong and should be amended.
3. Compensating controls must be written down first. "We can't meet this" is not an exception request; "we can't meet this, and here is what we do instead" is.

Withdrawing also requires a reason.

Editing

An exception can be edited only while it is requested or in_review. Once it is approved, active, expired or rejected, the row is part of the audit record and stops accepting changes. Status moves go through the status action; extending the window goes through renewal.

Renewal creates a new exception

There is no path from expired back to active. Renewing an expired exception creates a new exception linked back to the old one.

The chain is the point. Three consecutive one-year exceptions on the same control are visible as three decisions by three approvers — which is a very different story from one exception that has quietly been alive for three years, and it is the story that should be visible when somebody asks whether a temporary workaround has become permanent.

A renewal:

• inherits title, justification, compensating controls, risk accepted and approver requirements from the previous exception unless you restate them;
• starts back at requested — it needs fresh review and fresh approval;
• requires its own expiry date, again in the future and within two years.

The document page walks the chain back so the full history of a repeatedly renewed exception is visible in one place.

Second approver

An exception can be marked as needing a second approver — for a departure from a high-criticality policy, where one person's signature should not be enough. Both approvals are recorded separately, with who and when.

Expiry

The expiry date is the whole mechanism. An active exception whose date passes becomes expired, and the policy applies in full again from that moment. The dashboard counts expired exceptions, because an expired exception usually means one of two things: the gap was closed, or it was not and nobody noticed.

Raising one

Request exception on the Exceptions tab (manager role or above). The form asks for everything an approver will need, because the gates above are checked at approval and a request that cannot clear them is a dead end:

• Title, in English and Arabic.
• Justification — at least 50 characters. The field counts as you type.
• Compensating controls — at least 20 characters.
• Risk accepted — optional.
• Expiry date — in the future, within two years.

Moving one through

Each exception on the tab offers the actions its current status allows:

Status	Actions
requested	Start review, Withdraw
in_review	Approve, Reject
active	Withdraw
expired	Renew

Approving activates the exception in the same step. Withdrawing asks for a reason, which is recorded. Renew asks for the new expiry date and raises the linked successor described above — starting at requested, so it goes back through review.