Security Exception and Risk Acceptance Tracking
A system that can't meet a security policy requirement on schedule — a legacy application that can't support MFA yet, a vendor integration that needs a wider firewall rule than standard — gets a formal exception with a documented compensating control and an expected remediation date. That exception is meant to be temporary and reviewed, but in practice it gets approved once, filed away, and never revisited, because nothing forces a review when the remediation date passes. Two years later the same exception is still cited whenever it comes up in an audit, the original approver has left the company, and the compensating control it was granted with was never actually verified to still be in place.
STARTING PRICE
From €299
Standard tier · Multi-step workflow with AI extraction/decisioning and 2-3 integrations.
Get a quote →Saves roughly 3-4 hrs/week of manual exception tracking and renewal chasing.
How the automation works
We track every approved exception and risk acceptance against its documented expiry or planned remediation date, and its associated compensating control, so nothing granted as temporary defaults to permanent by omission. As an exception's review date approaches, it routes back to the original risk owner — or their successor, if roles have changed — for a genuine re-approval decision: remediate now, extend with updated justification, or accept the risk formally for another defined period. Compensating controls tied to an exception are checked periodically against their own evidence, so an exception granted on the condition of extra monitoring is flagged if that monitoring quietly stopped. Nothing is escalated to auto-remediation or auto-revocation of the underlying access — every exception decision, including renewal, stays a documented human judgment call, since these exist specifically because the standard control wasn't feasible, and that context matters at renewal time too.
Process flow
- 01
Exception approved and logged trigger
A newly approved security exception or risk acceptance is logged with its justification, compensating control, approver, and expiry or planned remediation date.
- 02
Monitor compensating control status ai
Where the exception depends on a compensating control (extra monitoring, restricted access scope, compensating logging), that control's status is checked periodically against its own evidence to confirm it's still actually in place.
- 03
Flag approaching and passed review dates ai
Exceptions nearing their review or expiry date are flagged ahead of time, and exceptions that passed their date without a renewal decision are flagged as overdue for review, distinct from actively-current exceptions.
- 04
Route to risk owner for renewal decision output
Flagged exceptions route to the original risk owner, or a designated successor if that person has left or changed roles, for a documented decision: remediate, extend with justification, or formally re-accept for a new period.
- 05
Report open exception register output
A current register of all open exceptions, their compensating controls, review status and age, is maintained and reportable on demand for audit or risk committee review.
Inputs
- Exception/risk acceptance approval records
- Compensating control evidence
- Risk owner and organizational role mapping
- Exception expiry/remediation dates
Outputs
- Open exception register with status
- Approaching and overdue review flags
- Risk owner renewal decision log
- Compensating control verification status
Works with
Prefer a fully custom build instead of an off-the-shelf integration? We scope both options during your free consultation — most jobs like this one work fine on standard connectors, but higher-volume or non-standard systems sometimes need bespoke API work, reflected in the complex tier.
Where this goes wrong if you get it wrong
- An exception approved by someone who has since left the company or changed roles has no active owner to review it at renewal time, and routing the review to a vacant approval slot means it never gets a genuine re-decision — successor mapping needs to be part of the review routing, not an afterthought discovered when the review fails to happen.
- The compensating control an exception depends on can quietly stop working — the extra monitoring alert gets muted, the restricted access scope creeps back open — without anyone revisiting the original exception, so the exception is technically 'active' while the thing that made it acceptable is gone.
- Treating exception renewal as a rubber-stamp extension rather than a genuine re-evaluation defeats the purpose of a time-bound exception in the first place — the review needs to actually ask whether remediation is still infeasible, not just reset the clock on autopilot.
- An exception register that isn't reconciled against what's actually still true in the environment (is the legacy system still in use, is the vendor integration still active) will keep tracking exceptions for things that no longer exist, cluttering the review queue and training reviewers to skim past it.
Frequently asked questions
Does this automatically revoke access when an exception expires?
No — an expired or overdue exception is flagged for the risk owner's decision. Any change to access or the underlying system stays a human action, since exceptions exist because the standard control wasn't feasible to begin with.
What happens if the original approver has left the company?
Review routing uses organizational role mapping to find the current successor for that risk-owner role, so the exception still gets a genuine re-decision rather than sitting unreviewed because the original approver is gone.
Does it check whether the compensating control is still actually working?
Yes — where an exception depends on a compensating control like extra monitoring or restricted scope, that control's status is checked periodically against its own evidence, not assumed to still be in place indefinitely.
Can this produce an exception register for an audit or risk committee?
Yes, a current register of all open exceptions with their compensating controls, review status and age is maintained and can be exported on demand.