Skip to main content
Governance Authority
Category: Policy and Document Management

Policy Exception

Also known as: Policy Waiver, Policy Deviation, Exception to Policy
Simply put

A policy exception is a formally approved decision to let a specific activity, transaction, or decision proceed even though it does not comply with an established organizational policy. Rather than simply ignoring the rule, the organization documents the deviation, assesses the associated risk, and records who approved it. Exceptions are typically granted for a defined period and may require additional safeguards to manage the added risk.

Formal definition

A policy exception is a documented, formally approved deviation from a specific requirement of an established organizational policy, permitting a defined activity, transaction, or decision to proceed outside that requirement. In practice it is administered through an exception process, typically a workflow to request, risk-assess, approve, document, and time-bound the deviation, with a named accountable owner and, where appropriate, compensating controls to address the residual risk introduced by the deviation. Exceptions are generally granted for a defined period; a deviation intended to be permanent is more accurately treated as a policy change, since an indefinite exception can obscure the organization's true risk posture from those relying on the stated policy (including leadership and auditors). Scope, approval authority, and required documentation vary by organization and by the policy domain involved; this entry is educational and not legal, audit, or compliance advice.

Why it matters

Policies exist to translate an organization's risk appetite and legal obligations into consistent, repeatable rules. Yet real-world activity does not always fit neatly within those rules, and a rigid refusal to deviate can obstruct legitimate business needs. A structured policy exception process allows the organization to accommodate justified deviations without abandoning the rule itself, preserving the policy's authority for the majority of cases while creating a documented, risk-assessed path for the minority that require flexibility. Without such a process, deviations tend to happen informally and invisibly, meaning the organization neither measures nor manages the additional risk it is accepting.

The governance value of an exception lies in its documentation and accountability. Because each exception records who approved the deviation, the risk assessed, any compensating controls, and a defined time period, it converts an unmanaged gap into a visible, owned decision. This matters to those relying on the stated policy to judge the organization's risk posture, including leadership and auditors. As one source frames it, a permanent exception is effectively a policy change hidden from the people evaluating the organization's risk, which is why exceptions are generally time-bound and a deviation intended to be indefinite is more accurately handled through the policy revision process.

Exceptions also generate assurance value when aggregated. A cluster of recurring exceptions against the same requirement can signal that a policy is poorly designed, outdated, or misaligned with operational reality, prompting a review of the underlying rule rather than an endless stream of individual waivers. Conversely, an absence of tracked exceptions where deviations are known to occur may indicate that the process is being bypassed. Scope, approval authority, and required documentation vary by organization and by the policy domain involved, so what constitutes an acceptable exception in one context may not translate to another.

Who it's relevant to

Chief Compliance Officers and Compliance Teams
Compliance functions typically own the design and administration of the exception process, ensuring deviations are requested, risk-assessed, documented, and time-bound rather than handled informally. They also monitor patterns in exceptions, which can reveal policies that need revision or areas where the process is being circumvented.
Risk Officers and Risk Management Functions
Because each exception introduces residual risk that departs from the organization's stated posture, risk functions have an interest in how deviations are assessed and whether compensating controls adequately address the added exposure. Aggregated exception data can inform the organization's understanding of where actual practice diverges from documented risk positions.
Internal Auditors and Assurance Providers
Auditors rely on the stated policy, and the record of approved exceptions, to evaluate the organization's control environment. Exceptions that are undocumented, indefinitely extended, or granted outside the proper authority can obscure the true risk picture from those providing assurance, making the integrity of the exception process itself a subject of review.
Management and Process Owners
Managers who request exceptions are typically responsible, as accountable owners, for the deviation and any compensating controls attached to it. They must ensure exceptions are revisited when their defined period lapses rather than allowed to lapse into an unmanaged permanent state, which would more properly be handled as a policy change.
Boards and Governance Committees
While boards and their committees generally do not administer individual exceptions, they have an oversight interest in whether the exception process functions effectively. A high volume of recurring exceptions or exceptions approved without proper authority may signal governance weaknesses that warrant attention at the oversight level.

Inside Policy Exception

Exception Request and Justification
A documented submission identifying the specific policy provision from which relief is sought and the business or operational rationale for departing from it. Typically includes the requesting party, the scope of the departure, and the circumstances that make compliance impractical or unwarranted.
Risk Assessment
An evaluation of the risk introduced by not complying with the policy, generally distinguishing the inherent risk of the exception from the residual risk after any compensating controls are applied. The depth of this assessment usually scales with the significance of the departure.
Compensating Controls
Alternative measures put in place to mitigate the risk that the policy provision was designed to address. These are the safeguards that reduce residual risk to a level consistent with the organization's stated risk appetite and tolerance.
Approval Authority
The individual or body with delegated authority to grant the exception, generally tied to the severity of the risk. Higher-risk exceptions typically escalate to more senior management or, in some cases, to a board committee, consistent with the organization's delegation of authority.
Duration and Expiry
A defined effective period after which the exception lapses or must be renewed, discouraging exceptions from becoming permanent de facto policy without reconsideration.
Register and Audit Trail
A centralized record of active and historical exceptions, capturing approvals, rationale, conditions, and review dates. This supports monitoring, reporting, and independent assurance.

Common questions

Answers to the questions practitioners most commonly ask about Policy Exception.

Does granting a policy exception mean the underlying requirement no longer applies?
No. A policy exception is generally a documented, time-bound authorization to deviate from an internal policy in specific circumstances; it does not repeal, waive, or amend the policy itself, which continues to apply to all other situations and populations. An exception is also distinct from a change to the policy, which would typically follow a separate governance and approval process. Importantly, an internal exception cannot override a binding legal or regulatory obligation, where a requirement reflects law, listing rules, or a regulator's expectation, an organization generally cannot use its own exception process to authorize non-compliance. Exceptions are usually most appropriate for internally set standards that exceed or operationalize external requirements. The specifics depend on the policy, the applicable regime, and the organization's own framework.
Is approving an exception the same as accepting the associated risk?
These are related but not identical. Approving an exception is typically an authorization decision made under a defined policy governance process, while risk acceptance is a distinct determination that the residual risk arising from the deviation falls within the organization's stated risk appetite and tolerance and is owned by an accountable party. In many organizations the two are handled together, an exception approval records who accepts the residual risk, but the approval authority for a policy deviation and the authority to accept risk of a given magnitude may sit with different roles or committees. Conflating them can obscure who is accountable if the risk materializes. Whether they are combined or separated depends on the organization's design, and neither substitutes for management's ownership of the risk or assurance functions' independent view.
What information should a policy exception request typically capture?
While the specifics vary by organization and by the sensitivity of the policy involved, an exception request generally captures the policy or control being deviated from, the business rationale, the scope and population affected, the proposed duration and expiry or review date, the residual risk and any compensating or mitigating controls, the requestor and the accountable risk owner, and the approver with appropriate authority. Capturing whether the underlying requirement stems from internal standards versus external law or regulation is often important, because that distinction affects whether an exception is even permissible. This describes a common approach rather than a mandatory template; organizations should design capture requirements to fit their own framework, and this is educational information, not compliance advice.
Who should approve a policy exception, and does approval authority vary?
Approval authority typically scales with the significance of the deviation and the level of residual risk involved. Lower-risk, routine exceptions may be delegated to management or a designated policy owner, while exceptions carrying higher residual risk, affecting many people, or touching sensitive areas often require escalation to senior management, a risk or compliance committee, or in some cases board-level oversight. The board and its committees generally hold an oversight role rather than approving individual operational exceptions, so most exception decisions sit with management within delegated authority limits, subject to reporting. The appropriate approver depends on the organization's delegation of authority framework, its risk appetite, and the nature of the policy, and where legal or regulatory obligations are implicated, additional or specialist review may be warranted.
How should exceptions be tracked and reviewed once granted?
Exceptions are generally more useful and defensible when they are recorded in a central register or log, assigned an expiry or scheduled review date, and monitored so that they do not persist indefinitely without reassessment. Many organizations periodically review open exceptions to confirm the rationale still holds, the compensating controls remain effective, and the residual risk remains within tolerance, and they aggregate exception data to identify patterns, such as a policy that is frequently overridden and may need redesign. Second-line functions may monitor the process, while internal audit may independently assess whether the exception framework is designed and operating effectively. The cadence and rigor of review typically reflect the risk involved and the organization's own governance design rather than a single universal standard.
What can a high volume of policy exceptions indicate?
A persistently high or rising number of exceptions can be a signal worth investigating rather than simply an administrative burden. It may indicate that a policy is impractical, poorly aligned with how the business operates, or set at a level the organization struggles to meet, in which case revisiting the policy design may be more appropriate than repeatedly granting exceptions. Alternatively, it may reflect weak enforcement, unclear requirements, or a control environment under strain. Tracking exception trends and themes can inform both policy improvement and risk reporting to management and, where relevant, to oversight bodies. Interpreting what the volume means depends on context, the policies involved, and professional judgment, so this should be treated as a diagnostic prompt rather than a conclusion.

Common misconceptions

A policy exception is the same as a policy violation.
An exception is a departure that has been formally requested, assessed, and approved through a governed process before or at the time it occurs. A violation is an unauthorized failure to comply. Conflating the two obscures accountability; an approved exception generally shifts the question from compliance failure to whether the residual risk was appropriately managed.
Granting an exception eliminates the underlying risk.
An exception does not remove the risk the policy was designed to control; it typically accepts or transfers a portion of that risk, often reduced by compensating controls. Residual risk remains and should be tracked, monitored, and reassessed rather than treated as resolved.
Once approved, an exception is permanent.
Exceptions are generally intended to be time-bound and conditional. Sound practice ties them to an expiry date and periodic review so that continued need, changed circumstances, and the effectiveness of compensating controls are reconsidered rather than assumed.

Best practices

Require a written justification and a proportionate risk assessment for every exception, distinguishing inherent from residual risk so approvers understand what they are accepting.
Align approval authority with the level of risk, escalating higher-risk exceptions to more senior management or the relevant board committee in line with the organization's delegation of authority.
Identify and document specific compensating controls, and confirm that residual risk remains within the organization's risk appetite and tolerance before granting relief.
Set a defined expiry date and mandatory review point for each exception so that departures do not quietly become permanent without reconsideration.
Maintain a central exception register with a complete audit trail to support monitoring, management reporting, and independent assurance by internal audit or other assurance functions.
Periodically analyze exception trends to detect whether a policy is systematically impractical or out of date, feeding those insights back into policy review and design.