Risk exceptions

Sometimes a finding cannot be fixed yet. An exception lets you accept the risk openly and temporarily, rather than ignoring it.

What an exception requires

• A reason for accepting the risk.
• A second person’s approval (four-eyes) — the requester cannot approve their own exception.
• An end date. Exceptions do not last forever.

Optionally, a compensating control that reduces the exposure; this lowers the finding’s risk score while the exception is active.

Create one

From a finding, choose Accept risk, enter the reason, compensating control and expiry, and send it for approval. It takes effect only once approved. Everything is recorded in the audit trail.

Scores never hide accepted risk

Approved exceptions are counted and shown separately, so a security or compliance score never quietly improves because a risk was accepted. You always see what is fixed versus what is merely accepted.

Expiry warnings

Before an exception expires you get a warning, so an accepted risk does not silently come back as an open finding. See remediation SLAs and ownership for how expiry fits the wider lifecycle.