thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Risk Exception

Formally approved, time-limited deviation from a policy or standard with documented risk acceptance.

Definition

Exception processes require a business justification, risk analysis, compensating controls, approval by an authorized risk owner, an expiration date, and periodic review. Exceptions are tracked in a register to prevent permanent drift from policy.

Example

A lab system is granted a six-month exception from EDR deployment with network isolation as a compensating control.

Exam tip

Exceptions must expire and be reviewed; permanent exceptions indicate a policy problem.

Related terms