Accept risk deliberately, never by default.
A structured exception process with justification, compensating controls, remediation plans, two-level approval and time-boxed expiry, so every accepted risk has an owner, a reason and an end date.
Owner notified by email · Due in 5 days · Full history retained for audit.
3 gaps identified; 2 map to existing risks, 1 proposed as a new finding. Approve or reject each before accepting.
Illustration with sample data
What Risk Exceptions does
A risk exception can only be submitted with a risk analysis and justification, a remediation plan with an owner and target date, and compensating controls. You can describe compensating controls in text or link them from the Control Register, and approvers see each linked control's current state. The Risk Owner approves first, then a CISO of the risk's organisation. Whether the CISO step applies depends on the higher of the risk's current and inherent severity.
Every approval applies to one immutable version. A material change to the risk or the exception suspends it and starts a new version for approval, and the earlier decisions stay on record. Expiry reminders go out 30, 14 and 7 days before and on the day. Extension requests are reviewed while the exception stays Active, and each renewal keeps a snapshot of the risk as it stood.
Key capabilities
Mandatory sections
Analysis and justification, remediation plan with owner and date, and compensating controls.
Linked compensating controls
Reference Control Register controls and show their live state to approvers.
Two-level approval
Risk Owner, then a CISO of the organisation who isn't the Risk Owner approver.
Versioned re-approval
Material changes suspend the exception and require a new approval.
Expiry & extension
Configurable reminders, business-day counting and reviewed extensions.
Cancel, revoke, close
Each ending is justified, notified and kept in history.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Risk Exceptions changes for your programme.
Exceptions without an end date
Every exception has an expiry, and material change means re-approval.
Documented risk acceptance
Supports ISO 27001 6.1.3 and PCI DSS expectations for formal acceptance.
Approvers act fast
Approvers decide in the Action Center or from email, after signing in.
History is self-explanatory
Versions and renewal snapshots answer the question of why something is still open.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Request
The action owner completes the mandatory sections and compensating controls.
Risk Owner approval
Level 1 approval, with an AI decision brief.
CISO approval
Level 2 approval by severity; the exception becomes Active.
Monitor and renew
Reminders, re-approval on change, extension or closure.
Supports your obligations.
Risk Exceptions contributes evidence and coverage to these frameworks and regulations.
Common questions.
Who approves a risk exception?
The Risk Owner first, then a CISO of the risk's organisation. The CISO step depends on severity and is configurable.
What happens if the risk changes after approval?
A material change suspends the exception and starts a new version that needs approval again. Earlier versions and decisions stay on record.
Can a normal risk save change an exception?
No. Exceptions are changed only through their own workflow.
Works better together.
Risk Treatment Workflows & Approvals
Choose how a risk becomes Active, such as the Risk Team defining the plan or the Action Owner defining it for Risk Owner and CISO approval. Every plan is versioned,…
Learn more →Risk ManagementSecurity Exception Management
Govern temporary deviations from security requirements, from a USB port or EDR exclusion to a firewall rule or delayed patch, with intelligence-informed review,…
Learn more →Platform, Security & IntegrationsAction Center & Email Approvals
Focus brings every approval, plan, task, evidence request and due date from every module into one list, ordered by urgency. Act inline, or straight from an email after…
Learn more →See Risk Exceptions in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.