Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Policy Lifecycle, Exceptions and Enforcement
The life cycle
Review policies at least yearly and whenever the business, the law or the threats change.
Exceptions
Sometimes a system or process can’t meet a policy, for a good reason. An exception lets that happen safely: the risk is assessed, compensating controls are added, the owner accepts what’s left, and it expires on a set date.
What an exception record holds
| Field | Why it matters |
|---|---|
| Requirement not met | So everyone knows the gap |
| Reason and business need | Shows it’s justified |
| Risk rating and compensating controls | Keeps the risk visible and reduced |
| Owner and approver | Accountability at the right level |
| Expiry date | Forces a review instead of permanence |
Enforcement
Example. Monitoring shows 40% of staff in one region store files on personal cloud drives. Investigation finds the approved file share is too slow from that region. Fixing the network solves the problem; discipline wouldn’t have.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| System can’t meet policy | Formal exception with compensating controls and an expiry date |
| Widespread non-compliance | Find out why before enforcing |
| When to review policy | At least yearly and on significant change |
| Who approves an exception | The risk owner with suitable authority |
In short
- Policies follow a life cycle: identify need, draft, consult, approve, communicate, enforce and review.
- Review policies at least yearly and when the business, law or threats change.
- An exception is a formally approved, risk-assessed and time-limited departure from policy.
- Every exception needs an owner, compensating controls where possible, and an expiry date.
- When many people break a policy, find out why: the policy may be unworkable.
Exam traps
- Approving exceptions by email with no record or expiry.
- Rewriting the policy to remove a requirement just because one system can't meet it.
- Disciplining everyone when widespread non-compliance points to a bad policy.
- Letting exceptions renew automatically without review.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The life cycle
Enforcement
ExampleMonitoring shows 40% of staff in one region store files on personal cloud drives. Investigation finds the approved file share is too slow from that region. Fixing the network solves the problem; discipline wouldn't have.
1 / 8