Policy exceptions and extensions provide temporary relief for non-compliant controls.

The policy exception captures the rationale, comments, and evidence to support the acceptance or rejection of a policy exception request. Also, you can request an extension to an approved policy exception before the policy exception validity period. The control owner, the compliance manager, and the risk manager may be involved in the policy exception and extension workflow.