Policy exception register and request form
Updated
Every policy in the set has an Exceptions section, and the Information Security Policy requires each deviation to be approved in writing, recorded with an expiry date and reviewed. This page builds the register those sections refer to, as Excel, and a one-page request and approval form, as Word, pre-filled with the draft exceptions your own answers imply. Runs in your browser: no signup, nothing uploaded.
Draft exceptions: Northwind Cloud Inc
Drafts come from generator answers where your own policies call for a dated plan or a documented compensating arrangement. Built in your browser; nothing is uploaded and there is no signup.
No generator answers found in this browser. Answer the 23 generator questions to get drafts for your own company.
No drafts for Northwind Cloud Inc: multi-factor authentication is enforced everywhere, there is a device management platform and an identity provider, and the team is larger than 10 people. The register still downloads with numbered blank rows, and the request form is the same.
What the policies say
The rule comes from the Information Security Policy, quoted here as it renders for the sample company. Your download quotes your own rendered policies.
Deviations from any policy require a documented exception under section 6; undocumented deviations are policy violations. (P01 Information Security Policy, section 4.13)
Exceptions. Requests are submitted in writing to the Security Owner stating the statement affected, the justification, compensating controls, the risk owner and an expiry date no more than twelve months out. Approved exceptions are logged in the exception register and reviewed at each annual review. (P01 Information Security Policy, section 5.6)
Exceptions to this or any supporting policy are granted only in writing by the Security Owner, and additionally by Priya Natarajan, CEO where customer data is affected. Each exception records the requirement waived, the business reason, compensating controls, the risk owner and an expiry date. Exceptions expire automatically and are re-justified rather than renewed by default; the register is available to the CPA firm on request. (P01 Information Security Policy, section 6)
Individual policies add to this. Some need Executive Management or the named approver as well, and some rule out an exception altogether, for example:
- P02 Acceptable Use Policy: No exception permits sharing accounts, disabling multi-factor authentication where it is mandatory, or storing Restricted data outside approved systems.
- P03 Access Control Policy: No exception permits shared interactive accounts or unreviewed privileged access.
- P04 Authentication and Password Policy: No exception permits sharing credentials, disabling multi-factor authentication on an administrative account, or storing secrets in source code.
- P05 Asset Management Policy: No exception permits access to customer data from a device not recorded in the register.
Where the drafts come from
A draft appears only when an answer means the policies themselves call for a dated plan or a documented compensating arrangement. Each one keeps [Fill in: ...] placeholders for what the answers cannot tell: which accounts, which dates, which deputy.
| Answer | Policy text | Draft exception |
|---|---|---|
| Multi-factor authentication not enforced on every account | P04 section 4.2 (also P01 4.8, P03 4.4) | The accounts not yet covered, with the dated rollout plan the policy requires. |
| No device management (MDM) platform | P05 section 4.4 and P19 section 4.3 | Endpoints outside a management platform, with the baseline checklist and quarterly attestation as compensating controls. |
| No identity provider | P03 section 4.3 | No single sign-on, with the master account list as the compensating control. |
| Headcount 1-10 | P13 section 3 | No staffed on-call rotation, with the written cover schedule and the small-team response targets. |
| Headcount 1-10 | P03 section 4.8 | Changes merged without an independent reviewer, with the compensating review the Security Owner documents. |
What is in the files
- Register (.xlsx): one row per exception with the policy and section, the requirement, the policy text, reason, compensating controls, risk rating, requester, approver, request, approval, expiry and review dates, and status. Status (Draft, Approved, Rejected, Closed) and risk rating (Low, Moderate, High, Critical: the rating bands of your risk policy) are drop-down lists. Expiry status is a formula: Expired, Expiring within 30 days or Open, recalculated whenever the file is opened. An expiry check flags dates more than 12 months after approval. An Instructions sheet and a Policy Rules sheet quote the policy text.
- Request form (.docx): page 1 is the request and the decision with signature lines for the requester, the Security Owner and the approver; page 2 is the procedure with the policy text quoted and each policy’s additional approvers and limits.
Why auditors ask about exceptions
Small teams rarely follow every policy statement from day one, and auditors know it. What they look for is whether a deviation was a decision: approved by someone with the authority to approve it, limited in time, offset by other controls and reviewed. The register is the evidence for that, and it relates to these criteria:
- CC5.3 Policies and procedures: policies are deployed and kept in place; an approved, dated exception shows how a deviation is handled instead of leaving the policy silently unfollowed.
- CC1.3 Structure, reporting lines and authority: authority is defined; the register shows who is allowed to approve a deviation, and that they did.
- CC3.2 Identifying and analyzing risks: risks are analyzed; each exception is a risk someone rated, accepted for a limited time and offset with compensating controls.
- CC4.2 Communicating deficiencies: gaps are tracked to closure; an exception has an expiry and a review date, so it is closed or re-justified rather than forgotten.
An exception is not a way to make a gap disappear. If a draft describes something your team does not intend to fix, it belongs in the risk register as an accepted risk, and the policy text may need to change at the next policy review.
The Audit Kit includes both files in its governance folder, quoting your tailored policies.
Frequently asked questions
- What is a policy exception?
- A documented, approved and time-limited permission not to follow one specific policy requirement, with the reason and the compensating controls written down. An unrecorded deviation is a policy violation; a recorded one is a managed risk. The Policyseed Information Security Policy says so directly in statement 4.13.
- Do SOC 2 auditors ask for an exception register?
- Often, when your policies mention exceptions, which most do. The auditor may ask for the register and for the approval behind a sample of rows, and may compare the register with what they find: a system without multi-factor authentication that has no approved exception reads as a control failure, while one with an approved, unexpired exception and working compensating controls reads as a managed decision. What any one firm asks for varies.
- How long can an exception last?
- The Policyseed policies set a maximum of 12 months, and the Vulnerability and Patch Management Policy sets 90 days for findings that miss their remediation deadline. The register proposes 90 days after approval by default, with a review 30 days before expiry. When an exception expires it is re-justified with a new request, not extended in place.
- Who approves an exception?
- The Security Owner, in writing, and the approver named in your generator answers as well when customer data is affected (Information Security Policy section 6). Some policies add an approver or rule out certain exceptions entirely; the Policy Rules sheet of the register and page 2 of the form quote each one.
- Why does my register have draft rows already?
- Some answers mean your own policies call for a dated plan instead of an operating control: multi-factor authentication not yet on every account, no device management platform, no identity provider, or a team of 1 to 10 people without a staffed on-call rotation or a second reviewer for every change. Each draft quotes the policy sentence it comes from. Confirm and approve it, or delete it if it does not apply.
- Is anything uploaded?
- No. Your generator answers stay in this browser's local storage, the policies are rendered here, and the Excel and Word files are built here. Without saved answers the page uses the sample company, Northwind Cloud Inc.
Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.