Exception battlecards
Recall the response patterns that keep policy exceptions scoped, conditioned, and evidenced.
Revenue pressure It is a strategic customer, so we need to approve the exception. A stakeholder wants business value to override the policy standard. Your line We can weigh the business value, but the decision still needs scope, compensating controls, residual-risk approval, and an expiry date. Do not let revenue become an undocumented risk acceptance. It acknowledges commercial stakes while keeping the ISO 31000 risk-treatment structure. Reflex vs move What is the better response to 'just this once'? One-time is only real when the record names its boundaries. Four fields What four fields should every exception record include? Scope, condition,…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in